Do no trust public Internet kiosk devices

Some time ago I was stuck for several long hours at a German airport in the middle of nowhere. I decided to spend them on proving that Internet kiosks are vulnerable to local attacks and thus unsafe. I will not give you a full tutorial on how to make free Internet access, since I may need it in the future . Instead, I just want to warn you that you shouldn't trust such devices - I was able to gain full control over it. See below for a proof.

The first one shows a default application on T-Mobile's Internet kiosk. By playing a little bit with the interface I was able to crash it (see error message). Note that the account shows 0,00E, so I didn't have to pay anything prior to crashing it:


A little bit more playing and I have launched Windows Task Manager and Internet Explorer. Note the ad banner on top of the screen. It is an independent application. I could kill it with Task Manager, but decided to make photo with it to prove that it is still an Internet kiosk:


Things I learned about the system:

- The application engine for T-Mobile Internet kiosks is made by Degasoft and its name is Kudos.
- Its 'security' is mostly achieved by obscurity. For example, the engine constantly sets focus and always-on-top application attributes to itself, which is annoying but does not provide any real security at all.
- The kiosk is equipped with hardware monitoring which forces to reboot the machine every several minutes if the main application is not responding. It is just enough to finish taking over full control after the application is dead.

Things I was able to do without paying anything:

- gain full controll (it takes up to 1 hour to do that)
- surf the net for free
- launch any application that is already installed (like mplayer - you can see it in the Task Manager application list in the picture above; no wonder why it was already installed )
- install any application (it could be a key logger, for example)
- uninstall any application (including Kudos Internet kiosk engine)
- view network drives and write to most of them
- copy apps, logs, configs, IE temporary files to external server
- reboot or shutdown the machine
- make it completely unusable by the time the technical service arrives

I hope you will think twice next time before logging in to your bank account using public Internet kiosk...