The Definitive Guide to Kiosks by 42Gears is a two-part series surveying the world of kiosks in the early 2020s. The first white paper of this series explored the ways that kiosks (and kiosk management) can elevate businesses through good interface design and connectivity with Internet of Things (IoT) devices. Part 2: How to Overcome the Challenges of Kiosk Management, covers a range of technical challenges and security threats that can make kiosk management difficult, and concludes by reviewing some important tools that make a substantial difference to kiosk owners and managers. 

This white paper contains three sections:

Section 1. The Challenges Facing Kiosk Owners: Security

Section 2. The Tools Kiosk Owners Can Use to Overcome Challenges

Section 3. Moving Forward with SureMDM by 42Gears

Given that kiosks are often placed in well-trafficked areas far from IT admins, they are an alluring target for malicious actors. The consequences of malicious kiosk tampering can range from public humiliation to severe financial hardship, so safeguarding these devices is essential.

Simple Oversights

Many kiosk owners likely focus on thwarting advanced threats, but great harm can be caused by simple oversights that go unnoticed while setting up a kiosk interface. Manipulating kiosks doesn’t require hacking skills if kiosks have obvious exploits in their user interfaces.

As an example, McDonald’s kiosks experienced an embarrassing compromise in the late 2010’s when Australian teenagers exploited an oversight in the ordering process. If someone ordered a certain item and then removed a certain component from the item, the kiosk would deduct more from the overall order cost than the item was worth. Although quickly patched, the exploit briefly allowed users to get unlimited free food with patience. 

This goes to show that complex and well-thought-out plans to keep devices safe cannot lose sight of the most basic security features.

Complex Security Threats

Kiosk threats come in many forms- and resolving simple oversights isn’t nearly enough to protect your business from them.

Bernard Parsons, CEO of the security firm Becrypt, divides kiosk security threats into three kinds: Threats to system integrity, threats to system availability, and threats to system confidentiality. Let’s look at each of Parsons’ categories in sequence.

Threats to System Integrity

Threats to system integrity are those that involve changing whatever the kiosk displays or does. Juvenile though it may seem, some individuals want to display humiliating or off-topic content (most stereotypically, pornography) on kiosks as a creative exercise- just to see what they can accomplish.

Kiosks worldwide have fallen victim to this sort of compromise often, forcing companies to do damage control when the content displayed is intensely off-brand. Although any type of device hacking could pose this kind of threat, a common target is a kiosk’s internet browser.

New York’s LinkNYC Wi-Fi kiosks in the mid-2010’s exemplify this challenge. These giant kiosks were intended to help New Yorkers of all socioeconomic backgrounds use the Internet, but some users quickly commandeered the devices to stream pornography on the giant kiosk screens in the middle of the street. 

In order to allow browsing without the risk of showing indecent content, kiosks can employ keyword filtering measures- but even this may not be sufficient, as LinkNYC discovered when it later implemented keyword filtering into its kiosks’ browser. A truly secure and safe web kiosk needs to be able to restrict access to just one or a few specific websites.

Many operating systems and services purport to offer “kiosk mode,” which restricts devices to specific applications, but kiosk mode needs to withstand common forms of tampering. Writing for the website IoTforAll, Yiteak Hwang notes that some of these forms of tampering include abusing external links (users will try to access restricted apps by finding links to them in approved apps), touch fuzzing (erratically tapping the screen to exploit the kiosk’s way of handling invalid inputs), and data fuzzing (entering invalid data into forms, and exploiting the resulting error message to gain access to other parts of the device).

Threats to System Availability

While threats to system integrity force kiosks to display unwanted content, threats to system availability result in kiosks displaying no content at all. This includes anything that would cause a device to crash, either intentionally or unintentionally. Kiosks that shut down at inopportune times can bring business to a halt- and the more important a kiosk is to the flow of customers, the more damaging the crash.

If kiosks display error messages and their owners need hours to repair them, it reflects poorly on the company. Threats to system availability can come in many forms, but having a way to quickly resolve them after-the-fact is useful no matter the nature of the threat.

Threats to System Confidentiality

When kiosk owners think of security threats, they likely think of threats to system confidentiality- those threats that do not outwardly impair kiosk functionality, but instead relay sensitive data to a third party. This kind of threat can result in companies losing the trust of their customers, impacting their financial bottom line for years to come.

Threats to system confidentiality can begin as oversights in the way that different system components work together, or they can begin as outright hacking.

In 2019, security experts working for IBM’s X-Force Red team discovered vulnerabilities in tablets that ran visitor manager software at major companies. Specifically, some applications had admin privileges over devices, so malicious actors could exploit those privileges to obtain visitor records and other confidential information. This could even potentially be used to print out ID passes with false credentials.

Another victim of this kind of threat is the kiosk company Uniguest. Uniguest had inadvertently made a web page with development tools for its software available publicly. This allowed researchers to manipulate the system in ways that could expose all private information (including passwords, data, and much more) from every customer of Uniguest.

Even if all liabilities of this nature are resolved, malware can invade and devastate kiosks- and the companies that own and run them. For example, a malware attack on kiosks of the food self-service provider Avanti Markets exposed an unspecified number of customers’ names, email addresses, and fingerprint data at risk.

By using comprehensive software to manage each of these elements, oversights become less likely. Additionally, kiosks need to have some form of mobile threat defense (MTD)- as otherwise, they could be sitting ducks for malware.

If you are in the market for kiosks, you should be aware of the various benefits and concerns inherent to your potential purchase options. In this section, we will briefly consider the differences between kiosk choices and what features all kiosks share. 

Common Kiosk Choices

1. Apple (iPadOS) devices

Many business owners turn to Apple (specifically, Apple’s iPad tablets) when implementing kiosks. In both consumer and enterprise contexts, Apple devices enjoy a reputation for strong quality and aesthetic design. Apple offers Apple Business Manager (ABM) for its devices, which allows businesses to quickly enroll devices and distribute application licenses to each device. 

In regards to kiosk lockdown, iPad owners can use iPad guided access to keep iPads safe- but this requires continual monitoring by the device owner and is not feasible in a setting with a large crowd flow and a large number of devices. Apple Business Manager enables businesses to run Single App Mode on iPads remotely, which makes using iPads as kiosks much more feasible in commercial contexts.

Businesses can gain further kiosk functionality on iPads if they use a mobile device management solution in conjunction with ABM.

2. Android devices

Android devices may not enjoy the same brand recognition as the iPad, but these devices come with a range of upsides. They typically cost much less than comparable iPads, and can include an array of custom hardware extensions (such as barcode scanners) and form factors (such as rugged casings) for a variety of needs. Android also offers Android Enterprise, which serves a similar purpose to ABM. 

The Android analogue to iPad’s guided access is Android screen pinning, but like guided access, this requires continual physical interaction with the device and is not reasonable for multi-device deployments. Kiosk owners will need to use an MDM solution to remotely lock down devices into kiosk mode.

3. Windows devices

Windows tablets are a good choice for organizations that would like to provide professional functionality on kiosks (such as full keyboard functionality for kiosks deployed in human resources departments). Additionally, given that many organizations already use an array of Windows devices, IT teams may be familiar with Windows and find it easy to integrate Windows tablets. Kiosk owners may also already have licenses for Windows applications that they can carry over to Windows kiosks.

As with Android, Windows kiosks rely on the help of mobile device management solutions to deploy kiosk lockdown solutions on many devices at once. 

Different kiosk attributes

Apps

For users without the technical know-how or persistence necessary to hijack devices, a kiosk’s functionality depends solely on what applications are available. For kiosks that constrain users to a single app, optimizing the in-app experience is all that matters. For kiosks that allow users to switch between multiple apps, owners must optimize both the available apps and the interface used to navigate between them.

If you choose to employ an off-the-shelf device, preparing an appealing kiosk interface requires more than just disabling access to off-topic apps. If you need an interface to navigate between apps, that interface needs to be restricted in the same way you restrict the available apps. Additional modifications may also be necessary; for example, if you would like to disable the ability to press a “back” button, you should remove any interface elements indicating the user can go “back” to begin with. If the menu interface doesn’t work properly, or it’s obvious that elements are missing, then the user won’t see the experience as natural.

Because the user’s experience is determined strongly by what apps are available. It should go without saying that you need to be able to restrict users to certain apps- but all of the design challenges mentioned above still apply. If the menu interface doesn’t work properly, or it’s obvious that elements are missing, then the user won’t see the experience as natural.

Browsers

Kiosks that serve limited purposes can likely restrict functionality to a single app, or a couple of apps. But for kiosks that need to answer open-ended questions, including an Internet browser is probably necessary.

Still, as with the LinkNYC example mentioned in Section 1, the open-ended nature of the Internet is as much a hindrance as it is a tool. A few strategies can help to restrict user activity to safe websites and topics, without restricting them from accessing what they need.

One such tool is the ability to lock browsers down to a single web page. Although at odds with open-ended inquiry, locking down a browser is a way to guarantee that users cannot visit inappropriate websites.

Another common strategy is permitting access only to certain websites (i.e. whitelisting). Whitelisting can provide a more open experience than single-page lockdown, while still making off-topic browsing difficult.

Alternately, browser admins can block access to specific websites (i.e. blacklisting). While it is difficult to anticipate and blacklist every undesirable website, kiosk owners can use blacklisting to block some of the most common problematic websites that kiosk users may try to visit.

For kiosk owners who like to have the kiosk experience be as open-ended as possible, keyword filtering may be a good option. Keyword filtering dynamically screens websites based on their content, so even if users find ways to undesirable websites you have never blacklisted, access will be denied.

Keys and keyboards (both physical and digital)

Kiosk owners need to put thought into how they structure the on-screen experience, but they cannot forget about the buttons of the devices they use as kiosks. 

Without proper protection, a user could use the physical keys of some devices to navigate away from the kiosk’s intended functionality. Whatever mobile device solution you choose needs to have a way to deactivate hardware keys.

Whether virtual or physical, keyboards can also pose a challenge for kiosks and kiosk owners. If kiosk users fill out forms using non-standard characters (such as emojis), this could result in text that the device cannot parse. For this reason, it’s necessary to have a way to restrict keyboard inputs to only alphanumeric (i.e. a-z, 0-9) characters.