How do I prevent extra javascript from being added into HTML kiosk in public space?

Question

I'm planning a project which is to be PCI compliant, but I am stuck on a particular vulnerability and I can't think of a way to protect against it.

The scenario is that there is a kiosk installed in a public location that is running an HTML/Javascript application. The physical computer is locked away, but users can access the touch-screen and keyboard.

The kiosk would be firewalled and only allowed to load content from certain domains or IPs, but I'm worried about a user injecting code directly into the page.

What I'm imagining is that a person accessing the kiosk could inject code into the page using document.write() that would record user input, and then return to the kiosk later to gather the input.

At this point it seems like the only protection against this is that the user probably can't open a web console using only the keyboard. Are there either a) any way to prevent additional scripts to be loaded after a certain point? or b) any way to ensure that a web console can't be opened in a browser? Or some other protection?

In other words, besides physically securing the computer, what do I need to do to secure a browser-based kiosk application when the kiosk has a keyboard?

And ideas or thoughts are appreciated!

Answer 1

From a web app point of view the vulnerabilities you describe are the same for any website and can be mitigated in the same way. Check out the OWASP top ten and ASVS for industry standard ways of dealing with these problems.

Otherwise some particular techniques off the top of my head include:

1. Scrubbing input
2. Use content security policy headers
3. Use a WAF
4. Clear all data after the session has finished

PCI DSS has requirement 6 to cover the development of secure software, take a look at the PCI council website.

Also I would imagine that your kiosk would be considered a virtual terminal, so check out SAQ C-VT to make sure you're cover there.

Answer 2

You can prevent a console from being opened by using Chrome kiosk mode flags. If you need a way of debugging in this mode you can use Google Chrome remote debug. Kiosk mode will also prevent javascript from being executed via the address bar as the address bar doesn't exist. The only way an attacker could circumvent this is to close the kiosk window via alt f4 or ctrl alt dlt and open a regular browser(however a simple login should help prevent this)