Уязвимости киосков самообслуживания

Уровень 0 · материалов: 4

В кластер входят документы об эксплуатации уязвимостей в настройках ОС для получения полного доступа к терминалам самообслуживания и государственным сервисам.

Общие признаки: обход ограниченного интерфейса, доступ к операционной системе, ошибки конфигурации терминалов, недостатки безопасности публичных киосков

Группа выше: Банкоматы, терминалы и платёжные карты

Материалы

• #29003 — Security Flaws in Electronic Government Kiosks — Представитель этого кластера

  Киоск электронного правительства с пасьянсом и маджонгом — dreamerchant

  Смысл: The text highlights the critical lack of security and system hardening in public electronic government terminals, demonstrating how a simple configuration error allows unauthorized access to the OS and the ability to disable the service.

  An author discovers that a public government kiosk in Saint Petersburg is just a standard Ubuntu PC with a hidden taskbar, allowing anyone to play games or shut down the system.

• #28548 — Security Vulnerabilities in Russian MFC Public Terminals

  Немного о безопасности терминалов в МФЦ — gdt

  Смысл: The author demonstrates a critical lack of security in public government service terminals (MFC), showing how easily a user can break out of the restricted interface to gain full control of the Windows operating system.

  An IT professional demonstrates how a simple keyboard shortcut (Ctrl+Shift+Esc) allows full administrative access to public government terminals due to poor security configuration.

• #11389 — Security Vulnerabilities in Self-Service Kiosks

  80% касс самообслуживания под угрозой — frsamara

  Смысл: The main idea is that many self-service kiosks are insecure because administrators fail to disable basic OS features (like Windows 10 gestures), allowing users to bypass the restricted application and gain full system access.

  An enthusiast demonstrates how simple Windows 10 gestures allow unauthorized access to the underlying system of many self-service kiosks due to poor administrative configuration.

• #16997 — Sberbank Terminal Vulnerability via Sticky Keys

  СберШифт: пять раз нажимай и в систему попадай — namikiri

  Смысл: The text illustrates how a simple OS-level accessibility feature (Sticky Keys) can create a security vulnerability in kiosks if the environment is not properly locked down, and highlights the effectiveness of public disclosure in speeding up corporate bug fixes.

  A user discovered that pressing Shift five times on a Sberbank terminal opened Windows settings and the taskbar, leading to a patch after the issue was posted online.