Ticket Kiosk Hardware Test Found Unprotected Controller
What we tested
Wolfcore carried out a physical device and embedded hardware test on a train company’s ticket kiosk. That means testing the machine itself, including the small computer inside it that controls how it behaves, rather than only the software people see on the screen.
What we found
Unprotected controller. The kiosk ran an Arduino-based controller with no security on it. Through that controller we could print tickets without paying. We could also monitor all of the kiosk’s usage.
We have not described how, and we will not. The point for the business is the outcome: the controller behind the kiosk did not protect itself.
Outcome
Wolfcore reported the findings with clear fix steps. A retest was offered.
Why physical device testing matters
This section is general background, not a finding from the engagement.
A kiosk sits in a public place, and anyone can walk up to it. Its screen and its payment features are only part of the picture. The hardware inside it also makes decisions, such as when to print and what to record. If that hardware has no protection of its own, it is worth testing it as an attacker would, with the machine in front of them.
Test your own devices
If your business runs kiosks, ticket machines, point-of-sale units or other devices that customers can touch, a physical device and embedded hardware test is a sensible place to start. See our wider penetration testing service, or book a conversation.
Ruben Selby, founder and penetration tester at Wolfcore