I offer here some friendly advice about public kiosk systems. Now, I define a kiosk system as any system provided for public use. I realize that most of us, when we think of kiosks think of those systems set up with a fixed interface to allow us to find a store in the mall, or check to see if a book at Barnes and Noble is in stock.
I’m being a bit more general when I talk about kiosk systems, however. I am speaking of systems provided for public use to allow people to check email, browse the web, or update their Facebook page. I am talking about systems found in libraries, hotel lobbies, and sometimes airport terminals. Sometimes you have to pay a fee to use them, but quite often they’re just sitting out there for anyone to use.
Seeing these systems I have to ask myself the following question: Who maintains them? Some are provided by a 3rd-party company as a service. Other systems are probably are set up by roaming hotel or library personnel. Perhaps they get pre-configured at headquarters and sent out to all the “branches.” Regardless, as I see them sitting there all dusty and abused with coffee cup rings on case, I have to wonder if these battered systems are ever again touched by the IT guys after their original setup. Oh sure, if a hard drive fails or coffee gets spilled into the keyboard someone will eventually come along and fix it. But these are not my concerns.
About three years ago I was waiting in a hotel lobby for my wife when I noticed one of these systems and, given my compulsive tendency to fiddle with things, I sat down at the keyboard and started looking around. I noticed stuff almost immediately. Shortcuts to games–obviously not installed with the original software–filled the desktop. I checked the internet cache and was not terribly surprised. Porn and gaming sites were apparently often visited on this system.
The web browser seemed very slow to come up, and when it finally appeared on the screen I started seeing quite a number of pop-up ads. This system was riddled with ad-ware and probably various kinds malware as well. I looked on the tray for some indication of anti-virus software. An expired version of Norton or something similar had been installed, but was never purchased.
However, the biggest surprise was still to come. A quick check of the Windows XP system settings revealed that the user account I was currently using, and that which dozens if not hundreds had used before me, had administrative rights on that system. This explained the seemingly endless list of software that others freely installed. The system was a dangerous mess, and it seems to be the “norm” among those publicly available. These systems should ALWAYS be avoided. What follows are my reasons…
First of all, giving average user administrative rights is like giving a kid a baseball bat to play with in a glass shop. I don’t say this to be insulting, I’m just stating a fact. Malware can do irreparable damage to an operating system when it runs under an account with access to all the system files and the registry. It’s common sense, but many who set up such systems are too lazy or apathetic to care. It’s much easier just to give everyone administrative rights so that nobody bothers you to install something or change a setting. Let them do it. It’s easier.
A few years ago I did IT administrative work for a securities trading company. I stood firm with regards to administrative rights. Normal user accounts were not members of the local administrative group on systems. I never took the position, however, of withholding these rights as some sort of personal power trip, nor did I tell people I thought they’d break their systems. I was always quick to explain about malware and how I was trying to protect them. Heck, I even created secondary administrative accounts they could use if they needed it. I bent over backwards, but it was never enough for some.
One lady was in constant gripe mode about not having administrative rights. I explained, and still she complained. One day, she brought her home system in and asked if I could have a look. It had gotten slow. I took it home that evening and spent an entire weekend removing dozens…no..hundreds of instances of malware. When I brought it back, I asked her “why did your home system have so much malware and your work system does not?” Her immediate answer was “Antivirus software is better on the work system” to which I replied “Nope.” I explained that her system was such a mess because she ran this system normally with administrative rights, giving malware much more to work with. She thanked me, gave me a case of Guinness for my work, and continued to complain, but perhaps a little less vehemently.
The point is that any system where users regularly do their day-to-day activities with administrative rights is on borrowed time. It’s like silly putty or that toy slime you sometimes buy (ok sometimes “I” buy). Once you drop it on the carpet you might as well toss it as you’ll never get out all the nasty bits that it picks up. A kiosk system sitting in a lobby with administrative rights will pick up every bit of digital nastiness out there.
If I were evil, I believe I’d infect kiosk systems with keylogging software, collecting all the user names and passwords for every person logging in to Paypal, Facebook, or even their bank accounts. Such logins are ripe for the harvest on kiosk systems. Keyloggers come in two varieties. Software keyloggers collect all the keystrokes through memory-resident software and then transmits this data to a 3rd party. Hardware keyloggers are devices installed between the keyboard and the system. While hardware keyloggers require the bad guy to retrieve the device at a later time, they are also nearly impossible to detect unless they are visibly noticed.
To further exacerbate the problem, often these kiosk systems are connected to the same network as everything else in the hotel. Imagine, if you will, a bit of nasty code running in memory on the kiosk system that scans the network looking for additional victims. A kiosk system could be a launching point for an attack on your laptop as you use the wireless network at the hotel, not to mention the hotel’s point of sale system and business related servers and databases. A clever virus could be written to constantly make reservations for all rooms or cancel such. Of course, I’m just thinking out loud here. 
If you run a hotel or library and have such systems, here’s a couple of excellent ideas. Hint: Read all three, but pay special attention to the first two. There’s a pop quiz at the end.
1. Use a live CD, not a hard drive. Boot the system to an Ubuntu or Knoppix Live CD and let people browse all they want. At the end of the day, reboot the system. Nothing in memory will reside, and you’ll provide a cleaner computing experience. It’s a little slower to operate from a live CD to be sure, but worth it.
2. Re-image the system daily. Create a basic system image and use this to restore the system every evening or when problems occur. This will put you back at square one every day. There really is no excuse for not at least doing this on kiosk systems.The process can even be automated to happen at night with very little effort.
3. If for some incredible reason points 1 and 2 are not available to you (which, if you’re honest, they ARE) then make sure that you have decent anti-virus software, keep the systems patched, and, above all, do NOT give the default account administrative rights. I do not recommend this point, however. It requires some ongoing “maintenance.” You may start off with good intentions, but eventually the cares and woes of your other responsibilities will distract you and before you know it the patches and virus signatures are out of date. Then there’s that time you make an “exception” and give someone admin rights for some strange reason and then forget to revoke them. Necessity may be the mother of invention, but laziness can be it’s favorite uncle. Make your life easier and do the smart thing: Use a Live CD or re-image the systems regularly.
There are other options as well. The use of thin clients such as Citrix may be available so that the OS is not really running on the system which you are using but instead a remote server. However, such solutions are usually costly and not within the budget of most.
So what if you’re a hotel customer or you want to use that library system? Don’t do it unless you know they are following one of my first two points above. But also don’t be afraid to bring along your own live CD and ask if you can use it. You may get strange looks or be viewed suspiciously. This is a good opportunity to introduce that library IT guy to the wonders of a clean, bootable, non-persistent environment.
If you “have” to use a kiosk without proper protection (and you never have to) then use common sense. Don’t visit sites to which you log in. If you happen to visit any such site, even on a safe system, make certain you log out completely. My wife’s family visited once and one of her relatives often used her computer for his facebook updates. Almost every time my wife sat down she found herself logged into his facebook account. (I had some really good ideas but she wouldn’t let me do anything.:-) ) Imagine a stranger sitting down at that kiosk system in the hotel finding himself logged into your online bank account or email.
Finally, I just want to say that Kiosk systems “can” be safe if those in charge follow best practice, but they should never be completely trusted. Besides, you’re on vacation. Give Facebook a rest and go to the beach.
Quiz: Which of the following is the least desirable option for keeping public systems “clean” in a hotel or library.
A) Use a live CD
B) Use a hard drive-based OS, but keep patches and anti-virus up to date.
C) Use a hard-drive based OS, but re-image or clone it daily.
The correct answer is B.
David H.