Payment systems are old and have – unlike card protocols – seen little scrutiny so far. This talk enumerates design and implementation flaws in payment processing systems, which can defraud consumers and merchants.<p>Like most embedded devices, payment system elements are potentially vulnerable to a range of attacks. This has not changed in years. What did change, though, is the exposure of these vulnerabilities: Serial interfaces are now exposed via ethernet; proprietary backend protocols are reachable over the Internet TCP, and flaws in real time operating systems are widely known.<p>This talk provides an overview of design issues and implementation vulnerabilities in current payment processing systems, including un-authenticated protocols and insecure hardware implementations, which enable fraud vectors against merchants who operate payment terminals and consumers who use them.<p><a href="https:&#x2F;&#x2F;events.ccc.de&#x2F;congress&#x2F;2015&#x2F;Fahrplan&#x2F;events&#x2F;7368.html" rel="nofollow">https:&#x2F;&#x2F;events.ccc.de&#x2F;congress&#x2F;2015&#x2F;Fahrplan&#x2F;events&#x2F;7368.htm...</a>