3 ms·

Nation wide disruption with Verifone H5000 payment terminals in Germany

17 points by usr1106 4y ago

riedel 4y ago
Sounds very much like history repeating [1]. They still cannot provide a stable fix and claim that it is not a certificate problem in their communication to users. This is somehow unlikely as this would also explain why remote updates won't work. Wonder what the lessons learned can be (if this is true): always have two update sites with a different cert path? Is this something that is a standardized best practice? [1] https://desormaismgt.com/may-2019-verifone-vx520-certificate-malfunction/ https://desormaismgt.com/may-2019-verifone-vx520-certificate...
AlexSail 4y ago
This is not a "german" issue. . https://www.stripes.com/theaters/europe/2022-05-27/aaefes-esso-credit-card-outage-6146620.html https://www.stripes.com/theaters/europe/2022-05-27/aaefes-es... and this might be the reason. . or am i wrong? https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/microsoft-trusted-root-store-removal-of-us-federal-common-policy https://docs.microsoft.com/en-us/troubleshoot/windows-server... >> Potential issues: After the "G1" root certificate is removed, users in environments that have not transitioned to the "G2" root certificate may experience issues that affect the following scenarios: TLS or SSL connections. Client authentication, including establishing VPN connections. Smart card or PIV authenticated access, including badge access that relies completely on Windows software.
usr1106 4y ago
> "Due to a certificate error it will be necessary to install new software updates on all H5000 terminals according to the current status" They forgot to install a renewed one to their trust base? Just guessing. Even if it's no longer sold, they advertise it as their most-sold model with 350,000 installations.
- hulitu 4y ago
  I don't think they forgot. When a product is sold is becomes someone elses problem.
  - usr1106 4y ago
    I'd assume they provide firmware maintenance?
    - hulitu 4y ago
      Only if the buyers pay for it. Most of the time support is billed separately.
      - usr1106 4y ago
        In that case they would have been probably quick with a statement that there is no problem in their product, but blaming the customers for running unsupported versions.
- zinekeller 4y ago
  > Due to a certificate error Wait, what root certificate expired today or yesterday? It seems not covered by Mozilla or Microsoft though, so perhaps a custom CA?
  - netsharc 4y ago
    You've conjured the word "root" out of your imagination...
    - zinekeller 4y ago
      But it's not unreasonable that the certificate-in-question is indeed a root CA: all machines (not just this specific Verifone model) will error-out on an expired end-entity certificates and the same can be said to intermediates (assuming that they don't issue directly from root). I've checked the original post where they're talking about this and it mentioned a server certificate so unless that machine choked on ECC certificates (possible but considering that no-one in the banking industry has encountered it as the error and the solution is a firmware upgrade, not that the server must back out of ECC deployment or apply dual ECC/RSA capabilities), speculating that this is something that other than root certificates doesn't align out with reality.

17 points by usr1106 4y ago

Sounds very much like history repeating [1]. They still cannot provide a stable fix and claim that it is not a certificate problem in their communication to users. This is somehow unlikely as this would also explain why remote updates won't work. Wonder what the lessons learned can be (if this is true): always have two update sites with a different cert path? Is this something that is a standardized best practice? [1] https://desormaismgt.com/may-2019-verifone-vx520-certificate-malfunction/ https://desormaismgt.com/may-2019-verifone-vx520-certificate...

AlexSail 4y ago

This is not a "german" issue. . https://www.stripes.com/theaters/europe/2022-05-27/aaefes-esso-credit-card-outage-6146620.html https://www.stripes.com/theaters/europe/2022-05-27/aaefes-es... and this might be the reason. . or am i wrong? https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/microsoft-trusted-root-store-removal-of-us-federal-common-policy https://docs.microsoft.com/en-us/troubleshoot/windows-server... >> Potential issues: After the "G1" root certificate is removed, users in environments that have not transitioned to the "G2" root certificate may experience issues that affect the following scenarios: TLS or SSL connections. Client authentication, including establishing VPN connections. Smart card or PIV authenticated access, including badge access that relies completely on Windows software.

usr1106 4y ago

> "Due to a certificate error it will be necessary to install new software updates on all H5000 terminals according to the current status" They forgot to install a renewed one to their trust base? Just guessing. Even if it's no longer sold, they advertise it as their most-sold model with 350,000 installations.

hulitu 4y ago
I don't think they forgot. When a product is sold is becomes someone elses problem.
- usr1106 4y ago
  I'd assume they provide firmware maintenance?
  - hulitu 4y ago
    Only if the buyers pay for it. Most of the time support is billed separately.
    - usr1106 4y ago
      In that case they would have been probably quick with a statement that there is no problem in their product, but blaming the customers for running unsupported versions.
zinekeller 4y ago
> Due to a certificate error Wait, what root certificate expired today or yesterday? It seems not covered by Mozilla or Microsoft though, so perhaps a custom CA?
- netsharc 4y ago
  You've conjured the word "root" out of your imagination...
  - zinekeller 4y ago
    But it's not unreasonable that the certificate-in-question is indeed a root CA: all machines (not just this specific Verifone model) will error-out on an expired end-entity certificates and the same can be said to intermediates (assuming that they don't issue directly from root). I've checked the original post where they're talking about this and it mentioned a server certificate so unless that machine choked on ECC certificates (possible but considering that no-one in the banking industry has encountered it as the error and the solution is a firmware upgrade, not that the server must back out of ECC deployment or apply dual ECC/RSA capabilities), speculating that this is something that other than root certificates doesn't align out with reality.