If espionage is the world’s second-oldest profession, counterfeiting may be in the running to be third on that list. People have been trying to forge currency for just about as long as currency has been circulating, and anti-counterfeiting methods have tried to keep pace with the state of the art. The anti-counterfeiting technology in use today of course relies on computers and software, and like all software, it has bugs, as researchers at IOActive discovered when they reverse-engineered the firmware in a popular Euro currency verifier and found that they could insert their own firmware and force the machine to verify any piece of paper as a valid Euro note.
Ruben Santamarta, a researcher at IOActive in Spain, decided to have a look at the firmware in a machine called the Secureuro, which is used widely in that country to verify Euro notes in a variety of settings. After watching some videos from the vendor Inves on the machine’s operations and reading through the machine’s documentation, Santamarta came to the conclusions that some of the security claims the vendor makes were somewhat specious.
“Unfortunately, some of these claims are not completely true and others are simply false. It is possible to understand how Secureuro works; we can access the firmware and EEPROM without even needing hardware hacking. Also, there is no encryption system protecting the firmware,” Santamarta said in his analysis of the firmware.
“My intention is not to forge a banknote that could pass as legitimate, that is a criminal offense. My sole purpose is to explain how I identified the code behind the validation in order to create ‘trojanized’ firmware that accepts even a simple piece of paper as a valid currency. We are not exploiting a vulnerability in the device, just a design feature.”
In that regard, Santamarta succeeded. He began by downloading the firmware for the Secureeuro from the vendor’s site and then performing a detailed analysis of the code to see how it works and what the important functions are. He found a number of interesting functions in the firmware and one of the things he came across was the counter that increments the number of invalid banknotes the machine has counted.
“Wait, hold on a second, the number of invalid banknotes is being stored in a three byte counter in the EEPROM, starting at position 0xE. Are you thinking what I’m thinking? We should look for the opposite operation. Where is that counter being incremented? That path would hopefully lead us to the part of code where a banknote is considered valid or invalid 🙂 Keep calm and ‘EEPROM_write’ Bingo!” Santamarta wrote.
Digging a bit further, Santamarta discovered that there are two functions that assign a value to a given bank note. One assigns a preliminary value and the second one assigns a final value for each note. He determined that the firmware may be processing some of the security features of a note, such as the ink or a hologram, with one function and then processing another set with the second function. He identified a separate function that performs some analog-to-digital conversion of input.
“This function receives the input pin from the ADC conversion as a parameter. As expected, it is invoked to complete the conversion of six different pins; inside a timer. The remaining three digital signals with information about the distances can also be obtained easily,” he said.
“The last step was to buy the physical device. I modified the original firmware to accept our home-made IOActive currency, and…what do you think happened?
“The impact is obvious. An attacker with temporary physical access to the device could install customized firmware and cause the device to accept counterfeit money. Taking into account the types of places where these devices are usually deployed (shops, mall, offices, etc.)Â this scenario is more than feasible.”
So Santamarta’s technique could enable an attacker to load his own malicious firmware onto a target device and validate counterfeit money. Euros, like other widely circulated currencies, have a number of security and anti-counterfeiting features and Santamarta’s research shows that it’s not necessary to circumvent those in order to pass counterfeit notes. The easier method is to attack the validator itself, rather than the notes.
Image from Flickr photos of Tax Credits.
