#Brinks security las vegas code#
The code for getting administrator access is surprisingly simple: it’s just 100 lines of macro code, which are instructions for a certain sequence of mouse and keyboard strokes that crack the CompuSafe and can be supplied using a USB stick. “It would be very difficult to track that theft down because the bank would receive exactly how much money it thinks it should be getting.” “You could very easily make the safe lie about the cash total it has,” he said. If the machine has US$2,000 in it but the database is modified to only report $1,000, the bank and retailer would be none the wiser. The store inherently trusts the safe to report how much cash it has, Salazar said. That includes popping open the safe’s doors, which they did.Īttackers could also perform much more sophisticated frauds using the database file that would be harder to detect, Salazar said. “By just editing that file, you can make the safe do anything you want,” Salazar said. Petro and Salazar had administrator access to a Microsoft Access database file, which retains information on how much money the safe contains, user accounts on the system, when the door has been opened and other log files. They found a way to escape that application-known as a kiosk-bypass attack-through a help menu, gaining access to the backend Windows XP embedded operating system.Īt that point, it was game over for the safe. The CompuSafe has a nine-inch touchscreen that runs an application that is used for entering authentication credentials. The doors on a CompuSafe Galileo from Brinks can be opened using 100 lines of code inserted using the safe's USB port, security researchers say. “Every step of the way, we were like, ‘This can’t be possible’,” Petro said. It was a sign of more bad things to come. “Nothing good comes from that,” Salazar said.
That allowed them to plug in a keyboard and a mouse, which worked. The most egregious problem they found is a fully functional USB port on the side of the safe.
0 kommentar(er)
