Medical workstation kiosk escape and pre-auth token parsing

Summary

The workstation’s printer-management workflow opened a path out of the intended kiosk experience. Separately, license and token data reached a deserialization routine before authenticity was established.

Technical workflow

The kiosk review followed the full user journey: sign-in, printer selection, error handling, unattended timeout and return to the clinical application. The token path was then traced in a lab with a sanitized fixture. A safe verification order is explicit:

import hmac

def verify_then_parse(blob: bytes, signature: bytes, key: bytes) -> bytes:
    expected = hmac.digest(key, blob, "sha256")
    if not hmac.compare_digest(expected, signature):
        raise ValueError("token authenticity check failed")
    return blob

Parsing must still use a restricted format with size, field and time budgets. On Windows, the kiosk boundary was checked with read-only policy inspection and event review; the public write-up intentionally omits product-specific escape sequences and paths.

Defensive lessons

• Treat every peripheral workflow as part of the kiosk threat model.
• Parse untrusted data safely only after strict authenticity checks.
• Remove development artifacts and protect administrative functions with modern password hashing.
• Test physical access, authenticated access and unattended-session scenarios separately.

Expected result: peripheral workflows return to the kiosk shell, expired sessions cannot open administration tools, and unauthenticated or malformed tokens are rejected before parsing.

The product and reverse-engineering details are withheld.