News for hackers. Stuff that matters.

A comment on How I got a Root Shell on a Credit Card Terminal. Parent comment

Re:How I got a Root Shell on a Credit Card Terminal by nine_k on Sunday June 01, 2025 @05:34PM (#44153893)
Someone with a root access to a card reader could just make it collect CC details with every transaction, no caches needed. It could also make certain transactions "temporarily fail", while siphoning a certain amount of funds to another, legit-looking, merchant under the hood.
[ Parent | on HN ]
Re:How I got a Root Shell on a Credit Card Terminal by jhugo on Monday June 02, 2025 @03:16AM (#44156413)
> could just make it collect CC details with every transaction

Only if the card is swiped (magnetic stripe) rather than tapped or inserted. EMV doesn't expose the full card details to the merchant; the card signs a payload with its internal private key and transmits it.

And the OP's root access wouldn't give card details in any case, because they didn't get root on the part of the reader that processes the transactions.

[ Parent | on HN ]