But we can still marvel at the engineering that went into building it. A device like this is awash in custom components that you can’t get datasheets for, and even if you could, aren’t exactly the sort of thing you could use in your average DIY project. Actually, there’s almost nothing that can be reused. Unfortunately, there isn’t a whole lot in here that can be used for much else. Since the device had either scrambled its internal storage or activated some kind of software flag that would prevent it from being used again, I could strip it for parts without the normal pangs of guilt. It saved me from having to decide if I should bother reassembling it or not. In a way, I was glad that the anti-tamper system in the VeriFone MX 925CTLS rendered it a paperweight upon disassembly. Feel free to leave a comment if you know any other tricks that are commonly used, or even if you see one here that slipped by me. Even still, I wouldn’t be surprised if I missed a couple. If we count the physical disconnection of this board, that’s five different ways for the VeriFone MX 925CTLS to detect it has been tampered with. Drilling through the board would invariably break a trace, and effectively be the same as if you triggered the tamper-evident systems normally. Plunger attached to one of the case screws.īut what about simply drilling through this little board to access the electronics underneath? That’s where all those traces on the PCB come in. But before you even got that far, the white plunger attached to one of the back panel screws would have lifted off its pad on the main PCB, alerting the system to the fact somebody was attempting to open it. So even if somebody figured out how to open the case without breaking the electrical connection (such as with some kind of extension cable), those features would still trip once physically separated from the rest of the device. But if you look closer, there’s also a reed switch and pads on the board that correspond to the appropriate features on the inside of the enclosure. If the back panel of the device is removed, then this small PCB becomes disconnected from the main board, and the VeriFone MX 925CTLS knows it’s been opened up. To prevent that sort of tampering, these devices utilize various tricks to deactivate themselves in the event that somebody tries to crack open the case. The ideal solution is to integrate the skimmer hardware directly into the terminal itself so it can’t be seen from the outside. We’re all aware of card “skimmers” which mount to the outside of a payment terminal, but from a criminal’s standpoint, the big weakness with such devices is that you can just yank the thing off. The unfortunate reality is that there are some very clever people out there who are actively looking to “crack” devices like the VeriFone MX 925CTLS. So if you’ve ever wondered what’s inside that machine that was swallowing up your debit card, let’s find out. There’s a good chance that you’ve seen one of these, or at least something very similar, while checking out at a retail chain. This is a fairly modern payment terminal with all the bells and whistles you’d expect, such as support for NFC and EMV chip cards. So without further ado, I present the first piece of hardware from my Toys “R” Us expedition: the VeriFone MX 925CTLS. Perhaps that accounts for the reshuffling of priorities, but I don’t want to make excuses. You could have a baby in that amount of time. I liberated several carloads worth of equipment from Geoffrey’s fallen castle with every intention of doing a series of teardowns on them, but it’s been nine months and I’ve got nothing to show for it. Ironically, I too have been somewhat derelict in my duty to the good readers of Hackaday. As a result of the media attention, it was revealed that the management teams of several other stores were similarly derelict in their duty to properly dispose of Toys “R” Us equipment and documents. The resulting article and accompanying YouTube video were quite popular, and the revelation that employee information including copies of social security cards and driver’s licenses were left behind even secured Hackaday and yours truly a mention in the New York Post. It was now the responsibility of the new owners to deal with all the detritus of a failed retail giant, from the security camera DVRs and point of sale systems to the boxes of employee medical records tucked away in a back office. Despite playing host to the customary fixture liquidation sale that takes place during the last death throes of such an establishment, this particular location was notable because of how much stuff was left behind. Regular Hackaday readers may recall that a little less than a year ago, I had the opportunity to explore a shuttered Toys “R” Us before the new owners gutted the building.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |