Chuck Darwin on Nostr: Since Redbox went bankrupt, many have wondered what will happen to those red kiosks ...
Since Redbox went bankrupt, many have wondered what will happen to those red kiosks and DVDs.
Another question worth examining is: What will happen to all the data stored inside the Redboxes?
Redbox parent company Chicken Soup for the Soul filed for Chapter 7 bankruptcy in June and is in the process of liquidating its assets.
Meanwhile, stores with Redboxes are eager to remove the obsolete hardware.
And tinkerers have reported getting their hands on Redbox kiosks and doing all sorts of things with them, including running Doom.
But Redboxes falling into technologists' hands can also result in the uncovering of customer data from kiosks' hard drives.
As spotted by Lowpass today, programmer and expert reverse engineer #Foone #Turing reported via Mastodon that she was able to retrieve records for 2,471 transactions from the disk image of a Redbox hard drive.
Turing told Ars Technica that she got the image from a Discord channel:
[The Redbox] logged lots of information, including debugging information from the transaction terminal, and they left old records on the device.
This probably saved them some time on QAing software bugs, but it exposed all their users to data being leaked.
Data went back "to at least 2015," Turing said on Mastodon. She told Lowpass the data included "records for when stuff is rented," including customers' email addresses and zip codes, as well as names of rented discs and when they were rented.
Turing was also able to retrieve some numbers of customer credit cards.
“The device talks to a secure payment transaction device (so there's no logs of full credit info) but it logs a bunch of stuff that it really shouldn't: We've got the first 6 and last 4 [digits] of each credit card used, plus some lower level transaction details,” Turing told Lowpass.
https://arstechnica.com/gadgets/2024/10/redbox-hard-drive-hacked-to-reveal-customer-information-from-2471-rentals/
Another question worth examining is: What will happen to all the data stored inside the Redboxes?
Redbox parent company Chicken Soup for the Soul filed for Chapter 7 bankruptcy in June and is in the process of liquidating its assets.
Meanwhile, stores with Redboxes are eager to remove the obsolete hardware.
And tinkerers have reported getting their hands on Redbox kiosks and doing all sorts of things with them, including running Doom.
But Redboxes falling into technologists' hands can also result in the uncovering of customer data from kiosks' hard drives.
As spotted by Lowpass today, programmer and expert reverse engineer #Foone #Turing reported via Mastodon that she was able to retrieve records for 2,471 transactions from the disk image of a Redbox hard drive.
Turing told Ars Technica that she got the image from a Discord channel:
[The Redbox] logged lots of information, including debugging information from the transaction terminal, and they left old records on the device.
This probably saved them some time on QAing software bugs, but it exposed all their users to data being leaked.
Data went back "to at least 2015," Turing said on Mastodon. She told Lowpass the data included "records for when stuff is rented," including customers' email addresses and zip codes, as well as names of rented discs and when they were rented.
Turing was also able to retrieve some numbers of customer credit cards.
“The device talks to a secure payment transaction device (so there's no logs of full credit info) but it logs a bunch of stuff that it really shouldn't: We've got the first 6 and last 4 [digits] of each credit card used, plus some lower level transaction details,” Turing told Lowpass.
https://arstechnica.com/gadgets/2024/10/redbox-hard-drive-hacked-to-reveal-customer-information-from-2471-rentals/