Default Passcode Card Readers

If you get in by the default password, can it be considered hacking? In most cases, the law will say yes, but by hacker standards, that seems nonsensical. Low hanging fruit is the bitterest.

In any case, the same default code has been left in place on the overwhelming majority of point-of-sale credit card readers for more than two decades. The code is Z66816 or 166816, depending on the Verifone terminal. A person with access to the machine has a 9 in 10 chance of successfully gaining root access with one of these codes, according to research revealed at the 2015 RSA Conference.

The truth of this was discovered in a recent report by Trustwave and Bishop Fox, two security firms, representatives of which gave a presentation at the recent RSA Conference in San Francisco. Using the right code, a person has access to do whatever the terminal allows him or her to do. In this writer's experience, that at the very least means being able to print out a report of the day's sales, which includes all card data in plain text.


Read original article