A researcher discovered the information kiosks used by Southern Rail in stations across the United Kingdom are susceptible to cyberattacks.
The researcher found kiosks in stations that are particularly understaffed are most vulnerable. The vulnerabilities reportedly exist in the certificate upload process of the information kiosks.
The bugs in the machines could allow an attacker to upload a compromised certificate to carry out cybercriminal activities with escalated privileges, according to the researcher.
The researcher, who uses the handle “vonsenger,” told reporters he discovered the vulnerabilities in November 2016. Although the security researcher notified Southern Rail, he said he doubted the machines were updated as they have to be remotely administered.
The kiosk machines contain vulnerabilities that could allow the attacker to achieve privileged access and manipulate the machine to be leveraged in other attacks.
Southern Rail underscored that no personal or confidential customer data is stored on the information kiosks.
The parent company of Southern Rail, ThamesLink Railway, is working with the transportation firm to investigate the researcher’s findings and seek proper security measures to mitigate against these types of attacks.