4 ms·

I wonder what is available in the settings interface? For example, is there some gateway address that could be changed to a MITM transparent proxy? They act lik

• sp332 11y ago
  Yeah but if the password is for an account that doesn't have any access, who cares? I guess some kind of privilege escalation would be news, but that's a separate vulnerability.
• Nursie 11y ago
  Presumably (and I have worked on devices like these, but not for Verifone) there is some sort of encryption going on. I.E. some protocols I've worked with have had all sensitive data protected by ANSI X9.24 Appendix 1 (I think...) derived keys, or keys derived by various other standard means, such that being able to read the data stream is pretty irrelevant.
  • gknoy 11y ago
    > Presumably ... there is some sort of encryption going on. Color me skeptical. I would presume similarly, but I also would have presumed that they did not have the same password, either. A failure of that scope seems like it could be indicative of a systemic disregard for security.
    • Nursie 11y ago
      >> A failure of that scope seems like it could be indicative of a systemic disregard for security. Well, all the security systems have to be audited and signed-off by third-party testing labs approved by the payment card industry body (PCI) so your cynicism should be unwarranted. But then I've seen code that got through those labs that I would be thoroughly ashamed of, so who knows really...