Why POS Systems Are More Than Just Checkouts<\/h2>\n\n\n\n
At first glance, many POS systems appear highly restricted. Only the functions required for the respective use case are visible. In the background, however, these systems often access product databases, communicate with payment service providers, exchange data with backend systems, or are connected to corporate domains.<\/p>\n\n\n\n
What may initially appear to be a standalone system is often part of an infrastructure with numerous connections to other applications and systems.<\/p>\n\n\n\n
The First Step: Breaking Out of Kiosk Mode<\/h2>\n\n\n\n
A central part of many pentests is checking the kiosk mode. The objective is to determine whether the intended restrictions can be bypassed and whether additional system functions become accessible as a result.<\/p>\n\n\n\n
In practice, however, we repeatedly see that such restrictions can be bypassed. Potential entry points include:<\/p>\n\n\n\n
- \n
- Unlocked keyboard shortcuts<\/li>\n\n\n\n
- Incorrect input that puts the application into an unexpected state<\/li>\n\n\n\n
- Insufficiently secured operating system functions<\/li>\n\n\n\n
- Applications or tools that are not required for operation, such as terminal emulators or administration tools<\/li>\n<\/ul>\n\n\n\n
A pentest does not only examine whether such a breakout is possible. It also assesses which additional access and escalation options could result from it.<\/p>\n\n\n\n
<\/div>\n\n\n\nThe Often Underestimated Risk of Physical Attacks<\/h2>\n\n\n\n
POS systems differ from many other corporate systems because of where they are used. They are often located in places where many people move freely every day and can interact with them directly, such as self-checkout terminals, ticket machines, or other self-service systems. Unlike traditional endpoint devices, they are often placed in publicly accessible areas and are not permanently supervised. This creates potential entry points that are not relevant for many other corporate systems.<\/p>\n\n\n\n
It is precisely the combination of physical access and network connectivity that makes these systems attractive to attackers. Security measures that are standard in data centers or office environments cannot always be implemented in the same way at a self-service checkout.<\/p>\n\n\n\n
That is why pentests also examine a system\u2019s physical attack surface. This includes, among other things:<\/p>\n\n\n\n
- \n
- USB ports<\/li>\n\n\n\n
- Ethernet ports<\/li>\n\n\n\n
- Service and maintenance interfaces<\/li>\n\n\n\n
- BIOS and boot configurations<\/li>\n<\/ul>\n\n\n\n
If these components are not sufficiently secured, they can create additional entry points or bypass existing security measures. In our pentests, we repeatedly see that unprotected USB ports or maintenance interfaces alone can be enough to bypass existing safeguards.<\/p>\n\n\n\n
<\/div>\n\n\n\nAccess to the Operating System Is Not the End of the Attack<\/h2>\n\n\n\n
For attackers, access to the operating system is often only the first step. They then frequently try to escalate their privileges and gain access to additional resources.<\/p>\n\n\n\n
The techniques used for this often differ only slightly from attacks in traditional Windows environments. Vulnerabilities in the operating system, insecure configurations, or overprivileged user accounts can help attackers expand their options.<\/p>\n\n\n\n
For this reason, operating system hardening also plays an important role for POS systems. A securely configured kiosk mode alone is not enough if attackers can gain additional privileges in other ways.<\/p>\n\n\n\n
<\/div>\n\n\n\nFrom the POS System into the Corporate Network<\/h2>\n\n\n\n
The situation becomes particularly critical when POS systems are directly connected to a corporate network, are part of a corporate domain, or have extensive network connections. In such scenarios, a compromised POS system can become the starting point for further attacks.<\/p>\n\n\n\n
If these systems are not sufficiently segmented, other systems may be reachable from there. These include:<\/p>\n\n\n\n
- \n
- other POS systems<\/li>\n\n\n\n
- backend systems<\/li>\n\n\n\n
- databases<\/li>\n\n\n\n
- employee endpoints<\/li>\n\n\n\n
- server infrastructures<\/li>\n<\/ul>\n\n\n\n
In the worst case, attackers move step by step through the environment and continue to extend their privileges. As a result, an incident that starts at a single checkout can affect significantly larger parts of the infrastructure. This means that not only IT systems may be impacted, but also the business processes that depend on them.<\/p>\n\n\n\n
<\/div>\n\n\n\n\n\n\n
\"When performing pentests of POS systems, we do not only look at the kiosk application itself. It usually becomes most interesting when we consider the entire system environment. This is where we often see what impact a compromise could actually have. Companies gain a sound basis for assessing risks and prioritizing security measures.\"<\/p>\n\n\n\n
<\/div>\n\n\n\nSamir Benzammour, Senior Consultant IT Security, usd AG<\/em><\/p>\n<\/blockquote>\n<\/div>\n\n\n\n
\n![\"\"](\"https:\/\/www.usd.de\/wp-content\/uploads\/Samir-Benzammour-1024x1024.png\")
<\/figure>\n<\/div>\n<\/div>\n\n\n\n<\/div>\n\n\n\nWhy Kiosk Pentests and Active Directory Pentests Belong Together<\/h2>\n\n\n\n
POS systems are usually connected to a domain on-site, allowing administrators and service providers to maintain and update the systems remotely. However, this connection also introduces risks. If attackers manage to compromise a POS system, they may also gain additional permissions within the domain, significantly expanding the potential attack surface. A pentest of the POS system shows whether the device can be abused as an entry point and what attack vectors are associated with it. An Active Directory Pentest<\/a>, on the other hand, assesses what impact such an entry point could have within the corporate environment.<\/p>\n\n\n\n
Among other things, this includes analyzing trust relationships, permissions, and misconfigurations within the domain. Only the combination of both security analyses provides a holistic view of the risks and their potential impact on the company.<\/p>\n\n\n\n
<\/div>\n\n\n\nWhich Measures Often Improve POS System Security?<\/h2>\n\n\n\n
The results of a pentest usually provide specific guidance on how to secure the systems. The objective is not only to prevent a breakout from kiosk mode but also to limit the impact of a possible compromise. A pentest is particularly useful when POS systems are publicly accessible, for example, as self-checkout solutions or kiosk applications, communicate with additional backend systems or are directly integrated into corporate networks and Active Directory environments. Common measures include:<\/p>\n\n\n\n
- \n
- consistent restriction of kiosk mode<\/li>\n\n\n\n
- deactivation of functions and applications that are not required<\/li>\n\n\n\n
- protection of physical interfaces<\/li>\n\n\n\n
- minimum user privileges<\/li>\n\n\n\n
- operating system hardening<\/li>\n\n\n\n
- network segmentation and the most restrictive domain connection possible<\/li>\n\n\n\n
- secure update and maintenance processes<\/li>\n<\/ul>\n\n\n\n
Which measures are appropriate depends on the specific system landscape and the risks identified. The objective should always be to reduce the attack surface as much as possible. POS systems should therefore not be considered trusted by default. They should only be able to access the systems and resources that are actually required for their operation.<\/p>\n\n\n\n
<\/div>\n\n\n\nLooking Beyond the Checkout<\/h2>\n\n\n\n
Modern POS systems, self-checkout solutions, and kiosk applications are no longer isolated devices. Their security, therefore, often affects much more than a single sales or service process.<\/p>\n\n\n\n
For this reason, a pentest of POS systems is often not only about uncovering individual vulnerabilities. Rather, it provides the basis for making informed decisions on how to secure POS systems and the systems connected to them.<\/p>\n\n\n\n