[HN Gopher] Kiosk mode bypass for an Ariane Allegro Scenario Pla...
       ___________________________________________________________________
        
       Kiosk mode bypass for an Ariane Allegro Scenario Player based hotel
       check-in te
        
       Author : todsacerdoti
       Score  : 49 points
       Date   : 2024-06-05 07:57 UTC (1 days ago)
        
 (HTM) web link (www.pentagrid.ch)
 (TXT) w3m dump (www.pentagrid.ch)
        
       | tantalor wrote:
       | > the underlying Windows Desktop
       | 
       | I think I found the problem
        
         | SpaceL10n wrote:
         | It's shocking just how many kiosk manufacturers expose the
         | underlying OS. Ariane isn't the only one.
        
           | RicoElectrico wrote:
           | On Linux you can make Qt use the framebuffer directly without
           | a window manager. With that setup there's nowhere to break
           | out. And if it crashes to the console - no way out either
           | with no physical keyboard present.
        
             | amluto wrote:
             | An actually good design would be secure even with a
             | physical keyboard. "All" you need to do is keep the
             | keyboard from interacting with the Linux VT system (which
             | is not conceptually difficult).
        
         | w0m wrote:
         | Honestly this seems like a crazy simple client application bug;
         | simply add a single quote as part of your name and it crashes.
         | How does that pass even incredibly basic QA to make production?
         | Maybe I've been blessed (or cursed?) to only work at shops with
         | full qa teams.
        
         | hnburnsy wrote:
         | They should be using kiosk mode which allows only one app to
         | run and no access to the desktop.
         | 
         | https://learn.microsoft.com/en-us/windows/iot/iot-enterprise...
        
           | fuzzfactor wrote:
           | I think they are using kiosk mode.
           | 
           | However sometimes if you plug in a keyboard and hit ctrl-alt-
           | del you get task manager and can run additional programs.
           | 
           | I can imagine the Allegro app uses a virtual keyboard of some
           | type for this user entry, and it goes south from there.
        
       | unwind wrote:
       | Meta: title is weirdly truncated "te" should be "terminal".
        
       | lainga wrote:
       | OT: I wonder if this company has ever had trademark trouble with
       | Arianespace, and why/why not. They're even both headquartered in
       | a suburb of Paris.
        
         | jefftk wrote:
         | In general a trademark is only valid within a field. So Dove
         | (chocolate) and Dove (shampoo) are not in conflict, and neither
         | is Delta (air travel) with Delta (plumbing).
        
           | duskwuff wrote:
           | Or, for my favorite example: Monster (energy drink) vs.
           | Monster (cables) vs. Monster (job search).
        
       | cortesoft wrote:
       | The fact that a single quote broke the system makes me question
       | all of their input sanitation.
        
       | whalesalad wrote:
       | git commit -m "adding YOLO mitigations"
        
       | byteknight wrote:
       | Good ol' bobby tables at it again.
        
       | crazygringo wrote:
       | How the heck does a bug with a single quote make it past QA, let
       | alone _crash_ an app?
       | 
       | I was expecting some kind of SQL injection, which you could at
       | least understand as a result of incompetence. Or I can similarly
       | understand UTF-8 bugs or whatever.
       | 
       | But it's not like O'Brien is an uncommon name. I don't know if
       | I'm more mystified by the fact that this made it past testing, or
       | that rather than the reservation lookup just returning no matches
       | it actually _crashes_.
       | 
       | I'm really trying to imagine what possible code could be
       | crashing. I guess my best guess is an off-by-one error in a
       | function trying to escape strings for use in a SQL query, that
       | leads to inserting infinite quotes and running out of memory. But
       | then I can't imagine who would be writing their own escaping
       | function...
        
         | chx wrote:
         | QA costs money. Why would you spend that money? The clients are
         | captive: replacing the system would mean replacing every room
         | lock which is serious cost and hassle.
        
       | thriftwy wrote:
       | In my opinion it is extremely stupid to use Windows Desktop for
       | kiosks. There are always ways to crash or minimize the kioks app.
       | Then you are on the loose.
       | 
       | With Linux and X, it is possible to run X server with a specific
       | app inside. You crash the app, it restarts together with X
       | server.
       | 
       | Of course, in Windows you can specify a different app other than
       | Explorer.exe as "shell" and get a single app session! It just
       | doesn't get used because:
       | 
       | Unfortunately, these systems seem to always been developed by
       | especially clueless people who only ever have seen hammers in
       | their lives and therefore everything looks like nails.
       | 
       | Having said that, the quality of embedded programming always
       | looks subpar. It's like these people see themselves as hardware
       | makers and therefore think they can avoid learning software
       | making 101.
        
         | chx wrote:
         | You contradict yourself: first you blame Windows then you blame
         | clueless people.
         | 
         | Here's the truth: for any organization the most secure
         | operating system is the one your people have experience in.
         | That's it. Good Windows sysadmins can run a secure Windows shop
         | and bad Linux sysadmins can run an insecure Linux shop. It's
         | the people.
        
         | HeWhoLurksLate wrote:
         | It is amusing to me in a comment about a particular group only
         | seeing hammers and nails that the presented solution focuses
         | specifically on a singular technology / implementation.
        
       | ziddoap wrote:
       | > _2024-03-07: Tried to find information how a vulnerability can
       | be reported to Ariane Systems. The vendor does not use
       | security.txt nor a DNS TXT record for security contact lookup.
       | There is no information on the website how to contact the product
       | security team. Therefore, Pentagrid initially contacted Ariane
       | Systems via support@ariane.com._
       | 
       | Ugh. I've been in a similar scenario and had to report a security
       | bug via the normal support channel for a fairly large-sized
       | company. Never again. It was significantly more work to get the
       | bug in front of someone who understood it and could do something
       | about it than it was developing the exploit in the first place.
       | 
       | After a certain company size it should be a legal requirement to
       | have a dedicated security contact listed somewhere.
       | 
       | Now, after a few good faith attempts to get an exploit in front
       | of the appropriate person at a company, I just forget it. I'm
       | sure there are people in similar situations who, after a few
       | attempts to report to the company, end up selling the exploit
       | rather than forgetting it.
        
       | RIMR wrote:
       | This is pretty hilarious, because I am familiar with these
       | systems, and the correct way to bypass the kiosk mode application
       | is to open the little drawer at the bottom of the self check-in
       | station, and hit Alt+F4 on the little keyboard.
       | 
       | Then you can plug in a USB key and do whatever you want.
       | 
       | Ariane doesn't give a single shit.
        
       | drozycki wrote:
       | It's hugged to death at the moment
       | 
       | https://web.archive.org/web/20240605075458/https://www.penta...
        
       ___________________________________________________________________
       (page generated 2024-06-06 23:01 UTC)