The purchase of overly expensive devices such as Apple's MacBook for just $1 is actually something that can happen due to a vulnerability in SAP POS systems, research published by the security company ERPScan shows.
The company has analyzed in a YouTube video how a security breach can occur in the SAP POS Xpress Server to modify the price of a specific product, to divert payments, and to collect financial data such as the details of a card that is used at a specific time.
The vulnerability is in the SAP POS Xpress Server which handles payments made through SAP POS systems in the store, and research shows that an attack has a high chance of being successful because the application misses many server-side authorization checks.
The security company says that for a hacker to breach the SAP POS system, the attack must be launched from the same network used by the payment solutions, so cybercriminals naturally have to be in a store to exploit the flaw. This is possible with very cheap hardware, such as the Raspberry Pi and other tools that cost a total of just $25.
On the other hand, if there is an Internet connection, attacks can also be carried out remotely, but only if the network is exposed to external connections.
“Once you are logged in, you have unlimited control over the backend and frontend of the POS system, as the tool can upload a malicious configuration file to the SAP POS Xpress Server without any authentication process. The new parameters are limited by the hackers’ imagination: they can specify a special price or discount, the time the discount is valid, the conditions under which it works – for example, when purchasing a specific product,” the company explains.
The good side of the situation is that the vulnerability has already been reported to the parent company in April of the current year and fixes have already been sent to prevent the attacks.
