A journey to protect POS by Nir Valtman Discoverer of Point-of-Sale Vulnerabilities From Target to other retail chains were all about 'POS'. Point-Of-Sale vulnerability has been at its peak for a while. This talk illustrates the POS vulnerabilities from both retailer and software vendor's perspective. Get an insight into how the POS devices are compromised including difficult methods like memory scraping. This talk will demonstrate the working of POS vulnerability and how threats can be minimized. It will also explain the ways to mitigate the risk while you get the basic concepts and get to know which of these actually work.

1. A Sprint To
Protect Points
Of Sale
Nir Valtman, CISSP
W : www.valtman.org
. : @ValtmaNir

2. Introduction
2
Photo by Bill Fraser

3. 11/18/14 3

4. 11/18/14 4
I’m an architect

5. 5

6. 11/18/14 6

7. 7
Zombies!!!

8. 8
Defacement

9. 9
AntiDef
OPEN SOURCE
Memory Scraper
Secure TDD
Cloudefigo

10. 10

11. Why Points Of Sale
Targeted?
11

12. 12

13. Ecommerce
POS
Credit Card
PANs
Credit &
Debit Card
Dumps
Credit Card
PANs
13

14. Retail
Environment
Assumptions
100% PCI Compliant

15. Retail
Environment
Assumptions

16. Retail
Environment
Assumptions

17. Retail
Environment
Assumptions
Not
vulnerable

18. Retail
Environment
Assumptions

19. Retail
Environment
Assumptions
Cashier ≠ hacker

20. RATs

21. Routing

23. 23
Memory Scraping

24. Bypassed Solutions
24

25. 25
Next NextNextNext Next Generation Firewall

26. 26
ANTI
*

27. 27

28. 28
Whitelist
MD5 SHA256

29. Correct Solutions
29

30. 30
Cyber
Intelligence

31. 31
Network-based
Anomaly Detection

32. 32
Operating System
Anomaly Detection

33. Not only products
required
33
!

34. 34

35. 35
Assembly
Signing

36. 36
Assembly Obfuscation

37. PROCESS ISOLATION

38. Summary
38

39. 39
Memory
Scraping
Security by Obscurity

40. 40
Memory
Scraping
Simple Exploitation

41. 41
Memory
Scraping
Hard to Protect

42. Nir Valtman
W : www.valtman.org
. : @ValtmaNir