6 ms·

From what I’ve read, this is exactly what I was thinking too - this has POS/till malware written all over it. I look forward to getting some of the more technic

From what I’ve read, this is exactly what I was thinking too - this has POS/till malware written all over it. I look forward to getting some of the more technical details (if they get realised) to see exactly how widespread this issue was.

sofaofthedamned 8y ago
Last time I looked their POS systems ran Windows XP. I wonder if this is still the case? Some parts of it seem to go through an old school terminal emulator, but others seem to be custom Windows apps and webpages using Internet Explorer. For a company selling the latest tech they seemed woefully out of date.
- gsnedders 8y ago
  Are you sure it wasn't running Windows Embedded POSReady 2009, which is based on XP SP3 and supported by MS until next year?
  - sofaofthedamned 8y ago
    Didn't seem to be any different than normal XP from what I saw. Could be completely incorrect though!
    - gsnedders 8y ago
      I have no actual knowledge here; it's just worthwhile remembering there are XP-derivative OSes that are still supported!
- walshemj 8y ago
  1 Its a mobile company 2 Its really a big box store with even less grasp of security than real Mobile operators who are not as serious about security as traditional telco's
  - Rjevski 8y ago
    I worked at a large UK mobile operator around the end of 2015. The "security" there was a nightmare. They were inputting customer data into Windows XP machines with Internet Explorer (probably 7 or 8), Flash and Java. For credit checks they were also swiping card's magstripes into the same machine (I no longer remember if they were also manually typing the CVV). The staff could and did also use the machines for web browsing like resetting a customer's Apple or Google account password, etc.
    - zxcmx 8y ago
      I’m going to assume you are talking about retail since you describe card-present transactions. Retail is hard. Surprisingly genuinely hard. When you have hundreds or thousands of outlets, some of them are special, you have wacky hardware, stuff is potentially updated over WAN, you often have a varied hardware fleet, retraining hundreds or thousands of operators is damn near impossible, your stuff was stuck together with sticky tape in the first place and meanwhile the customer is in the reps face tapping their feet or walking out on a sale because “the new system is acting up”. There are a lot of orgs eating a ton of risk on the retail end just because the problem is so messy and expensive to fix.
      - Rjevski 8y ago
        Yep I am talking about retail! > you have wacky hardware They were using standard desktop PCs, not sure what you mean by that. > stuff is potentially updated over WAN They had a Cisco router in the shop that VPN'ed back to the mothership, so as far as the computers are concerned they were all on one big LAN and don't have to worry about its security (as long as the VPN is configured correctly - which for such a company is a quite a big if). > retraining hundreds or thousands of operators is damn near impossible Make the web app intuitive enough to not require any training? Strangely, I never hear people needing any "training" to use the latest Facebook or Snapchat - maybe the real answer is to actually hire a competent UX designer? > your stuff was stuck together with sticky tape in the first place True, but then again this problem needs to be solved. Putting tons of customers at risk and praying that they don't get compromised is unacceptable. > the new system is acting up I am not sure if they can do worse than the old system. It was routinely throwing Java stack traces all over the place (from the server) filled with confidential info. Not to mention, none of this excuses having outdated IE, Java & Flash, and unrestricted outbound internet access on those machines.
- kennydude 8y ago
  Last I looked Carphone Warehouse were using DOS
  - sofaofthedamned 8y ago
    I know what you mean but that actually seemed to be some sort of remote terminal rather than dos.
  - morrisirwin 8y ago
    That's not DOS. It's a telnet session to a VMS server. The epos runs windows which simply runs a telnet client.
- sleavey 8y ago
  I worked there around the time of end of support for XP and there was no reason to suspect they were upgrading. What's weird is that it was clearly written in Java so in theory it shouldn't have been too difficult to upgrade the platform. Probably it was a driver issue with the receipt printers or touchscreen monitors.

sofaofthedamned 8y ago

Last time I looked their POS systems ran Windows XP. I wonder if this is still the case? Some parts of it seem to go through an old school terminal emulator, but others seem to be custom Windows apps and webpages using Internet Explorer. For a company selling the latest tech they seemed woefully out of date.

gsnedders 8y ago
Are you sure it wasn't running Windows Embedded POSReady 2009, which is based on XP SP3 and supported by MS until next year?
- sofaofthedamned 8y ago
  Didn't seem to be any different than normal XP from what I saw. Could be completely incorrect though!
  - gsnedders 8y ago
    I have no actual knowledge here; it's just worthwhile remembering there are XP-derivative OSes that are still supported!
walshemj 8y ago
1 Its a mobile company 2 Its really a big box store with even less grasp of security than real Mobile operators who are not as serious about security as traditional telco's
- Rjevski 8y ago
  I worked at a large UK mobile operator around the end of 2015. The "security" there was a nightmare. They were inputting customer data into Windows XP machines with Internet Explorer (probably 7 or 8), Flash and Java. For credit checks they were also swiping card's magstripes into the same machine (I no longer remember if they were also manually typing the CVV). The staff could and did also use the machines for web browsing like resetting a customer's Apple or Google account password, etc.
  - zxcmx 8y ago
    I’m going to assume you are talking about retail since you describe card-present transactions. Retail is hard. Surprisingly genuinely hard. When you have hundreds or thousands of outlets, some of them are special, you have wacky hardware, stuff is potentially updated over WAN, you often have a varied hardware fleet, retraining hundreds or thousands of operators is damn near impossible, your stuff was stuck together with sticky tape in the first place and meanwhile the customer is in the reps face tapping their feet or walking out on a sale because “the new system is acting up”. There are a lot of orgs eating a ton of risk on the retail end just because the problem is so messy and expensive to fix.
    - Rjevski 8y ago
      Yep I am talking about retail! > you have wacky hardware They were using standard desktop PCs, not sure what you mean by that. > stuff is potentially updated over WAN They had a Cisco router in the shop that VPN'ed back to the mothership, so as far as the computers are concerned they were all on one big LAN and don't have to worry about its security (as long as the VPN is configured correctly - which for such a company is a quite a big if). > retraining hundreds or thousands of operators is damn near impossible Make the web app intuitive enough to not require any training? Strangely, I never hear people needing any "training" to use the latest Facebook or Snapchat - maybe the real answer is to actually hire a competent UX designer? > your stuff was stuck together with sticky tape in the first place True, but then again this problem needs to be solved. Putting tons of customers at risk and praying that they don't get compromised is unacceptable. > the new system is acting up I am not sure if they can do worse than the old system. It was routinely throwing Java stack traces all over the place (from the server) filled with confidential info. Not to mention, none of this excuses having outdated IE, Java & Flash, and unrestricted outbound internet access on those machines.
kennydude 8y ago
Last I looked Carphone Warehouse were using DOS
- sofaofthedamned 8y ago
  I know what you mean but that actually seemed to be some sort of remote terminal rather than dos.
- morrisirwin 8y ago
  That's not DOS. It's a telnet session to a VMS server. The epos runs windows which simply runs a telnet client.
sleavey 8y ago
I worked there around the time of end of support for XP and there was no reason to suspect they were upgrading. What's weird is that it was clearly written in Java so in theory it shouldn't have been too difficult to upgrade the platform. Probably it was a driver issue with the receipt printers or touchscreen monitors.