Kiosk Breakouts
Interactive kiosks are computer systems that are generally intended to be used
by the public
for tasks such as Internet browsing, registration, or information retrieval.
They are commonly installed in the lobbies of corporate buildings,
in airports and retail establishments, and in various other locations.
As publicly-used systems, kiosks are designed with restrictive interfaces
and offer limited functionality which is designed to prevent malicious behavior.
However, these unattended systems are generally connected to back-end systems
or corporate networks
and as such can act as a platform for compromise.
Similarly, a thin client
provides a limited interface to a powerful back-end system.
This type of client may be physical,
such as a self-contained Wyse Client
or virtual, such as the Citrix virtual desktop.
The attack methodology used against kiosks and thin clients is similar.
In this module, we’ll focus on Porteus Kiosk
as a case study in exploiting a locked-down kiosk
in order to escape the limited user experience
and fully compromise the system.