News for hackers. Stuff that matters.

A comment on How I got a Root Shell on a Credit Card Terminal. Parent comment

Re:How I got a Root Shell on a Credit Card Terminal by dijit on Sunday June 01, 2025 @03:29PM (#44153205)
How does the binary signing work?

I’m not looking to hack anything, but it sounds cool to have signed binaries only on linux!!

[ Parent | on HN ]
Re:How I got a Root Shell on a Credit Card Terminal by _djo_ on Sunday June 01, 2025 @05:10PM (#44153776)
Varies from manufacturer to manufacturer. This is Ingenico's approach, for instance: https://ingenico.com/en/products-services/services/security-...
[ Parent | on HN ]
Re:How I got a Root Shell on a Credit Card Terminal by shakna on Sunday June 01, 2025 @05:14PM (#44153799)
Whilst I'm sure they use something else, Linux does have an experimental extension, "Integrity Measurement Architecture" extension that allows you to sign and verify RSA keys against every binary.
[ Parent | on HN ]
Re:How I got a Root Shell on a Credit Card Terminal by zoobab on Monday June 02, 2025 @05:57AM (#44157230)
ah good to know, I wanted that feature back in 2018 :-)
[ Parent | on HN ]
Re:How I got a Root Shell on a Credit Card Terminal by lelanthran on Monday June 02, 2025 @12:51AM (#44155898)
Varies from vendor to vendor; signed-binaries-only is part of the certification process but the exact mechanism itself is not (or maybe that has changed, not sure).

The way it worked in 2003 (when I first wrote EMV applications) was, when we have a binary that we are ready to deploy, we ship that binary to the manufacturer (Schlumbeger(sp?), at that time), if it passes cert-testing, they sign it and ship it back and that's what we would program the terminals with.

The way it works now is pretty much the same - we build an APK bundle, send it to the manufacturer (Verifone, Pax, etc) and after signing they make it available on their appstore which their terminal can access.

[ Parent | on HN ]