Article Response 30 (Root on POS Machine)

That was the boring story of how I got the root shell. It is just there, exposed. No sophisticated exploit chain, no brute-force password cracking required. Additionally, everything seems to still work although the device still shows the tamper message

Article

In this article, the author walks us through the process they used to hack a POS terminal used to accept card payments. It's a really interesting read and even though my hardware knowledge is a bit rusty (no thanks to Covid), I was still able to follow along. If you get stuck, use Grok to find out what different terms mean or you could even paste the entire thing in the prompt window and then tell it to ELI5 (explain it me like I'm 5) [1].

When it comes to working with computers, it's a good rule of thumb to always understand the layer on the stack below which you are working on. So if you're a web developer, you should understand how systems work (threads, processes, memory management etc.). If you're a systems developer, you should understand assembly, boot loaders etc. And so on and so forth. The logic behind this is that every level of the stack uses abstractions of the level below it. Most times, when you start out, you use those abstractions without really knowing what they do behind the scenes.

But as you mature, you start to run into esoteric bugs, performance becomes a factor or your curiosity just gets the better of you. Regardless of the reason why you start to dig, once you start digging into what's actually going on behind the scenes, you've a begun a very enriching journey. You'll likely have to do a lot more reading than you intended but once you get a handle on things, you'll realize that you've become more adept at your day-to-day tasks.

In particular, you'll be much better at making design decisions, you should be able to better evaluate when and where in the code performance should be a feature and (my personal favorite) you begin to understand how valuable certain constructs and techniques are in your tools of choice.

All in all, it's a very worthwhile way to spend your time. Easy it won't be but better of you will be for having done it.

[1] - If you're studying a new field, using ELI5 in an LLM for new terms is a serious learning hack

Thanks for reading and as always, all comments, critiques and questions are highly appreciated. Here's a link to the previous article response.

Brought to you by mulVid.