Explore the security vulnerabilities of Square's mobile card-reading device, the Square Reader, and its associated Square Register app. Delve into the challenges posed by compact, affordable, and widely compatible mobile point-of-sale systems. Discover how these devices expose new attack surfaces, leaving them susceptible to fraudulent transactions and credit card information skimming by both malicious merchants and third parties. Examine various models of the Square Reader, uncovering software and hardware design flaws that persist even in current secure mobile payment systems. Learn about incomplete deprecation, playback attacks, hardware vulnerabilities, encryption bypasses, and potential attack vectors. Gain insights into the security implications of mobile payment processing and discuss potential countermeasures to mitigate these risks.
Overview
Syllabus
Intro
WHY DO I CARE?
HOW IT WORKS
THE SQUARE READER - MODELS
INCOMPLETE DEPRECATION
PLAYBACK ATTACK
HARDWARE VULNS
HARDWARE ENCRYPTION BYPASS
HARDWARE ATTACK VECTOR
COUNTERMEASURES
Taught by
Black Hat