A customer walks up to a self-service kiosk at a retail store and notices something is off. The screen looks slightly different than usual. There is an extra field asking for a PIN. Or the display is frozen on something that is not the intended app. By the time anyone investigates, the device has been running compromised software for hours and every transaction processed during that window is at risk.
Kiosk attacks are not theoretical. They are a documented, growing problem across retail, hospitality, healthcare, and financial services. The combination of public physical access, always-on internet connectivity, and inconsistent management makes customer-facing kiosks one of the softest targets in any organization’s technology environment.
Understanding what an attack actually looks like, what it compromises, and how to prevent it is the foundation of a secure kiosk deployment. MDM platforms like Moki exist precisely to close the gaps that make kiosks vulnerable.
How Kiosks Get Compromised
Kiosk attacks follow a small number of common patterns, and understanding those patterns clarifies exactly which preventive measures matter most.
Physical access attacks are the most straightforward. An attacker approaches the kiosk, bypasses the intended interface to reach the underlying operating system, and installs malicious software. This is possible on any device that is not running proper kiosk lockdown. On an unlocked tablet, a few taps and the device’s settings, file system, or app store is accessible. From there, a compromised app can be sideloaded, settings can be changed to redirect network traffic, or a keylogger can be installed to capture customer inputs including payment information.
Network-based attacks target the kiosk’s connectivity. Devices that are not isolated on their own network segment and not restricted to authorized endpoints can be reached from other devices on the same network. A compromised device elsewhere on the network can push malicious traffic to an unprotected kiosk, or the kiosk itself can be used as an entry point to reach backend systems it has network access to.
App tampering occurs when the application running on the kiosk is replaced or modified. If a device does not have version control and app integrity monitoring, a malicious actor who can access the device’s storage can replace the legitimate app with a lookalike that captures credentials, payment data, or personal information entered by customers.
Supply chain attacks target devices or software before they even reach the deployment location. Compromised hardware, firmware with backdoors, or applications with malicious code introduced during development or distribution can arrive at a location already compromised.
What Gets Compromised in a Kiosk Attack
The specific exposure from a kiosk attack depends on what the device handles, but the categories of risk are consistent:
- Payment data: Kiosks that process card transactions are a direct target for skimming and credential theft. A compromised POS kiosk can capture card numbers, PINs, and CVVs from every transaction processed until the attack is discovered.
- Personal information: Healthcare check-in kiosks, hotel check-in terminals, and loyalty program kiosks collect names, dates of birth, insurance information, email addresses, and other personal data that has direct value to attackers and significant liability exposure under privacy regulations.
- Network access: A compromised kiosk that has broad network access can be used as a pivot point to reach inventory systems, customer databases, or other backend infrastructure that the attacker could not reach directly.
- Brand and customer trust: Even a kiosk attack that does not result in data theft damages brand reputation when customers are exposed to a compromised experience. A fake interface, unexpected behavior, or a public disclosure that devices were not properly secured all carry reputational cost.
The Specific Vulnerabilities MDM Closes
Most kiosk attack vectors rely on the same underlying conditions: the device is not locked down, it is not monitored, and changes to its configuration go undetected. Mobile device management addresses all three.
Kiosk mode and device lockdown eliminate the physical access attack vector by making the underlying operating system inaccessible. A device locked to a single app through Moki’s kiosk mode cannot be navigated to device settings, the app store, or any system function outside the designated application. There is nothing for a physical attacker to access even if they are standing at the device for an extended period.
App integrity monitoring and version control close the app tampering vector. When Moki enforces which apps are installed and at which version, any deviation from the approved configuration is detectable. If an unauthorized app appears on a managed device, or if the approved app is replaced with a different version, the MDM platform can detect and flag it.
Real-time monitoring and alerting address the detection gap. Most kiosk attacks persist because no one is watching. Moki’s alert system notifies the team when a device goes offline, an app stops running, or a device falls out of its expected configuration state. Unusual device behavior that precedes or accompanies an attack is surfaced in real time rather than discovered after the fact.
Network restriction capabilities reduce the blast radius of a compromised device. Restricting kiosks to specific Wi-Fi networks and limiting which external endpoints the device can reach means that a compromised kiosk cannot easily reach backend systems or other devices on the network.
Remote wipe capability ensures that if a device is confirmed compromised, it can be wiped immediately from the Moki dashboard without anyone visiting the location. Sensitive data and credentials are removed before they can be exfiltrated further.
A Practical Kiosk Security Checklist
For any organization operating customer-facing kiosks, the following configuration checklist represents the minimum security baseline:
- Kiosk mode or device lockdown is enabled on every customer-facing device, restricting it to the authorized application only
- The home screen, settings, app store, and all system navigation are inaccessible to the user
- All managed apps are enrolled in version control and any deviation from the approved version triggers an alert
- Devices are connected to a dedicated network segment separated from corporate systems and other devices
- Network policies restrict the device to only the external endpoints it needs to reach for its intended function
- Real-time alerts are configured for device offline, app crash, and compliance state changes
- Remote wipe capability is confirmed and the team knows the escalation process for using it
- Devices are enrolled in Moki’s MDM platform and all configuration is managed centrally rather than set manually on each device
For industries handling sensitive data, additional controls apply. Healthcare deployments handling patient information need HIPAA-aligned configuration including encrypted storage and strict access controls. Retail and restaurant operators processing payment transactions need PCI-DSS compliant configurations that restrict card data handling to certified payment applications only.
The Cost of Inaction
The average cost of a data breach continues to climb. In 2024, the global average cost of a data breach reached $4.88 million, a 10 percent increase from the prior year. For small and mid-sized businesses, a single kiosk breach involving customer payment data can be existential. Regulatory fines, card network penalties, legal costs, and customer notification expenses add up quickly, often far exceeding the cost of the MDM platform that would have prevented the incident. Applivery
The prevention investment is not large relative to the exposure. Proper kiosk lockdown, centralized management, and real-time monitoring through Moki’s platform close the vast majority of attack vectors that make kiosks a target.
Schedule a Moki demo to see kiosk lockdown and security monitoring in action, or start a free trial to begin securing your device fleet today. Moki’s FAQ covers common questions about device security configuration and compliance.