Turning My Virtual Wallet into a Skimming Device
Examines hardware and Bluetooth vulnerabilities in low-cost Mobile Point-of-Sale (MPOS) card readers that allow attackers to skim payment credentials.
Summary
The Proliferation of Mobile Point-of-Sale Hardware
In emerging economies, low-cost Mobile Point-of-Sale (MPOS) card readers paired with smartphones have become the dominant infrastructure for processing contactless and chip transactions.
Hardware Teardowns and Microcontroller Extraction
Federico Borgogno and Luciano Barrionuevo dissect budget MPOS readers, analyzing microcontroller security, PCB trace routing, and anti-tamper mesh failures.
Exploiting Bluetooth Communication Flaws
Insecure pairing mechanisms and unencrypted serial communication between the terminal and host smartphone enable man-in-the-middle interception of payment data.
Constructing Virtual Skimming Devices
Demonstrating arbitrary firmware modification and malicious companion apps shows how rogue merchants or attackers can silently capture payment card data during routine sales.
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Wireless Village·33 min
Travis Goodspeed
Travis Goodspeed provides an update on the Goodwatch open-source wrist-worn RF radio hacking and packet manipulation platform.
Main Stage·41 min
Jeroen 'Jeroen' Domburg
Demonstrates hardware hacking and reverse engineering to run custom Linux kernels and open software on inexpensive USB webcams.