[Madderc]

Ok so I'm currently working at a gas station for the heck of it.

Software looks super old, windows XP, and the gas pumps themselves must be older than I am (at LEAST pre 2000).

Today a pump went crazy and instead of pricing something at 1.354 it priced it at 5€ per Liter which was insane lmao.

The result? Tech guys called after I contacted my boss about the issue.

So a few things, first they can get access to the POS without you even getting a prompt or anything, the cursor will just start moving (They use TeamViewer, didn't even knew you could do that without any sort of warning or popup), then he started fiddling around and logged into admin or Master or something (which is a basic/obvious number for login and no clue if they have any check on injections there), and started looking at the Database.

I asked if it was SQL and he said it was, after looking around a bit he found the thingy with the issue (which I hadn't cashed out yet) and he changed the Price as well as the Liters used just like that.

I also asked if they usually hire pentesters to test their system, he said no and something along the lines of it not being necessary or that they basically just handle customer receipts and stuff so no biggie (Mind you it also contains data such as the Tax Numbers, addresses, etc of some customers).

And I also said I found it weird that they can just connect automatically without any warning, to which he said it's not a problem because it needs a password lol.

Now here's the thing.

I admit I don't really have any clue how one would go about hacking this, I just know a few basics about SQL injection and such, but given how old the software is and whatnot it doesn't really seem well protected or anything like that, and I can imagine someone with a laptop getting a full tank of fuel, hacking into the POS and altering the price/Liters/etc so they only pay like 10€ without anyone noticing (it allows self service).

So yeah lol, wanted to share this.


As a side note however, imagine if I wanted to test if they are really vulnerable and find something, if I report it to them is there any sort of legal issue I could get myself into even if my intent is just to pentest? For this I would obviously get the software for myself, not try it on the work computer.

[Dismas]

Only possible vulnerabilities are the outdated OS/Teamviewer password. Can't exactly do an injection-based attack if there's no web-based input.

[Madderc]

Only possible vulnerabilities are the outdated OS/Teamviewer password. Can't exactly do an injection-based attack if there's no web-based input.

well the whole system is connected to the internet, I think it has wifi but was turned off I believe, they do have Wifi there though

[Boudica]

That's concerning.. Although, many companies are lacking in the security department, so I wouldn't be surprised.

Not sure what legal ramifications would be.

[Kludge]

rofl
You expected the people in charge of the POS system to want anything to do with the rest of your systems?
The pumps are the job of the pump techs. The POS is taken care of by the local POS system providers. Everything else is worked on by whatever contractor your wack store hired to take care of cooling, plumbing, and electrics.
I am only saying these things concretely because I've worked for a POS installation/support company and the amount of times, "That's not in my job description," came out of my mouth disgusted me, but was also completely a completely reasonable thing to do. Fixing the pumps? Not my job at all. I modify a Windows back-end to take care of CC's and barcodes, not reprogram petrol pumps.
You can probably use the most out of date and nowadays useless privilege escalations to gain total control of you work's computer system, and even, theoretically, skim tiny amounts off purchases while making the count correct.
The only time the pump techs and POS techs should be working together is when signals need to be translated and transported between the two, very very different systems.

[mothered]

Judging by what's written, It seems quite vulnerable to a combination of technical and social engineering exploits.

[Madderc]

rofl
You expected the people in charge of the POS system to want anything to do with the rest of your systems?
The pumps are the job of the pump techs. The POS is taken care of by the local POS system providers. Everything else is worked on by whatever contractor your wack store hired to take care of cooling, plumbing, and electrics.
I am only saying these things concretely because I've worked for a POS installation/support company and the amount of times, "That's not in my job description," came out of my mouth disgusted me, but was also completely a completely reasonable thing to do. Fixing the pumps? Not my job at all. I modify a Windows back-end to take care of CC's and barcodes, not reprogram petrol pumps.
You can probably use the most out of date and nowadays useless privilege escalations to gain total control of you work's computer system, and even, theoretically, skim tiny amounts off purchases while making the count correct.
The only time the pump techs and POS techs should be working together is when signals need to be translated and transported between the two, very very different systems.

I mean I understand what you just said and I agree, but totally not the point I was trying to make lmao.

Their very own software allows you to easily access the Database and change the price/amount/etc of any open tabs, so even if it's JUST the POS that is compromised, it still seems very insecure*...


(Tried talking to it on dinner, it didn't respond)

[samjr]

Curious, where do you w0rk? :O

[mothered]

Their very own software allows you to easily access the Database and change the price/amount/etc of any open tabs, so even if it's JUST the POS that is compromised, it still seems very insecure*...

I'm at a loss as to why they don't opt for the simplicity of updating their software.

Critical data Is at risk, yet they fail to protect It.

[Boudica]

Their very own software allows you to easily access the Database and change the price/amount/etc of any open tabs, so even if it's JUST the POS that is compromised, it still seems very insecure*...

I'm at a loss as to why they don't opt for the simplicity of updating their software.

Critical data Is at risk, yet they fail to protect It.

It'll take a focusing event to cause companies like that to change. Once someone decides to do damage, they will likely change it then