Mission mPOSsible
summary
Research demonstrates code execution on consumer mPOS terminals by chaining three real vectors: a firmware update handler that triggers on USB unplug, Bluetooth file-upload reuse of that same flaw, and an EMV fuzzed malicious credit card that exploits a 180‑byte stack overflow. Exploits achieve remote root shell and persist by replacing the payment app (demo runs Flappy Bird), enable PIN skimming, and phone‑based C2. About 75% of devices share the same Linux platform so the flaws are widely applicable.
AI-written summary · about
chapters (25)
- 0:00Intro
- 0:18Agenda
- 2:10Apple
- 2:35emboss
- 3:07transaction fees
- 3:38Square
- 4:47Chip and Sign
- 5:27Chip and PIN
- 7:12Popular brands
- 8:08Hardware overview
- 9:24Interface overview
- 10:09Internal filesystem
- 12:00Software updates
- 13:05Vulnerability demo
- 15:40Bluetooth
- 16:40Bluetooth over USB
- 17:43Bluetooth over Linux
- 19:18Friendly blue light
- 19:41EMV
- 23:06EMV Buffer Overflow
- 23:40Demonstration
- 28:28Exploit
- 29:22Attack
- 33:23Vendors
- 34:34Conclusion
related talks
44mExposing Critical Threats In Millions Of Connected Devices
50mBreaking Payment Points of Interaction (POI)
23mAll Your Payment Tokens Are Mine: Vulnerabilities of Mobile Payment Systems
24mPicking Up My Tab...
40mBiohacking: The Invisible Threat
37mFirst Contact - Vulnerabilities in Contactless Payments
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem
36mOut Of The Box Exploitation Breaking The Trust Chain Of The Ethereum Phone