SAP cash terminals pirated with a Raspberry Pi

[soujanyanaganur]

Point-of-sale (POS) terminals are prime prey for cyberpatients of all types. In 2016, according to FireEye, more than a dozen malicious software targeted at POS terminals used by many retailers to process electronic payments was discovered . The cloud systems are not spared with a wave of attacks that also affected   last summer 38,000 companies using the distribution system of the Canadian Lightspeed.

Among the most common point-of-sale terminals in the world, SAP POS (point of sale) equips 80% of the retailers that make up the Forbes Global 2000 in the US It is part of the publisher's sector. The latter was placed on the ERPScan grill at the Hack in the Box conference on 24 August in Singapore, detailing the exploitation of a vulnerability reported in April to SAP PI Training which corrected it only a few days earlier on 21 August.

SAP Point of Sale Terminal Piracy

Attack scenario of a SAP POS. (credit: ERPScan)

What the two security researchers of ERPScan, Dmitry Chastuhin and Vladimir Egorov, have raised is quite edifying. In a video , they showed the possibility, thanks to a simple Raspberry Pi costing about 25 dollars, to access the network on which the POS is located and to install a malware allowing to attribute to an article a reduction. The example shows the scan of the price tag of a MacBook appearing in the terminal at 1 euro associated with a receipt of the same amount. An exaggeratedly low price that is obvious, but which could go unnoticed for the cashier if it took into account a reduction less in the order of 20 to 30% ...

"To exploit the missing authorization controls on the SAP POS Xpress server, you must have access to the network where SAP POS is located. This network can be connected to the Internet, so the attack can be conducted remotely. Otherwise, it can still be accessed, for example, by connecting Raspberry Pi to electronic scales in a store, "explains ERPScan. "Once you are, you have unlimited control over the POS backend and frontend because the tool can upload a malicious configuration file to SAP POS Xpress Server without any authentication procedure. The new parameters are limited by the imagination of the pirates: they can fix special prices or discounts, the time when the discount is valid, the conditions under which it operates - for example, when purchasing a specific product. "

Oracle microphones also victim of cyberpirates

To avoid this type of attack, merchants and retailers using SAP POS Xpress must install the latest patch published by the publisher on 21 July. "SAP PI Product Security Response Team often collaborates with research companies such as ERPScan to ensure responsible disclosure of vulnerabilities. All vulnerabilities in SAP Point of Sale Retail Xpress Server have been corrected and security patches are available for download on the publisher's support. We strongly advise our customers to secure their SAP landscape by applying the security patches available from SAP support, " the publisher said .

In addition to SAP POS Xpress, ERPScan researchers have also examined other solutions such as Oracle Micros, but for the time being, have not provided detailed reports, as in the case of vulnerability. In August 2016, Oracle's payment systems division was infiltrated by Russian cybercriminals , as were also Cin7, ECRS, Navy Zebra, PAR Technology and Uniwell in the same month .