BEGIN:VCALENDAR VERSION:2.0 PRODID:Data::ICal 0.24 BEGIN:VEVENT DESCRIPTION: 'Title: Insert coin: Hacking arcades for fun\n When: Satur day\, Aug 10\, 12:00 - 12:50 PDT\n Where: LVCC West/Floor 2/W204-W207/W2 04-W207-Infinity - [1]Map\n\n Description:\n\n Since we were children we wanted to go to the arcade and play for\n hours and hours for free. H ow about we do it now? In this talk I’m\n gonna show you some vulnerab ilities that I discovered in the cashless\n system of one of the biggest companies in the world\, with over 2\,300\n installations across 70 cou ntries\, from arcades in Brazil\, amusement\n parks in the United Arab E mirates to a famous roller coaster in Las\n Vegas. We will talk about AP I security\, access control and NFC among\n other things.\n\n\n Descri ption\n -----------\n\n The talk is divided into 10(+1) stages. Starti ng at Stage 0\, I will\n relate the origin of the idea during H2HC Brazi l in 2023. Initially\,\n the proposal was an arcade in Brazil with a deb it card system.\n\n In Stage 1\, I will present the company\, the NFC ca rd\, an application\n to charge money and check our data\, but without e xploitable\n vulnerabilities due to the use of middleware.\n\n In the next stage\, the focus shifts to the company responsible for the\n debit card system. This Argentine company dominates the market\, with\n more than 2300 installations in 70 countries\, ranging from arcades to\n a fa mous roller coaster in Las Vegas. During the investigation\, the\n /api endpoint on the server was identified\, filtering out endpoints\n that d id not return 404 or 200. DNS enumeration and the use of Shodan\n reveal ed an outdated info.php\, as well as other servers with open\n ports and versions with vulnerabilities. Documentation was also found\n in /api/v 2 without the necessary credentials.\n\n In Stage 3\, the IDOR and Broke n Authentication vulnerabilities will be\n explained. Then I will presen t endpoints in the system that allow us\n to exploit these vulnerabiliti es and obtain card information and\n personal customer data.\n\n Then\ , it will be revealed that the company provides a mobile\n application. When decompiling some applications\, keys and API\n endpoints were disco vered. All APKs were similar\, differing only in\n keys and endpoints. N ow\, with these credentials we have the ability to\n recharge credit to our debit card.\n\n In Stage 5\, we will explain the Account Takeover at tack and how to\n execute it on the system via API. Also I’ll explain Race Condition\n found in the API.\n\n In the next scenario\, a server found in Shodan: The online event\n booking system. Confidential inform ation was found here\, such as all\n Argentinean invoices\, logs and ext ra company information\, obtained by\n script written by me.\n\n A res ervation management portal was also identified with a Broken\n Access Co ntrol vulnerability\, allowing us to view and modify all\n reservations\ , including modifying prices. It is important to note that\n all of thes e vulnerabilities affect ALL of the company's customers.\n\n As we near the end\, other servers will be quickly highlighted\, such as\n the comp any's public Zendesk\, allowing user creation and access to\n useful inf ormation. A U.S. case will be presented where a go-karting\n facility us es this system\, allowing access to all monitors. Other\n examples inclu de an amusement park company in Spain providing links to\n their park ma nagement consoles\, and similar findings in Chile\, Ecuador\n and Phoeni x.\n\n The last scenario will explain the NFC system\, focusing on card\ n reading and manipulation due to lack of security. Some attacks\, such\ n as changing the ID and referencing another card\, will be shown. I’m \n also going to show the “feature” of emulating the card with the\n NFC of android phones\, thus being able to emulate any card.\n\n The idea of the talk is to demonstrate that even in 2024 there are\n signifi cant systems with many users and with "basic" vulnerabilities\n known fo r years. Also I would like to encourage new generations to do\n ethical hacking and help generate a good relationship between hackers\n and comp anies. Computer security education and training are crucial to\n prevent attacks and protect our digital assets.\n\n\n Outline\n -------\n\n * Stage 0\n\n * Introduction\n\n * Stage 1\n\n * Ab out Brazilian arcade and cashless system\n\n * NFC Card\n\n * Website to charge money and view data\n\n * Stage 2\n\n * Company who provide the system\n\n * More than 2300 installations across 70 countries\n\n * Api endpoints\n\n * Stage 3\n\n * IDOR and Broken Authentication\n\n * A lot of user and cards data\n\n * Not just arcades. Roller coaster Vegas. Clients around the\n world\n\n * Stage 4\n\n * Mobile app for all the customers\n\n * Keys and endpoints in plain text (DEMO)\n\n * Endpoint to recharge credits\n\n * Stage 5\n\n * Accou nt Takeover (DEMO)\n\n * Race Condition (DEMO)\n\n * Stage 6\n \n * Online Party Booking\n\n * A lot of confidential info rmation\n\n * Script to get data (DEMO)\n\n * Stage 7: Booking Management portal\n\n * Broken Access Control\n\n * List and modify all the bookings\n\n * Stage 8: Side servers\n\n * Public zendesk with data\n\n * Go-karting in U.S.\n\n * Am usement park in Spain\n\n * Chile\, Ecuador\, Phoenix\n\n * St age 9: NFC\n\n * Brazilian card\n\n * Leak security\n\n * Android NFC\n\n * Stage 10\n\n * A lot of customers in the U.S.\n\n * Conclusions\n\n * QA\n\n SpeakerBio: Ig nacio Daniel Navarro\, Appication security / Ethical\n hacker\n\n Igna cio Navarro\, an Ethical Hacker and Security Researcher from\n Cordoba\, Argentina. With around 6 years in the cybersecurity game\,\n he's curre ntly working as an Application Security. Their interests\n include code analysis\, web application security\, and cloud security.\n\n Speaker at Hackers2Hackers\, Security Fest\, BSides\, Diana Initiative\,\n Hacktiv ity Budapest\, 8.8\, Ekoparty.\n\n '\n\n 1. #LVCCW_Level2_West\n\n\n DTEND:20240810T195000Z DTSTART:20240810T190000Z LOCATION:RTV - LVCC West/Floor 2/W204-W207/W204-W207-Infinity SUMMARY:Insert coin: Hacking arcades for fun END:VEVENT END:VCALENDAR