10 ms·

Once I scanned barcodes from a competing store rewards program into a PointOfSale terminal of a grocery store. The machine promptly shutdown. Sometimes I wonde

Once I scanned barcodes from a competing store rewards program into a PointOfSale terminal of a grocery store. The machine promptly shutdown. Sometimes I wonder if that was a failure mode to prevent attacks or a lack of sanitizing inputs.

ct0 5y ago
Similar to airplane phone in the late 90's using a calling card. While the asked for a calling card number, the system didn't actually confirm that there was any money on the card itself and just connected to the person you were calling.
- exikyut 5y ago
  That actually makes sense, the logic there would be that the on-plane system just captured the card number and an on-the-ground system was responsible for checking and billing. Given that 747s (IIRC) are still using floppy disks (https://google.com/search?q=747+floppy+disks https://google.com/search?q=747+floppy+disks) the chances are the billing was probably done by some equally byzantine process. Yes, I'm saying that, despite the fact that "capture calling card number for later using on-plane PBX, establish satellite call directly to dialed number" and "establish satellite call directly to on-ground PBX, which asks for calling card number and forwards call" both ultimately return TRUE for "but users can trigger our satellite uplink to initiate connections just by picking up the phone!!1"... but the latter approach actually blocks illegitimate use and is thus measurably better, and skips the need for an on-plane PBX too. I can't help but wonder if there was some sort of "capture the number first before initiating the call" initiative early on (which totally makes sense), only for the calling-card billing integration to fall through at some point rendering the whole approach moot. Naturally I'm making a lot of assumptions here, the biggest being that the plane isn't just making a direct-to-ground connection the moment you pick up the phone, with an on-ground system accepting then forgetting the calling card number. That would be even more stupefying but I do doubt that's what was happening.
  - jedberg 5y ago
    I'm amused that you linked to a google search for a floppy disk.
    - woleium 5y ago
      A buddy's son exclaimed "oh, cool, you 3d printed the save icon" on seeing a floppy for the first time.
      - killingtime74 5y ago
        We old
      - copperx 5y ago
        That raises the question: are there any proposals for replacing the diskette icon? At what point are we going to make the change?
        ncmncm 5y ago
        Change it to what?
        jwagenet 5y ago
        I think I have seen as icons CDs, hard drives, usb sticks, sd cards... which may be varying levels of obsolete depending on audience.
        copperx 5y ago
        A cloud might do the job.
        ncmncm 5y ago
        "Make your data go 'poof!'"?
isoprophlex 5y ago
In the early days of our local rfid-powered public transport payment system, i tried scanning a random misc rfid card from my wallet instead of the correct payment card. The gate locked up and started screeching its "i scanned a card" chime on loop. It was hilarious... and i guess a matter of poorly sanitized inputs.
Hamuko 5y ago
Sounds like a pretty easy way to do a denial-of-service attack against a grocery store if you can just shut down a bunch of terminals with a barcode. I guess you'll stand out a fair bit if you move from PoS to PoS, scanning a barcode.
- throwaway48375 5y ago
  You could just print them on stickers and put them on random items.
- flerchin 5y ago
  I suppose it would be considered vandalism. "but i just scanned a barcode" will not amuse the judge.
  - Mountain_Skies 5y ago
    If nothing else, the store could ban you and have you arrested for trespass if you ever came back.
- fortran77 5y ago
  You can shut down all sorts of things with the EICAR string encoded as a QR code. See: https://en.wikipedia.org/wiki/EICAR_test_file https://en.wikipedia.org/wiki/EICAR_test_file and this video https://www.youtube.com/watch?v=cIcbAMO6sxo https://www.youtube.com/watch?v=cIcbAMO6sxo where all the gates at a parking garage are rendered inoperable because someone scanned a QR code that encoded EICAR
- pessimizer 5y ago
  You could stick the barcode on tons of random items in the store.
- Maursault 5y ago
  The barcode register attack was explored in a episode of The X-Files titled Duane Barry (2x05; 14 Oct 1994), when Special Agent Dana Scully scans a chip (that had been found implanted in her neck and subsequently removed) at a grocery store checkout scanner, and iirc all the registers went berserk. So this is definitely a thing.
Mountain_Skies 5y ago
Most of the stores where I live allow you to scan other stores rewards cards. You don't get points on your account but you still get whatever sale prices that are reserved for reward card holders. Wonder if in your case the store supported this function but there was a null or something similar in the record for that card type.
- heywire 5y ago
  Most retailers use the same ranges for their rewards cards, UPC-A barcodes starting with 4. So even if not intentional, if their system is configured to allow an unregistered card to receive discounts, doesn't validate registration at all, or the number collides with a legitimate rewards card, you'll receive the sale pricing. Similarly, if you simply use a common phone number like xxx-867-5309, 800-555-1212, the store's phone number, etc., you'll probably get discounts too.
  - rhino369 5y ago
    At the store I worked at 15 years ago, any 4xxxxxxxxxx code would give you the loyalty program. No reason to authenticate, they'll give you the "discount" (hint its not really a discount) even if you just ask.
flir 5y ago
> The machine promptly shutdown. I have a credit card that bluescreens (some) PoS terminals. I theorize the upstream server is returning a rare error code when it's used in contactless mode, because that account's never been approved for contactless. In that case I'm going with lack of sanitizing inputs.
- MBCook 5y ago
  That’s quite strange. There s a very rigorous certification process such terminals are supposed to go through.
  - posguy 5y ago
    Terminals that only supported the first version of tap to pay in the USA often have this bug when activated by a card from this first version of tap to pay.
myself248 5y ago
Lack of sanitizing inputs. Barcode scanners are hilariously bad, look up "scan tags" for why. Q: This barcode scanner has a million options, how do we configure them? A: By showing configuration barcodes to it!
- Eduard 5y ago
  Looked up "scan tags", didn't find anything. Can you clarify?
  - cliffwarden 5y ago
    A lot of them are configured by literally scanning settings. These "settings" barcodes are often left out in the open, or east to recreate. I used to have a "cheat sheet" when i managed scanners in a warehouse https://downloads.dell.com/manuals/all-products/esuprt_tab_mob/esuprt_tablets/latitude-7202-tablet_reference%20guide8_en-us.pdf https://downloads.dell.com/manuals/all-products/esuprt_tab_m...
  - isaac21259 5y ago
    [1] Is what (I believe) they were talking about. Rather than configuring these in a sane way you just scan configuration barcodes. I didn't see anything on the list that was too dangerous but you could change the maximum input length or allow full ASCII encoding which could be dangerous if the programmers assumed that the barcode reader returns a fixed length string of numbers. [1] https://cdn.sparkfun.com/assets/b/5/0/e/e/DY_Scan_Setting_Manual-DE2120___19.4.6___.pdf https://cdn.sparkfun.com/assets/b/5/0/e/e/DY_Scan_Setting_Ma...
    - Groxx 5y ago
      honestly that sounds like a super-convenient and easy to use approach. field-configuring in an instant without any specialized hardware is great. ... but yeah, it should require pressing a recessed button with a pin or something. not allow it all the time.
      - 5y ago

ct0 5y ago

Similar to airplane phone in the late 90's using a calling card. While the asked for a calling card number, the system didn't actually confirm that there was any money on the card itself and just connected to the person you were calling.

exikyut 5y ago
That actually makes sense, the logic there would be that the on-plane system just captured the card number and an on-the-ground system was responsible for checking and billing. Given that 747s (IIRC) are still using floppy disks (https://google.com/search?q=747+floppy+disks https://google.com/search?q=747+floppy+disks) the chances are the billing was probably done by some equally byzantine process. Yes, I'm saying that, despite the fact that "capture calling card number for later using on-plane PBX, establish satellite call directly to dialed number" and "establish satellite call directly to on-ground PBX, which asks for calling card number and forwards call" both ultimately return TRUE for "but users can trigger our satellite uplink to initiate connections just by picking up the phone!!1"... but the latter approach actually blocks illegitimate use and is thus measurably better, and skips the need for an on-plane PBX too. I can't help but wonder if there was some sort of "capture the number first before initiating the call" initiative early on (which totally makes sense), only for the calling-card billing integration to fall through at some point rendering the whole approach moot. Naturally I'm making a lot of assumptions here, the biggest being that the plane isn't just making a direct-to-ground connection the moment you pick up the phone, with an on-ground system accepting then forgetting the calling card number. That would be even more stupefying but I do doubt that's what was happening.
- jedberg 5y ago
  I'm amused that you linked to a google search for a floppy disk.
  - woleium 5y ago
    A buddy's son exclaimed "oh, cool, you 3d printed the save icon" on seeing a floppy for the first time.
    - killingtime74 5y ago
      We old
    - copperx 5y ago
      That raises the question: are there any proposals for replacing the diskette icon? At what point are we going to make the change?
      - ncmncm 5y ago
        Change it to what?
        jwagenet 5y ago
        I think I have seen as icons CDs, hard drives, usb sticks, sd cards... which may be varying levels of obsolete depending on audience.
        copperx 5y ago
        A cloud might do the job.
        ncmncm 5y ago
        "Make your data go 'poof!'"?

isoprophlex 5y ago

In the early days of our local rfid-powered public transport payment system, i tried scanning a random misc rfid card from my wallet instead of the correct payment card. The gate locked up and started screeching its "i scanned a card" chime on loop. It was hilarious... and i guess a matter of poorly sanitized inputs.

Hamuko 5y ago

Sounds like a pretty easy way to do a denial-of-service attack against a grocery store if you can just shut down a bunch of terminals with a barcode. I guess you'll stand out a fair bit if you move from PoS to PoS, scanning a barcode.

throwaway48375 5y ago
You could just print them on stickers and put them on random items.
flerchin 5y ago
I suppose it would be considered vandalism. "but i just scanned a barcode" will not amuse the judge.
- Mountain_Skies 5y ago
  If nothing else, the store could ban you and have you arrested for trespass if you ever came back.
fortran77 5y ago
You can shut down all sorts of things with the EICAR string encoded as a QR code. See: https://en.wikipedia.org/wiki/EICAR_test_file https://en.wikipedia.org/wiki/EICAR_test_file and this video https://www.youtube.com/watch?v=cIcbAMO6sxo https://www.youtube.com/watch?v=cIcbAMO6sxo where all the gates at a parking garage are rendered inoperable because someone scanned a QR code that encoded EICAR
pessimizer 5y ago
You could stick the barcode on tons of random items in the store.
Maursault 5y ago
The barcode register attack was explored in a episode of The X-Files titled Duane Barry (2x05; 14 Oct 1994), when Special Agent Dana Scully scans a chip (that had been found implanted in her neck and subsequently removed) at a grocery store checkout scanner, and iirc all the registers went berserk. So this is definitely a thing.

Mountain_Skies 5y ago

Most of the stores where I live allow you to scan other stores rewards cards. You don't get points on your account but you still get whatever sale prices that are reserved for reward card holders. Wonder if in your case the store supported this function but there was a null or something similar in the record for that card type.

heywire 5y ago
Most retailers use the same ranges for their rewards cards, UPC-A barcodes starting with 4. So even if not intentional, if their system is configured to allow an unregistered card to receive discounts, doesn't validate registration at all, or the number collides with a legitimate rewards card, you'll receive the sale pricing. Similarly, if you simply use a common phone number like xxx-867-5309, 800-555-1212, the store's phone number, etc., you'll probably get discounts too.
- rhino369 5y ago
  At the store I worked at 15 years ago, any 4xxxxxxxxxx code would give you the loyalty program. No reason to authenticate, they'll give you the "discount" (hint its not really a discount) even if you just ask.

flir 5y ago

> The machine promptly shutdown. I have a credit card that bluescreens (some) PoS terminals. I theorize the upstream server is returning a rare error code when it's used in contactless mode, because that account's never been approved for contactless. In that case I'm going with lack of sanitizing inputs.

MBCook 5y ago
That’s quite strange. There s a very rigorous certification process such terminals are supposed to go through.
- posguy 5y ago
  Terminals that only supported the first version of tap to pay in the USA often have this bug when activated by a card from this first version of tap to pay.

myself248 5y ago

Lack of sanitizing inputs. Barcode scanners are hilariously bad, look up "scan tags" for why. Q: This barcode scanner has a million options, how do we configure them? A: By showing configuration barcodes to it!

Eduard 5y ago
Looked up "scan tags", didn't find anything. Can you clarify?
- cliffwarden 5y ago
  A lot of them are configured by literally scanning settings. These "settings" barcodes are often left out in the open, or east to recreate. I used to have a "cheat sheet" when i managed scanners in a warehouse https://downloads.dell.com/manuals/all-products/esuprt_tab_mob/esuprt_tablets/latitude-7202-tablet_reference%20guide8_en-us.pdf https://downloads.dell.com/manuals/all-products/esuprt_tab_m...
- isaac21259 5y ago
  [1] Is what (I believe) they were talking about. Rather than configuring these in a sane way you just scan configuration barcodes. I didn't see anything on the list that was too dangerous but you could change the maximum input length or allow full ASCII encoding which could be dangerous if the programmers assumed that the barcode reader returns a fixed length string of numbers. [1] https://cdn.sparkfun.com/assets/b/5/0/e/e/DY_Scan_Setting_Manual-DE2120___19.4.6___.pdf https://cdn.sparkfun.com/assets/b/5/0/e/e/DY_Scan_Setting_Ma...
  - Groxx 5y ago
    honestly that sounds like a super-convenient and easy to use approach. field-configuring in an instant without any specialized hardware is great. ... but yeah, it should require pressing a recessed button with a pin or something. not allow it all the time.
    - 5y ago