[HN Gopher] Kiosk mode bypass for an Ariane Allegro Scenario Pla...
___________________________________________________________________
Kiosk mode bypass for an Ariane Allegro Scenario Player based hotel
check-in te
Author : todsacerdoti
Score : 49 points
Date : 2024-06-05 07:57 UTC (1 days ago)
(HTM) web link (www.pentagrid.ch)
(TXT) w3m dump (www.pentagrid.ch)
| tantalor wrote:
| > the underlying Windows Desktop
|
| I think I found the problem
| SpaceL10n wrote:
| It's shocking just how many kiosk manufacturers expose the
| underlying OS. Ariane isn't the only one.
| RicoElectrico wrote:
| On Linux you can make Qt use the framebuffer directly without
| a window manager. With that setup there's nowhere to break
| out. And if it crashes to the console - no way out either
| with no physical keyboard present.
| amluto wrote:
| An actually good design would be secure even with a
| physical keyboard. "All" you need to do is keep the
| keyboard from interacting with the Linux VT system (which
| is not conceptually difficult).
| w0m wrote:
| Honestly this seems like a crazy simple client application bug;
| simply add a single quote as part of your name and it crashes.
| How does that pass even incredibly basic QA to make production?
| Maybe I've been blessed (or cursed?) to only work at shops with
| full qa teams.
| hnburnsy wrote:
| They should be using kiosk mode which allows only one app to
| run and no access to the desktop.
|
| https://learn.microsoft.com/en-us/windows/iot/iot-enterprise...
| fuzzfactor wrote:
| I think they are using kiosk mode.
|
| However sometimes if you plug in a keyboard and hit ctrl-alt-
| del you get task manager and can run additional programs.
|
| I can imagine the Allegro app uses a virtual keyboard of some
| type for this user entry, and it goes south from there.
| unwind wrote:
| Meta: title is weirdly truncated "te" should be "terminal".
| lainga wrote:
| OT: I wonder if this company has ever had trademark trouble with
| Arianespace, and why/why not. They're even both headquartered in
| a suburb of Paris.
| jefftk wrote:
| In general a trademark is only valid within a field. So Dove
| (chocolate) and Dove (shampoo) are not in conflict, and neither
| is Delta (air travel) with Delta (plumbing).
| duskwuff wrote:
| Or, for my favorite example: Monster (energy drink) vs.
| Monster (cables) vs. Monster (job search).
| cortesoft wrote:
| The fact that a single quote broke the system makes me question
| all of their input sanitation.
| whalesalad wrote:
| git commit -m "adding YOLO mitigations"
| byteknight wrote:
| Good ol' bobby tables at it again.
| crazygringo wrote:
| How the heck does a bug with a single quote make it past QA, let
| alone _crash_ an app?
|
| I was expecting some kind of SQL injection, which you could at
| least understand as a result of incompetence. Or I can similarly
| understand UTF-8 bugs or whatever.
|
| But it's not like O'Brien is an uncommon name. I don't know if
| I'm more mystified by the fact that this made it past testing, or
| that rather than the reservation lookup just returning no matches
| it actually _crashes_.
|
| I'm really trying to imagine what possible code could be
| crashing. I guess my best guess is an off-by-one error in a
| function trying to escape strings for use in a SQL query, that
| leads to inserting infinite quotes and running out of memory. But
| then I can't imagine who would be writing their own escaping
| function...
| chx wrote:
| QA costs money. Why would you spend that money? The clients are
| captive: replacing the system would mean replacing every room
| lock which is serious cost and hassle.
| thriftwy wrote:
| In my opinion it is extremely stupid to use Windows Desktop for
| kiosks. There are always ways to crash or minimize the kioks app.
| Then you are on the loose.
|
| With Linux and X, it is possible to run X server with a specific
| app inside. You crash the app, it restarts together with X
| server.
|
| Of course, in Windows you can specify a different app other than
| Explorer.exe as "shell" and get a single app session! It just
| doesn't get used because:
|
| Unfortunately, these systems seem to always been developed by
| especially clueless people who only ever have seen hammers in
| their lives and therefore everything looks like nails.
|
| Having said that, the quality of embedded programming always
| looks subpar. It's like these people see themselves as hardware
| makers and therefore think they can avoid learning software
| making 101.
| chx wrote:
| You contradict yourself: first you blame Windows then you blame
| clueless people.
|
| Here's the truth: for any organization the most secure
| operating system is the one your people have experience in.
| That's it. Good Windows sysadmins can run a secure Windows shop
| and bad Linux sysadmins can run an insecure Linux shop. It's
| the people.
| HeWhoLurksLate wrote:
| It is amusing to me in a comment about a particular group only
| seeing hammers and nails that the presented solution focuses
| specifically on a singular technology / implementation.
| ziddoap wrote:
| > _2024-03-07: Tried to find information how a vulnerability can
| be reported to Ariane Systems. The vendor does not use
| security.txt nor a DNS TXT record for security contact lookup.
| There is no information on the website how to contact the product
| security team. Therefore, Pentagrid initially contacted Ariane
| Systems via support@ariane.com._
|
| Ugh. I've been in a similar scenario and had to report a security
| bug via the normal support channel for a fairly large-sized
| company. Never again. It was significantly more work to get the
| bug in front of someone who understood it and could do something
| about it than it was developing the exploit in the first place.
|
| After a certain company size it should be a legal requirement to
| have a dedicated security contact listed somewhere.
|
| Now, after a few good faith attempts to get an exploit in front
| of the appropriate person at a company, I just forget it. I'm
| sure there are people in similar situations who, after a few
| attempts to report to the company, end up selling the exploit
| rather than forgetting it.
| RIMR wrote:
| This is pretty hilarious, because I am familiar with these
| systems, and the correct way to bypass the kiosk mode application
| is to open the little drawer at the bottom of the self check-in
| station, and hit Alt+F4 on the little keyboard.
|
| Then you can plug in a USB key and do whatever you want.
|
| Ariane doesn't give a single shit.
| drozycki wrote:
| It's hugged to death at the moment
|
| https://web.archive.org/web/20240605075458/https://www.penta...
___________________________________________________________________
(page generated 2024-06-06 23:01 UTC)