+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Social Engineering (https://sinister.li/Forum-Social-Engineering)
+--- Thread: Point-of-Sale Activation (/Thread-Point-of-Sale-Activation)
Point-of-Sale Activation - Ecks - 05-31-2017
In a recent thread I go on about a job I came across.
Now I don't quite know where to put this thread but this seems proper so here I go.
After dealing with this crap all day, I began to do research on the people behind the anti-theft system located on the tablet. What I discovered was a company called Digital Safety USA who has been contracted by Walmart Inc. to reduce inventory loss by placing a PoSA on their devices (not all devices just the ones they have stock in), including cell phones, tablets and computers.
This system is a pretty descent deterrent if the person stealing knows this renders the device useless unless cracked or hacked to work again ( it's actually still being tried I will update the other thread if I get it) but the problem remains that this is a new system that Walmart put in place this year and I am dead set on figuring it out and releasing as much information as I can about it.
I am sure someone here could have easily gotten pass this system with a good SE , but I am not that good at SE, my foray is breaking/unlocking devices, so far I have attempted to install a new OS (just to wipe everything including security) but it appears they figured out how to deny this or at least made it hard enough a simple adb command wont work (it had a hard time detecting device and when it did it appeared as ??????????????? locked).
So now I am digging up how this system works, not just how it generates code (which is the juicy part that can be used to make a code generator), but how Walmart PoS systems have integrated it, how this company knows if and when a device was legitimately purchased and any vulnerabilities in the system that can provide more information.
So why am I posting about this? Well it is simple, I would like anyone else who has come across this to join in, or if your interested join in, it seems like one hell of a challenge and I am sure someone on SL is smart enough to crack this cookie.
Now onto the nitty gritty the company above prints a code they generate on the device package, they call this a DiSa(it is an acronym of their company name), when the product is scanned a 6 digit code is printed onto the receipt which the buyer then punches into the device to unlock it. The device is not connected and due to volume of sales there is no way each product has an individual code there for that means it must be done by product line, meaning a limited amount of codes issued.
So while I attempt to descramble this little mystery and bruteforce a code I will also be researching all I can and appreciate any help offered in any form.
Thank you for reading all that crap and have a great day.
RE: Point-of-Sale Activation - evegrant - 06-01-2017
I have read this but I am not able to offer a hand, wish you good luck. Have a nice day.
RE: Point-of-Sale Activation - Dylan426 - 07-27-2017
Did you figure it out. I'm going through the same thing trying to get past the store recipt sales associate activation code... Help!!!
RE: Point-of-Sale Activation - Blink - 07-27-2017
Shit... I was too late.
Now I'm interesting in digging into it. :/
RE: Point-of-Sale Activation - Ecks - 07-27-2017
Still working on it, need some actual examples to build a number pool, unless someone else has any ideas how to go about it.
RE: Point-of-Sale Activation - Fayt - 09-17-2017
Hey I came across this post while researching about this new DiSa POS activation lock and decided to sign up to see if I could help in any way. I also had a tablet with this lock come to me while working on a Google FRP of the clients. I've only had the tablet for a day and not sure how much longer I'll have it, but either way I would love to crack this thing.
I've done some research on the lock and the company behind it so far. You may know this stuff already, but figure it can't hurt to put it out there. The device will have what's called an Expanded Databar UPC, which is scanned at the register and contains the information to produce the activation code. If you want to read up on what this type of UPC consists of here is some info: http://www.idautomation.com/barcode-faq/gs1-databar/#GS1_DataBar_Expanded
Im still just researching it myself so I can't offer much more than that as far as the UPC goes right now.
Another thing I've come across is the DiSa file located on the tablet. If you hook it up to a computer and navigate to "Internal Storage/Android/Data", you will see a file called "TestDiSa". I've only opened it in notepad so far and haven't deciphered much from it yet, but im not extremely familiar with this type of stuff so I am digging in to that aspect more as well right now. I'll make another post after this with what's contained in my TestDiSa file and im sure someone here can shed some more light on it. I did notice it contains more info than it did when I a first opened it so it's logging my incorrect tries is what im assuming.
Lastly, I noticed someone who was posting a lot of places when I was searching saying they could get the code for a small fee of like $15 or something like that. I emailed him, because I was curious to see what he would need from me to get the code and all he needed was this file along with the serial number on the back of my device. So there must be a way to decipher the activation code just by using the file and SN.
That's all I have for the moment so the search continues and I hope someone here will have the knowledge to get the rest of it figured out. I'll keep doing what I can and I'll post back with any progress I make. Im doing this purely for the challenge and the knowledge of it. I love these kind of things and once I get started on something I am determined to see it through. Any questions please let me know.
Thanks
RE: Point-of-Sale Activation - Fayt - 09-17-2017
Here is a copy of my TestDiSa file if anyone wants to take a look at it:
https://drive.google.com/open?id=0BzhoB2FirAqPZENMZGliQUp4Znc
Also, here is the SN on the device I currently have:
YFGV0417024548
RE: Point-of-Sale Activation - pcrepairscody - 09-19-2017
So i just joined, wanted to help out with this discussion. Ive been working on the same nextbook tablet series. Currently a nextbook ares 10a model number NX16A. SO. I'll start off by saying on the tablet box there is a model #, upc #, DiSa #, and also a green sticker with the serial #.
I'll start by saying that it's the last 6 digits of the serial number that where interested in. The first 4 numbers are model specific. So my serial starts YFGV. I've seen others with the same starting 4 digits. Next is 0317. Now these reference the manufacturer date. Mine is march 2017. And I've comfermed these 4 numbers. Then you have your last 6 digits. Now, I'm not positive, but I'm almost certain that the last digits is the key to finding the activation code.
So now. We have to hook the tablet to pc, open the testDiSa file in notepad and search for some form of the last 6 digits of the serial. Now remember that you only have a limited amount of tries. EVERYTIME YOU TRY AN ACTIVATION CODE, IT GETS LOGGED IN THIS FILE. And I dont know how many tries yout get before the tablet is permanently locked up. And we have comfermed that it will permanently lock up.
We also know that the Bios of some tablets will not allow a flash untill activated. I'll be trying tonight to decode the testdisa file. I'll let ya'll know. email me at pcrepairscody@Gmail.com if you want to join us in this disa PosA.
RE: Point-of-Sale Activation - pcrepairscody - 09-20-2017
I could be way wrong. But that's my 2 cents. I just still wonder if the disa # or upc have anything to do with it. Idk. Ya'll help me out. Been some long nights on this project.
RE: Point-of-Sale Activation - Ecks - 09-20-2017
It is great to see so many minds attacking this all at once, I am currently moving but will be looking through what you guys have posted when I am able and see what else I can dig up. Until keep up the great work, I am sure we can crack this soon enough.