Kiosk Hacking Demonstration – Defcon 16

Last Updated on March 28, 2026 by Craig Allen Keefner

Kiosk Hacking Demo

Lots of tools out there. This one sorts of puts the wrap on Windows XP (and 7 to extent).Complete how-to from Defcon 16 and Paul Craig (who has since moved onto ATMs).

Here is pdf of entire presentation — defcon-16-craig

The web address for iKat is ikat period h period cked period net

• An online tool you visit from any Kiosk terminal.
• Provides content to help an escape from any application jail.
• “Sure would help me during penetration tests”

Available Remote Input Vectors:
 Remotely hosted content, viewed by a Kiosk.
 JavaScript.
 Java Applets.
 ActiveX.
 ClickOnce applications (.NET Online Application Deployment).
 Internet Zone protocol handlers.
 File type handlers.
 Flash, Director, Windows Media Player, Real, QuickTime, Acrobat, other browser plug-ins.

More Security Kiosk news