Some Windows CE-based ATMs especially generous

z@re: Jedna kladionica u HR (ne, necu rec koja :)) dijeli aparate za kladjenje koji se postave u kafic. Aparat se otvori na cetiri matice sa straznje strane, unutra je standardna ATX ploca sa nekim Celeronom, Windows XP sa auto-loginom administracijskog accounta, i OpenVPN cert-based autorizacija na centralni server. Program je pisan u .NETu, ne radi nikakvu provjeru osim sta ce roknut exception na drugom kompjuteru ako mu citac love nije spojen na COM port (ovaj je konkretno spojen preko COM<->USB adaptera). Osim sta firma koja proizvodi citac para ima dev.kit koji instalira virtualni COM port komandiran emulatorom :)

Instaliras OpenVPN, samo pokrenes config fajl i preko cert autorizacije se VPNas u njihovu mrezu. Tu je jedan Oracle server, kojem imas pristup jer imas pristup svim podatcima i svemu na toj masini, i drugi server koji preko nekog porta u nekakvom XML obliku konstantno puca live rezultate i informacije, tako da je program apdejtan.

Aparat ima izlaz na internet preko 3G sticka, koji naravno nema PIN. Koliko znam, u HR ne postoji flat-rate na 3G promet.

Epic fail.

When the manuals are provided online and the default passwords are not changed on most system when installed you are just asking for problems. I think the main problem with this system is that you can enter programming mode straight from the keypad, this is convenient however it would be much more secure if the operator was required to unlock the front of the machine and flip a service switch.

Download the manual (10 MB PDF)

Also with default passwords of Master = 555555 Service = 222222 Operator = 111111 you are asking for problems. Here are a few more links with information of this blunder.
Link 1, Link 2, Link 3, Link 4

I wonder how long it will take for other manufactures such as Triton to learn from this. Lilricky mentioned in the Digg post that this manual also contains master passwords, looks like this problem might be ongoing!

“I just confirmed that this does in fact work. We hit the market down from the office, I put the machine into admin mode with holding down ——, picked administration menu, and entered in the default —— and voila.

By this time I was shitting myself and decided to walk away. So I exited out of the mode leaving the machine’s settings unchanged. What I also noticed is that you can easily get a list of customer transactions as well as it is a menu option when you hold down ——.

This machine was a Triton but owned/managed by E-Trade (at least that’s the sign that was on it.). So yeah … it works.”

izvor i linkovi