Chipotle may have banished E coli, but now it has a new infection The last quarter has been a trying one for Mexican fast-food chain Chipotle. People are returning to its restaurants after the great 2015 E coli outbreak, but now customers are being struck by a different kind of virus. The taco takeaway admitted that it had become the latest victim of what sounds like classic cash register …
Also, I was bored and I completed my treatment of the big banner advert that has been sending me secret signals all the past week or so... I give you now:
Infosys 7 Mainframe Migration Challenges, featuring Kate and Simon:
1) Gosh, Kate smells really good today, what is she wearing?
2) Kate has awesome hair, she really does smell nice, don't let on!
3) I think Kate knows I like her, I mean really really like her. Be cool.
4) I'm starting to sweat with Kate right next to me. How can I apply more deodorant during my break?
5) Ask her to lunch! No, she won't go. Just ask her already!
6) Pretend to be more interested in the terminal than Kate, or her blouse, or her hair, oh no, I just saw her shoes... this is going to be a long day.
7) Why do people still use mainframes, and why does Kate bother working here?
Doesn't matter, any system can be infected. I've done a proof of concept malware for client with PoS systems that was just a bash script that would run tcpdump, filter for credit card numbers with grep, use a bit of sed to combine the information into a semi-structure format, then XOR'ed the data with a pre-shared key (Actually a DNS query to my domain then used the result as the key) then would query my DNS server for a host named <Encoded_CC_Data>.<subdomain>.<my_domain>.com.
The infection method was to just hi-jack the PoS terminals boot process. When the terminal boots up, it sends out a DHCP/BOOTP request, the server would then pass an IP address to client for a TFTP server to receive its configuration. All I had to do was to plug a small system into the network that would emulate a PoS terminal so that I'd get a copy of what the PoS terminals would. Next step was to modify the payload with my script added into it. Once that was prepared, the device would DoS the real DHCP server (Exhaust its addresses) then give out its own address for the TFTP server and give the poisoned package to those systems.
I was able to also a quick nmap and found that the boot server I was attacking was responsible for the entire region and that each store was connected to it by way of an L2TP VPN. With a slight modification of my attack, I was able to infect about 30 stores and about 120 PoS terminals.
The whole thing just used utilities that came pre-installed with the OS, so would avoid any and all anti-malware scans. The only signs of my attack were that the PoS terminals had an extra line in their crontab (the entire script could be condensed to a single line), the DHCP server seeing a little less traffic, and some odd DNS queries coming out of each store's network (Although my domain would, at first glance, look just like a legitimate domain). Hell, I didn't even attack the cash registers themselves, nor any other server, just exploited some weaknesses in the network.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
