39 ms·

Why are McDonald’s Self Service Kiosks so hackable?

250 points by ghuntley 4y ago

paulpauper 4y ago
They are hackable in part because the stakes are low that not much thought is put into security. We're talking ordering food, not cryptocurrency or bank records.
- chris_wot 4y ago
  Credit card readers are attached to these.
  - zinekeller 4y ago
    As pointed out multiple times, these are separate systems that are designed to be connected to insecure systems.
- mrweasel 4y ago
  > the stakes are low that not much thought is put into security. What I don't get is that NO though was put in to security. Sure the card reader and the payment processing, I'm honestly sure that someone did a reasonable job at that part, because that comes as part of the payment terminal. For a management perspective I can't see why you didn't think about the security for just a few minutes extra and came up with a much better product in general. There's certainly a point to being overly focused on security and never shipping, but it's also the case that thinking about security and misuse will help you to build better, more stable products. These devices fail, and they fail constantly. I was a a Burger King two weeks ago, and again at the same restaurant two days ago. Two out of three kiosk where broken when I arrived two days ago, that all three where broken after I order two weeks ago. At the local McDonald's it often that three or four out of ten kiosks are broken. They aren't broken as in physically damaged, it's the software that's not working or stuck somehow. As the article points out, they break so frequently that they are left unlocked, which in turn violates the idea that they are physically secured. Three things I'd change is: * Don't run as administrator, because hey, it's a quick thing to fix, so might as well. * Read-only filesystems. * PXE boot those things, so that they'll get fresh OS + application install on each boot. If you ever see staff try to fix a kiosk, then you'll notice that they just open them and reboot the device. From what I've seen that frequently fails to fix the device, meaning that the system is in a broken state. Having the whole thing boot a known good image could help. When the normal recovery plan for thousands of these kiosk is: "Reboot and hope it works. If not, wait for a technician to re-image, or reboot again." then you didn't spend enough time on systems design.
witheld 4y ago
If it’s anything like American McDonald’s those card readers should be hooked up over the network- not USB. There shouldn’t be a trivial way to use them as card skimmers, the software loaded on them, doesn’t just like hand out card numbers it processes the transaction. Now, if they are hackable, and if they’re networked, or if you’re in America, your target is the Ethernet ports strategically hidden around the store. Look under and behind soda machines, inside cabinets in the lobby used to store napkins and stuff, randomly on the walls in the playplace etc I don’t know about skimming cards from those ethernet ports, but you will have full access to the entire POS system which includes ordering and business data and the backend server.
- KennyBlanken 4y ago
  Yeah - I'm fairly certain payment terminals, USB or otherwise, do not provide credit card numbers in clear text. Any card information is encrypted on-device, then sent to the payment gateway - and the readers usually have some sort of anti-tamper stuff to at least prevent them from being opened up and the encryption key compromised or the hardware hijacked.
  - imroot 4y ago
    FiPay (which is one of the pieces of software you can run with Verifone terminals) can be configured to return a credit card number back, but, it's only for legacy point of sales applications that need to have a number for whatever reason. Even after moving everything to our Verifone vault, we still had those fields in our point of sales database, even if all of the numbers were '4111 1111 1111 1111' and the expiration dates were 2099+. We would pass the "proper" things down for the receipt as text fields (AID/TID/etc) to be printed on the receipt and stored with the transaction log.
  - MBCook 4y ago
    EMV tags gives you parts of the card number (so you can tell the kind of card or put the last 4 on receipt) but you don’t get the full number anymore like with mag-stripe.
- FearlessNebula 4y ago
prvit 4y ago
Even if the kiosk loads the payment terminal firmware, that firmware will be signed. It’s 2022, pretty much all developed nations use chip cards so you wouldn’t have anything to gain from this exercise anyway.
- joombaga 4y ago
  I'm not sure I understand why you brought up chip cards so this may be irrelevant, but in the US cards still have magnetic strips, and I believe most terminals are configured to fail over to the strip reader after a few failed attempts to read the chip.
  - prvit 4y ago
    It’s possible for a compromised payment terminal to record magnetic stripe card data. These kinds of payments essentially do not exist in developed countries. It’s not possible for a compromised payment terminal to do anything interesting with other kinds of cards.
    - MBCook 4y ago
      In the US skimming of mag-stripe is still surprisingly/sadly common. Most(?) store gift cards don’t have chips. I think some smaller banks may not have chips on debit cards. I don’t know about “food stamp” cards or gas station branded cards. So as a thief you can collect what you can get. Plus you can screw up the EMV slot so people must swipe, making them vulnerable (if they don’t use contactless).
      - PeterisP 4y ago
        > you can screw up the EMV slot so people must swipe I think that outside of USA most banks would configure their systems to automatically decline any transaction from a chip-capable terminal for a chip-capable card (to prevent cloned cards from being used with just the mag-stripe data), so swiping would be possible only on terminals that never had a EMV slot in the first place, and IIRC even that is limited to certain regions as in many countries it's expected that all terminals must be chip-capable; a damaged EMV slot should result in the bank returning an error code effectively saying 'broken terminal, repair or use another' instead of permitting to swipe. Alternatively, I think I have seen contracts (for merchants who really wanted to keep swipes longer than the expected transition) that say that any fraudulent swiped transactions are fully paid for by the merchant.
wronglebowski 4y ago
I was involved with the card reader upgrades at McDonald’s in the US. Essentially the card readers were stripped out of the main network and all buildings were rewired With a physically segregated network for cashless transactions. Registers placed orders to the main routing Server in the back which passed the information to each individual station for fulfillment. The only time the card reader is involved is when the register makes a request to the cashless processing appliance in the back office then it reaches out to the card reader on the segregated network.
- shepherdjerred 4y ago
  This is good right? It sounds like a secure design.
  - wronglebowski 4y ago
    I’d say so. Also there was effectively no troubleshooting in the store you could do. Aside from unplugging and replugging the appliance and terminals it was all under a very strict service contract. Too many terminals down or the appliance that processes transaction and a tech had to be out in 8 hours regardless of time of day to service.
    - kotaKat 4y ago
      And really, the worst exploit I fathomed you could do would be... changing the IP address on two PEDs to swap what lanes they were on (so register 2's pad would be really being used for register 3 and vice versa). (Former in-training OTP here.)
      - wronglebowski 4y ago
        What was your experience like and where did it lead you? For me it was part of the wake up call that showed me to the door. Being OTP for 14 Stores and GM for 1 was what pushed me over the edge.
- __MatrixMan__ 4y ago
gjsman-1000 4y ago
Wow… and I had felt nervous about the computers in my house and business still running Windows 10 (which will be EOL in 3 years, not a lot of time for a business). But McDonalds has no problem with Vista (EOL 5 years ago). Ouch. If McDonalds ever gets hacked, this should come up for possible criminal liability.
- prvit 4y ago
  > If McDonalds ever gets hacked, this should come up for possible criminal liability. Oh no, the criminals might find out about your disgusting eating habits! The horror! Seriously though, what kind of damages might you as a customer expect to see from McDonalds kiosks getting hacked?
  - deleted 4y ago
    [deleted]
  - egypturnash 4y ago
    The same damages you might expect from sticking your credit card into a hacked ATM. There are some comments here claiming that their experience with McDonald’s order kiosks in the US makes them feel this is unlikely to be hackable, but “employees regularly leave them unlocked” sure sounds like an invitation for someone to find other hacks.
    - prvit 4y ago
      So… nothing? At least a physically tampered-with ATM could capture the magnetic stripe on my card. But what could a hacked ATM do with my not-American card which I insert in the chip slot?
      - seoaeu 4y ago
        Deduct a bunch of money from your account but not dispense it?
        4y ago
thomasjudge 4y ago
In Australia, they call McDonald's, "Macca's"?
- mhh__ 4y ago
  yep. "Maccies" is common in the UK
- treelovinhippie 4y ago
- FearlessNebula 4y ago
  https://m.youtube.com/watch?v=1oFpTNsPu_w https://m.youtube.com/watch?v=1oFpTNsPu_w
- simondotau 4y ago
  Yes, and it’s embraced by the brand. https://m.youtube.com/watch?v=GEhHkjB075M https://m.youtube.com/watch?v=GEhHkjB075M
- stevage 4y ago
  Yep. At least since I was a kid in the 80s
- bigiain 4y ago
  They even use http://macc.as http://macc.as (And have done since at least 2013, according to whois.)
  - unsafecast 4y ago
    The domain seems to try to redirect to yourquestions.mcdonalds.com.au but it doesn't really work...
    - quitit 4y ago
      Back when macc.as was launched it linked to a campaign to debunk/side-step some common local ideas about the food quality of mcdonalds. Back when McDonalds was still relevant there was a lot of press about the nutritional content, food preparation standards and so on. Food poisoning or undercooked food from mcdonalds was a common theme. My understanding is that they have largely addressed these issues.
kyelewis 4y ago
As pointed out here, the huge assumption in this article is is: > If someone installs malware on here - just insert a usb stick or use the recovery mode - then tada we have the next generation of atm skimming. Which is just not how these payment devices work- they are entirely separate, they are sent a request to make a transaction, that transaction (and also likely the transaction request itself) occur entirely in a secure connection between someone like Verifone, and the device itself. The PC has has no way to get those card details, only request a transaction and confirm a payment status as successful or failed.
- walterlb 4y ago
  > Today at another McDonald's I observed the entire bootstrap process and can confirm that the kiosk indeed is responsible for installing “custom firmware” on the card reader If this part is correct, it seems like an attacker could compromise the reader itself.
  - charles_kaw 4y ago
    Considering the article writer already expresses some clear misunderstandings, I don't think it's correct. Maybe they witnessed it, but that would be a bigger deal than some shitty windows box being popped. Certainly, that would not pass compliance.
  - MBCook 4y ago
    I work with POS hardware at my job. The “custom firmware” is likely just some settings, screens for the POS to display (so they’re McD branded instead of the POS maker), and some per payment-processor configuration so the terminals are using the expected encryption (differs per processor and customer). Even if it was real firmware (I doubt it), it’s likely the firmware for the POS device interface. I don’t believe that firmware has any control over the actual payment processing bits of hardware, just the software intermediary. Since that intermediary only has access to EMV tags (which anyone in the payment path has) there is no point. The secret encryption stuff that secures passwords is not controlled from any layer an attacker could touch, outside of documented configuration parameters.
nonrandomstring 4y ago
> Why are McDonald’s Self Service Kiosks so hackable? > Underpaid staff who used to do ordering have been replaced with.... staff across Australia leaving the Kiosks unlocked to make it easier to replace the paper. They pay the staff who replace paper less than the staff who served at the counter. Case closed.
- SyneRyder 4y ago
  In my experience, the people who replace the paper are the staff who serve at the counter. They don't just replace the paper, they'll also refeed it when the receipt printer inevitably gets jammed. Counter service hasn't completely disappeared, but they seem to spend most of their time now bagging orders for Uber Eats / Doordash & taking drive-through orders. They're also there for customer enquiries, eg "why did the self service decline my card", "I didn't get any sauce with my McNuggets", "I got a medium fries instead of a large"
unethical_ban 4y ago
I will take this opportunity to go off-topic and discuss the UX of the McD's terminals. It's terrible. I loathe it. I always go to a person if possible, whereas I go to the self-checkout at the grocer's. The technical performance and the menu navigation of those kiosks is unbearable, and I'm a 30s techie.
- stevage 4y ago
  I can't stand any self checkouts anywhere. I always order with a person.
  - lotsofpulp 4y ago
    I love self checkouts. Home Depot has the best with the wireless scanners. With few items, I can be in and out in a minute and never have to wait in line because there are so many self checkouts. If I have a lot of items, then I can wait in line for cashier because scanning all of them is more work than I care for. I rarely have issues using them, at a variety of retailers.
    - mwint 4y ago
      I think Home Depot might be more usable because many of their items are too big to be removed from the cart and put on a scale, so they don't have that slowdown-inducing option for under-scanning prevention
    - presentation 4y ago
      Here in Japan Uniqlo’s self checkout is awesome, you dump the clothes into a bin and then it wirelessly/barcodelessly scans everything and just tells you the total. Idk if they’re doing that in the USA yet.
      - unsafecast 4y ago
        Decathlon does that in Romania.
jdavis703 4y ago
I have seen legacy companies with security rules so tight they can’t ship anything cool. On the flip side are legacy companies that ship great user experiences, but apparently just totally ignore the security people. Does the security professions have a “human centric security design” capability? It’s something the non-tech Fortune 500s to desperately need.
kevin_thibedeau 4y ago
If anyone has a vulnerable card processing system it would be Lowes. They didn't support chip and pin over a year after the deadline. Suggesting a whole lot of broken system design that is probably still held together with bubblegum and duct tape.
aaron695 4y ago
BoorishBears 4y ago
The confident self-assured tone as this article gets everything but the very basics wrong is definitely something...
- muppetman 4y ago
  This is the same clown who had a post a few weeks ago about his speakers that don't go as loud. But yea, he pulls up at beaches in his van and starts playing loud music that no one asked for. He could be a member of that fantastic band "Tool"
krnlpnc 4y ago
> McDonalds in Australia do a decent cup of coffee. It’s not great but it’s consistently decent so I often start my day with a cup. Ugh lost me on the first sentence
- SoftTalker 4y ago
  If your idea of coffee is Folger's or Maxwell House brewed in a drip machine, McDonald's serves decent coffee.
  - BrissyCoder 4y ago
    No. They do proper espresso style coffees with decent beans.
    - chris_wot 4y ago
      This is true.
      - hestefisk 4y ago
        I can attest to this. The Australian maccas coffee is decent.
- BrissyCoder 4y ago
  They really do though.
presentation 4y ago
Why not just have the receipt paper door be separate from that containing ports?
Peleus 4y ago
Honestly I have to say this is the type of security article that annoys me the most. - Snarky and talks down about people not "in the know" about potential security issues. - Supreme confidence that they are super knowledgeable about how it "should" be done. - Fails to provide any actual demonstrable impact, but doing the old "left to the reader" as to how it's clearly exploitable. But when you drill into the details, they are just fundamentally wrong about how the product is even working, what is possible with the attack surface, and how components are interacting with each other. There are plenty of vulnerabilities out there, and companies do make stupid mistakes with regards to security in lots of situations. That doesn't mean that every pie in the sky idea you have (oh look, I did a kiosk escape, dot dot dot, clearly I can credit card skim now) is possible.
- gergov 4y ago
  it's in the tradition of "posting the wrong answer to get the good one". within this genre the comment section ends up even more terrifying than the post itself!
- josefresco 4y ago
  - DocTomoe 4y ago
    After having read quite a few, security articles seem much like proposing Russel's teapot: as long as you as the authors don't demonstrate a viable exploit, it is unlikely that such an exploit exists.
    - FerretFred 4y ago
      I'd at least want to see a "Big Macs free all day" exploit to make it worthwhile.
  - Peleus 4y ago
    > There are payment terminals attached to these kiosks. If someone installs malware on here - just insert a usb stick or use the recovery mode - then tada we have the next generation of atm skimming. As has been mentioned through out this thread by others there is not this form of interaction between the payment terminal and the kiosk.
ck2 4y ago
Understandably covering the technical details but the practical reason is some executive got a bigger kickback offer from one of the vendors regardless of their competence and there you go, screws over millions of people with high risk for an extra vacation home.
chris_wot 4y ago
I have contacted McDonalds Australia (I am an Australian) and asked them for comment.
steve_taylor 4y ago
These kiosks arrived about 10 years too late anyway. All they need to do is make their phone app a bit more usable and no one would need the kiosks. Regarding paper, 99 times out of 100, there’s no paper in the printer. People are used to having to remember their order number.
- ajanuary 4y ago
  The “sorry, there is no paper” error message popup obscures the order number. So if you missed it before the error message shows, you don’t know your number.
- Too 4y ago
  Apps, requires you to install them and they always require you to sign in. Not something I’m willing to do just to grab a cheese burger. It’s not like I go to mcd on such regular basis. Don’t say it’s possible to make one that doesn’t. First, kids would abuse it to anonymously order 200 Big Macs in another town, and secondly companies are always too greedy to look away from that stream of potential user data.
  - happyopossum 4y ago
    > Apps, requires you to install them and they always require you to sign in. A) app-less or install-free apps are a thing, on iOS they’re called app clips and work great. B) the mcd’s app (and all of the other fast food apps I can think of) don’t require a login. You pay for your food when you order it, so the ‘anonymous order’ attack isn’t a thing. Also they usually take ApplePay, which is an added security benefit.
    - unsafecast 4y ago
      And now we're stuck requiring Android or iOS.
    - russelg 4y ago
      I believe you're incorrect about point B there. The mymacca's app goes straight to a sign-in/up screen, and I can't figure out any way around it.
selfthrow2 4y ago
Closer to Truth with Robert Lawrence Kuhn is great for Philosophy/Science content - a variety of episodes with great interviews from multiple perspectives and in digestible segments: https://www.youtube.com/c/CloserToTruthTV https://www.youtube.com/c/CloserToTruthTV
- deleted 4y ago
  [deleted]
freeflight 4y ago
I was expecting some fun UI exploits like getting a negative bill for removing all the ingredients on a burger, and adding that up to pay for an actual burger [0], sadly nothing like that. [0] https://www.delish.com/food-news/a27091162/mcdonalds-kiosks-free-burger-hack/ https://www.delish.com/food-news/a27091162/mcdonalds-kiosks-...
foxes 4y ago
TLDR don’t listen to anyone with a stupid crypto ape profile picture.
02020202 4y ago
sgjohnson 4y ago
Why is everyone so concerned about a malicious party compromising the card reader? Because that would be solely a McDonald's problem. No credit card issuer would refuse chargebacks for fraud that occurred because of this, nd ultimately when they'd find the source, it'd me McDonalds picking up the tab. The risk to the average person from this is 0. At most it's an inconvenient call to a bank and sorting out a card replacement. (And an extra inconvenience for people using debit cards). I have plenty of cards, and I wouldn't care one bit if the details of some got leaked, as I'm getting a push notification for every transaction. Anything unexpected? Call/fill in an online form, and it's resolved within 2 days, and by then you already have a new card in the mail.
zerm778 4y ago
nerds
smelbe 4y ago
If it's anything like the McDonald's in the United States, the card readers need to be connected through the network rather than through USB. Because the software that is installed onto them does more than simply send out card numbers, there should not be an easy way to exploit them as card skimmers. The software that is loaded on them handles the transaction.
desindol 4y ago
It’s easy because they had to be cheap and ready just in time of the next shareholder Meeting.
thinkingemote 4y ago
I think many would be interested in what kind of surveillance hardware and software the kiosks have. It should also be easier to determine what is being sent over the net to some end point than getting encrypted payment details. I wouldn't be surprised if there was a camera with video, microphone or at least photographs of customers. Indeed, grocery kiosks have these in the UK, some actually show you the video feed on the monitor in front of you to install fear to deter shoplifting. Where this data goes and what the company uses the data for, we don't know.
Lio 4y ago
I never understand how these terminals get past hygiene regs. They’re touch screen and right next to toilets where the previous customer may …or may not have just washed their hands. Then customers go right ahead and eat their food with their hands. It’s like the perfect recipe for worms. Gross.
- dewey 4y ago
  How is that different than any other surface in the restaurant, doors or card terminals where you sometimes have to type the pin code?
  - Lio 4y ago
    You have a good point and are probably correct, but still. These days most McDonalds seem to have automatic doors and card payments are contactless via phone or card. Assuming the kitchen staff keep their hands clean and the trays are washed the touchscreens are the most obvious thing too break the illusion of hygene. The real problem I guess is eating food with your hands without immediately washing them first. Historically before contactless payments and automatic doors the world didn't end so it probably is just a percived "yuck factor" on my part, I fully acknowledge that. It's just... those screens and their suspicious smears... :-###..
xor99 4y ago
True hacking by some Australian innovators "in this space" (AMAZING SELF-SERVE KIOSK HACK THAT SCORES YOU FREE MACCAS): https://www.youtube.com/watch?v=h7ttj41Fdig https://www.youtube.com/watch?v=h7ttj41Fdig
snickerbockers 4y ago
Im too high-inhib to stand there fucking with the kiosk while everyone in the restaurant is staring at me wondering if they should tell the employees.
hestefisk 4y ago
I wonder if these systems are airgapped (or perimeter around the local restaurant). If the menu doesn’t change very often, there’s a good chance that could be and the payment terminal does all the work itself. In which case it would not be much different to an ATM or POS running OS/2 Warp.
memcg 4y ago
Hacking aside, they are still subject to good old programming errors. Back in November 2019 the kiosk showed a Bacon BBQ Quarter Pounder for $0. You could customize it and still check out for $0. I ordered as many as 6 at once, plus a drink and paid $1.04 total. This worked for about a month.
itsthejb 4y ago
Can confirm the usability problems - during the recent brief heatwave I popped into a local store to treat myself to a rare guilty pleasure of a McFlurry. After confirming, printer paper error pops up, giving the option to continue. Clicked ok, but no re-presentation of the order number. Could remember it anyway, but unimpressive for a mega corp

250 points by ghuntley 4y ago

They are hackable in part because the stakes are low that not much thought is put into security. We're talking ordering food, not cryptocurrency or bank records.

chris_wot 4y ago
Credit card readers are attached to these.
- zinekeller 4y ago
  As pointed out multiple times, these are separate systems that are designed to be connected to insecure systems.
mrweasel 4y ago
> the stakes are low that not much thought is put into security. What I don't get is that NO though was put in to security. Sure the card reader and the payment processing, I'm honestly sure that someone did a reasonable job at that part, because that comes as part of the payment terminal. For a management perspective I can't see why you didn't think about the security for just a few minutes extra and came up with a much better product in general. There's certainly a point to being overly focused on security and never shipping, but it's also the case that thinking about security and misuse will help you to build better, more stable products. These devices fail, and they fail constantly. I was a a Burger King two weeks ago, and again at the same restaurant two days ago. Two out of three kiosk where broken when I arrived two days ago, that all three where broken after I order two weeks ago. At the local McDonald's it often that three or four out of ten kiosks are broken. They aren't broken as in physically damaged, it's the software that's not working or stuck somehow. As the article points out, they break so frequently that they are left unlocked, which in turn violates the idea that they are physically secured. Three things I'd change is: * Don't run as administrator, because hey, it's a quick thing to fix, so might as well. * Read-only filesystems. * PXE boot those things, so that they'll get fresh OS + application install on each boot. If you ever see staff try to fix a kiosk, then you'll notice that they just open them and reboot the device. From what I've seen that frequently fails to fix the device, meaning that the system is in a broken state. Having the whole thing boot a known good image could help. When the normal recovery plan for thousands of these kiosk is: "Reboot and hope it works. If not, wait for a technician to re-image, or reboot again." then you didn't spend enough time on systems design.

witheld 4y ago

If it’s anything like American McDonald’s those card readers should be hooked up over the network- not USB. There shouldn’t be a trivial way to use them as card skimmers, the software loaded on them, doesn’t just like hand out card numbers it processes the transaction. Now, if they are hackable, and if they’re networked, or if you’re in America, your target is the Ethernet ports strategically hidden around the store. Look under and behind soda machines, inside cabinets in the lobby used to store napkins and stuff, randomly on the walls in the playplace etc I don’t know about skimming cards from those ethernet ports, but you will have full access to the entire POS system which includes ordering and business data and the backend server.

KennyBlanken 4y ago
Yeah - I'm fairly certain payment terminals, USB or otherwise, do not provide credit card numbers in clear text. Any card information is encrypted on-device, then sent to the payment gateway - and the readers usually have some sort of anti-tamper stuff to at least prevent them from being opened up and the encryption key compromised or the hardware hijacked.
- imroot 4y ago
  FiPay (which is one of the pieces of software you can run with Verifone terminals) can be configured to return a credit card number back, but, it's only for legacy point of sales applications that need to have a number for whatever reason. Even after moving everything to our Verifone vault, we still had those fields in our point of sales database, even if all of the numbers were '4111 1111 1111 1111' and the expiration dates were 2099+. We would pass the "proper" things down for the receipt as text fields (AID/TID/etc) to be printed on the receipt and stored with the transaction log.
- MBCook 4y ago
  EMV tags gives you parts of the card number (so you can tell the kind of card or put the last 4 on receipt) but you don’t get the full number anymore like with mag-stripe.
FearlessNebula 4y ago

prvit 4y ago

Even if the kiosk loads the payment terminal firmware, that firmware will be signed. It’s 2022, pretty much all developed nations use chip cards so you wouldn’t have anything to gain from this exercise anyway.

joombaga 4y ago
I'm not sure I understand why you brought up chip cards so this may be irrelevant, but in the US cards still have magnetic strips, and I believe most terminals are configured to fail over to the strip reader after a few failed attempts to read the chip.
- prvit 4y ago
  It’s possible for a compromised payment terminal to record magnetic stripe card data. These kinds of payments essentially do not exist in developed countries. It’s not possible for a compromised payment terminal to do anything interesting with other kinds of cards.
  - MBCook 4y ago
    In the US skimming of mag-stripe is still surprisingly/sadly common. Most(?) store gift cards don’t have chips. I think some smaller banks may not have chips on debit cards. I don’t know about “food stamp” cards or gas station branded cards. So as a thief you can collect what you can get. Plus you can screw up the EMV slot so people must swipe, making them vulnerable (if they don’t use contactless).
    - PeterisP 4y ago
      > you can screw up the EMV slot so people must swipe I think that outside of USA most banks would configure their systems to automatically decline any transaction from a chip-capable terminal for a chip-capable card (to prevent cloned cards from being used with just the mag-stripe data), so swiping would be possible only on terminals that never had a EMV slot in the first place, and IIRC even that is limited to certain regions as in many countries it's expected that all terminals must be chip-capable; a damaged EMV slot should result in the bank returning an error code effectively saying 'broken terminal, repair or use another' instead of permitting to swipe. Alternatively, I think I have seen contracts (for merchants who really wanted to keep swipes longer than the expected transition) that say that any fraudulent swiped transactions are fully paid for by the merchant.

wronglebowski 4y ago

I was involved with the card reader upgrades at McDonald’s in the US. Essentially the card readers were stripped out of the main network and all buildings were rewired With a physically segregated network for cashless transactions. Registers placed orders to the main routing Server in the back which passed the information to each individual station for fulfillment. The only time the card reader is involved is when the register makes a request to the cashless processing appliance in the back office then it reaches out to the card reader on the segregated network.

shepherdjerred 4y ago
This is good right? It sounds like a secure design.
- wronglebowski 4y ago
  I’d say so. Also there was effectively no troubleshooting in the store you could do. Aside from unplugging and replugging the appliance and terminals it was all under a very strict service contract. Too many terminals down or the appliance that processes transaction and a tech had to be out in 8 hours regardless of time of day to service.
  - kotaKat 4y ago
    And really, the worst exploit I fathomed you could do would be... changing the IP address on two PEDs to swap what lanes they were on (so register 2's pad would be really being used for register 3 and vice versa). (Former in-training OTP here.)
    - wronglebowski 4y ago
      What was your experience like and where did it lead you? For me it was part of the wake up call that showed me to the door. Being OTP for 14 Stores and GM for 1 was what pushed me over the edge.
__MatrixMan__ 4y ago

gjsman-1000 4y ago

Wow… and I had felt nervous about the computers in my house and business still running Windows 10 (which will be EOL in 3 years, not a lot of time for a business). But McDonalds has no problem with Vista (EOL 5 years ago). Ouch. If McDonalds ever gets hacked, this should come up for possible criminal liability.

prvit 4y ago
> If McDonalds ever gets hacked, this should come up for possible criminal liability. Oh no, the criminals might find out about your disgusting eating habits! The horror! Seriously though, what kind of damages might you as a customer expect to see from McDonalds kiosks getting hacked?
- deleted 4y ago
  [deleted]
- egypturnash 4y ago
  The same damages you might expect from sticking your credit card into a hacked ATM. There are some comments here claiming that their experience with McDonald’s order kiosks in the US makes them feel this is unlikely to be hackable, but “employees regularly leave them unlocked” sure sounds like an invitation for someone to find other hacks.
  - prvit 4y ago
    So… nothing? At least a physically tampered-with ATM could capture the magnetic stripe on my card. But what could a hacked ATM do with my not-American card which I insert in the chip slot?
    - seoaeu 4y ago
      Deduct a bunch of money from your account but not dispense it?
      - 4y ago

thomasjudge 4y ago

In Australia, they call McDonald's, "Macca's"?

mhh__ 4y ago
yep. "Maccies" is common in the UK
treelovinhippie 4y ago
FearlessNebula 4y ago
https://m.youtube.com/watch?v=1oFpTNsPu_w https://m.youtube.com/watch?v=1oFpTNsPu_w
simondotau 4y ago
Yes, and it’s embraced by the brand. https://m.youtube.com/watch?v=GEhHkjB075M https://m.youtube.com/watch?v=GEhHkjB075M
stevage 4y ago
Yep. At least since I was a kid in the 80s
bigiain 4y ago
They even use http://macc.as http://macc.as (And have done since at least 2013, according to whois.)
- unsafecast 4y ago
  The domain seems to try to redirect to yourquestions.mcdonalds.com.au but it doesn't really work...
  - quitit 4y ago
    Back when macc.as was launched it linked to a campaign to debunk/side-step some common local ideas about the food quality of mcdonalds. Back when McDonalds was still relevant there was a lot of press about the nutritional content, food preparation standards and so on. Food poisoning or undercooked food from mcdonalds was a common theme. My understanding is that they have largely addressed these issues.

kyelewis 4y ago

As pointed out here, the huge assumption in this article is is: > If someone installs malware on here - just insert a usb stick or use the recovery mode - then tada we have the next generation of atm skimming. Which is just not how these payment devices work- they are entirely separate, they are sent a request to make a transaction, that transaction (and also likely the transaction request itself) occur entirely in a secure connection between someone like Verifone, and the device itself. The PC has has no way to get those card details, only request a transaction and confirm a payment status as successful or failed.

walterlb 4y ago
> Today at another McDonald's I observed the entire bootstrap process and can confirm that the kiosk indeed is responsible for installing “custom firmware” on the card reader If this part is correct, it seems like an attacker could compromise the reader itself.
- charles_kaw 4y ago
  Considering the article writer already expresses some clear misunderstandings, I don't think it's correct. Maybe they witnessed it, but that would be a bigger deal than some shitty windows box being popped. Certainly, that would not pass compliance.
- MBCook 4y ago
  I work with POS hardware at my job. The “custom firmware” is likely just some settings, screens for the POS to display (so they’re McD branded instead of the POS maker), and some per payment-processor configuration so the terminals are using the expected encryption (differs per processor and customer). Even if it was real firmware (I doubt it), it’s likely the firmware for the POS device interface. I don’t believe that firmware has any control over the actual payment processing bits of hardware, just the software intermediary. Since that intermediary only has access to EMV tags (which anyone in the payment path has) there is no point. The secret encryption stuff that secures passwords is not controlled from any layer an attacker could touch, outside of documented configuration parameters.

nonrandomstring 4y ago

> Why are McDonald’s Self Service Kiosks so hackable? > Underpaid staff who used to do ordering have been replaced with.... staff across Australia leaving the Kiosks unlocked to make it easier to replace the paper. They pay the staff who replace paper less than the staff who served at the counter. Case closed.

SyneRyder 4y ago
In my experience, the people who replace the paper are the staff who serve at the counter. They don't just replace the paper, they'll also refeed it when the receipt printer inevitably gets jammed. Counter service hasn't completely disappeared, but they seem to spend most of their time now bagging orders for Uber Eats / Doordash & taking drive-through orders. They're also there for customer enquiries, eg "why did the self service decline my card", "I didn't get any sauce with my McNuggets", "I got a medium fries instead of a large"

unethical_ban 4y ago

I will take this opportunity to go off-topic and discuss the UX of the McD's terminals. It's terrible. I loathe it. I always go to a person if possible, whereas I go to the self-checkout at the grocer's. The technical performance and the menu navigation of those kiosks is unbearable, and I'm a 30s techie.

stevage 4y ago
I can't stand any self checkouts anywhere. I always order with a person.
- lotsofpulp 4y ago
  I love self checkouts. Home Depot has the best with the wireless scanners. With few items, I can be in and out in a minute and never have to wait in line because there are so many self checkouts. If I have a lot of items, then I can wait in line for cashier because scanning all of them is more work than I care for. I rarely have issues using them, at a variety of retailers.
  - mwint 4y ago
    I think Home Depot might be more usable because many of their items are too big to be removed from the cart and put on a scale, so they don't have that slowdown-inducing option for under-scanning prevention
  - presentation 4y ago
    Here in Japan Uniqlo’s self checkout is awesome, you dump the clothes into a bin and then it wirelessly/barcodelessly scans everything and just tells you the total. Idk if they’re doing that in the USA yet.
    - unsafecast 4y ago
      Decathlon does that in Romania.

jdavis703 4y ago

I have seen legacy companies with security rules so tight they can’t ship anything cool. On the flip side are legacy companies that ship great user experiences, but apparently just totally ignore the security people. Does the security professions have a “human centric security design” capability? It’s something the non-tech Fortune 500s to desperately need.

kevin_thibedeau 4y ago

If anyone has a vulnerable card processing system it would be Lowes. They didn't support chip and pin over a year after the deadline. Suggesting a whole lot of broken system design that is probably still held together with bubblegum and duct tape.

aaron695 4y ago

BoorishBears 4y ago

The confident self-assured tone as this article gets everything but the very basics wrong is definitely something...

muppetman 4y ago
This is the same clown who had a post a few weeks ago about his speakers that don't go as loud. But yea, he pulls up at beaches in his van and starts playing loud music that no one asked for. He could be a member of that fantastic band "Tool"

krnlpnc 4y ago

> McDonalds in Australia do a decent cup of coffee. It’s not great but it’s consistently decent so I often start my day with a cup. Ugh lost me on the first sentence

SoftTalker 4y ago
If your idea of coffee is Folger's or Maxwell House brewed in a drip machine, McDonald's serves decent coffee.
- BrissyCoder 4y ago
  No. They do proper espresso style coffees with decent beans.
  - chris_wot 4y ago
    This is true.
    - hestefisk 4y ago
      I can attest to this. The Australian maccas coffee is decent.
BrissyCoder 4y ago
They really do though.

presentation 4y ago

Why not just have the receipt paper door be separate from that containing ports?

Peleus 4y ago

Honestly I have to say this is the type of security article that annoys me the most. - Snarky and talks down about people not "in the know" about potential security issues. - Supreme confidence that they are super knowledgeable about how it "should" be done. - Fails to provide any actual demonstrable impact, but doing the old "left to the reader" as to how it's clearly exploitable. But when you drill into the details, they are just fundamentally wrong about how the product is even working, what is possible with the attack surface, and how components are interacting with each other. There are plenty of vulnerabilities out there, and companies do make stupid mistakes with regards to security in lots of situations. That doesn't mean that every pie in the sky idea you have (oh look, I did a kiosk escape, dot dot dot, clearly I can credit card skim now) is possible.

gergov 4y ago
it's in the tradition of "posting the wrong answer to get the good one". within this genre the comment section ends up even more terrifying than the post itself!
josefresco 4y ago
- DocTomoe 4y ago
  After having read quite a few, security articles seem much like proposing Russel's teapot: as long as you as the authors don't demonstrate a viable exploit, it is unlikely that such an exploit exists.
  - FerretFred 4y ago
    I'd at least want to see a "Big Macs free all day" exploit to make it worthwhile.
- Peleus 4y ago
  > There are payment terminals attached to these kiosks. If someone installs malware on here - just insert a usb stick or use the recovery mode - then tada we have the next generation of atm skimming. As has been mentioned through out this thread by others there is not this form of interaction between the payment terminal and the kiosk.

ck2 4y ago

Understandably covering the technical details but the practical reason is some executive got a bigger kickback offer from one of the vendors regardless of their competence and there you go, screws over millions of people with high risk for an extra vacation home.

chris_wot 4y ago

I have contacted McDonalds Australia (I am an Australian) and asked them for comment.

steve_taylor 4y ago

These kiosks arrived about 10 years too late anyway. All they need to do is make their phone app a bit more usable and no one would need the kiosks. Regarding paper, 99 times out of 100, there’s no paper in the printer. People are used to having to remember their order number.

ajanuary 4y ago
The “sorry, there is no paper” error message popup obscures the order number. So if you missed it before the error message shows, you don’t know your number.
Too 4y ago
Apps, requires you to install them and they always require you to sign in. Not something I’m willing to do just to grab a cheese burger. It’s not like I go to mcd on such regular basis. Don’t say it’s possible to make one that doesn’t. First, kids would abuse it to anonymously order 200 Big Macs in another town, and secondly companies are always too greedy to look away from that stream of potential user data.
- happyopossum 4y ago
  > Apps, requires you to install them and they always require you to sign in. A) app-less or install-free apps are a thing, on iOS they’re called app clips and work great. B) the mcd’s app (and all of the other fast food apps I can think of) don’t require a login. You pay for your food when you order it, so the ‘anonymous order’ attack isn’t a thing. Also they usually take ApplePay, which is an added security benefit.
  - unsafecast 4y ago
    And now we're stuck requiring Android or iOS.
  - russelg 4y ago
    I believe you're incorrect about point B there. The mymacca's app goes straight to a sign-in/up screen, and I can't figure out any way around it.

selfthrow2 4y ago

Closer to Truth with Robert Lawrence Kuhn is great for Philosophy/Science content - a variety of episodes with great interviews from multiple perspectives and in digestible segments: https://www.youtube.com/c/CloserToTruthTV https://www.youtube.com/c/CloserToTruthTV

deleted 4y ago
[deleted]

freeflight 4y ago

I was expecting some fun UI exploits like getting a negative bill for removing all the ingredients on a burger, and adding that up to pay for an actual burger [0], sadly nothing like that. [0] https://www.delish.com/food-news/a27091162/mcdonalds-kiosks-free-burger-hack/ https://www.delish.com/food-news/a27091162/mcdonalds-kiosks-...

foxes 4y ago

TLDR don’t listen to anyone with a stupid crypto ape profile picture.

02020202 4y ago

sgjohnson 4y ago

Why is everyone so concerned about a malicious party compromising the card reader? Because that would be solely a McDonald's problem. No credit card issuer would refuse chargebacks for fraud that occurred because of this, nd ultimately when they'd find the source, it'd me McDonalds picking up the tab. The risk to the average person from this is 0. At most it's an inconvenient call to a bank and sorting out a card replacement. (And an extra inconvenience for people using debit cards). I have plenty of cards, and I wouldn't care one bit if the details of some got leaked, as I'm getting a push notification for every transaction. Anything unexpected? Call/fill in an online form, and it's resolved within 2 days, and by then you already have a new card in the mail.

zerm778 4y ago

nerds

smelbe 4y ago

If it's anything like the McDonald's in the United States, the card readers need to be connected through the network rather than through USB. Because the software that is installed onto them does more than simply send out card numbers, there should not be an easy way to exploit them as card skimmers. The software that is loaded on them handles the transaction.

desindol 4y ago

It’s easy because they had to be cheap and ready just in time of the next shareholder Meeting.

thinkingemote 4y ago

I think many would be interested in what kind of surveillance hardware and software the kiosks have. It should also be easier to determine what is being sent over the net to some end point than getting encrypted payment details. I wouldn't be surprised if there was a camera with video, microphone or at least photographs of customers. Indeed, grocery kiosks have these in the UK, some actually show you the video feed on the monitor in front of you to install fear to deter shoplifting. Where this data goes and what the company uses the data for, we don't know.

Lio 4y ago

I never understand how these terminals get past hygiene regs. They’re touch screen and right next to toilets where the previous customer may …or may not have just washed their hands. Then customers go right ahead and eat their food with their hands. It’s like the perfect recipe for worms. Gross.

dewey 4y ago
How is that different than any other surface in the restaurant, doors or card terminals where you sometimes have to type the pin code?
- Lio 4y ago
  You have a good point and are probably correct, but still. These days most McDonalds seem to have automatic doors and card payments are contactless via phone or card. Assuming the kitchen staff keep their hands clean and the trays are washed the touchscreens are the most obvious thing too break the illusion of hygene. The real problem I guess is eating food with your hands without immediately washing them first. Historically before contactless payments and automatic doors the world didn't end so it probably is just a percived "yuck factor" on my part, I fully acknowledge that. It's just... those screens and their suspicious smears... :-###..

xor99 4y ago

True hacking by some Australian innovators "in this space" (AMAZING SELF-SERVE KIOSK HACK THAT SCORES YOU FREE MACCAS): https://www.youtube.com/watch?v=h7ttj41Fdig https://www.youtube.com/watch?v=h7ttj41Fdig

snickerbockers 4y ago

Im too high-inhib to stand there fucking with the kiosk while everyone in the restaurant is staring at me wondering if they should tell the employees.

hestefisk 4y ago

I wonder if these systems are airgapped (or perimeter around the local restaurant). If the menu doesn’t change very often, there’s a good chance that could be and the payment terminal does all the work itself. In which case it would not be much different to an ATM or POS running OS/2 Warp.

memcg 4y ago

Hacking aside, they are still subject to good old programming errors. Back in November 2019 the kiosk showed a Bacon BBQ Quarter Pounder for $0. You could customize it and still check out for $0. I ordered as many as 6 at once, plus a drink and paid $1.04 total. This worked for about a month.

itsthejb 4y ago

Can confirm the usability problems - during the recent brief heatwave I popped into a local store to treat myself to a rare guilty pleasure of a McFlurry. After confirming, printer paper error pops up, giving the option to continue. Clicked ok, but no re-presentation of the order number. Could remember it anyway, but unimpressive for a mega corp