13 ms·
Criminals can guess Visa number and security code in six seconds, experts find
- avh02 10y agohindsight is 20/20 - but I'm awefully surprised that this would not be detected by the backend/backoffice systems processing cards.
- coldcode 10y agoMatercard supposedly has a single back end but VISA does not, according to the article. Given the distributed nature of the attack I imagine only the card processors could detect it; if you pick sufficiently broad set of web site to test with the chances of them sharing a server that could detect something is probably low.
- Zyst 10y agoThat frankly sounds like a strong security argument to use MasterCard over Visa. But more research on how MasterCard would handle a similar attack might be necessary.
- Freestyler_3 10y agoI remember seeing the VISA security centre, where they monitor threats etc. It was a huge high tech facility. I would think that they flag if a card is attempted a lot of times in short time span.
- tyingq 10y agoApparently, VISA does not do this. The actual research paper is online: http://eprint.ncl.ac.uk/file_store/production/230123/19180242-D02E-47AC-BDB3-73C22D6E1FDB.pdf http://eprint.ncl.ac.uk/file_store/production/230123/1918024... It says this: "Whereas MasterCard’s centralised network detects the guessing attack after fewer than 10 attempts (even when those attempts were distributed across multiple websites), Visa’s payment ecosystem does not prevent the attack"
- digler999 10y agoAs another poster said, you don't run one card 1000 times. You run 100 cards 10 times and achieve almost the same probability of guessing one without burning the card. On another note, I wish they'd get rid of the number + exp + cvv. Quit concatenating more codes and just go to an alpha numeric model. You could have fewer digits and a bigger probability space. Even when you remove certain letters that sound alike.
- imaginenore 10y agoIt's absolutely insane. Setting up a distributed key-value system with some basic API shouldn't take more than a few days.
- mannykannot 10y agoThis does not require hindsight - it is literally the first thing you would ask about in an audit of the system's security. The real issue is what it says about the competence of the people running these systems.
- deleted 10y ago[deleted]
- throwaway2016a 10y agoSource? Do you audit credit card security systems or are in a related industry? I personally tend to air on the side of NOT assuming people I have never met working on a problem I have never had to try to solve (and therefor may not see all the complexity) are incompetent. I find it way more likely they are competent it is just a problem that is significantly more complex when dealing with the kind of big-data volume they do than it would be on a smaller scale.
- mannykannot 10y agoActually, I have worked on the development of security software, but if you want a source, I suggest you start with the work of the researchers mentioned in the article. Among the facts there, you can find that Mastercard is apparently capable of detecting these guessing attempts, so as we are on the subject of sources, what is your source for your suggestion that this is an insurmountable volume-related problem? You have a point about not casually attributing incompetence, but this does seem to be a particularly facepalm-inducing issue. I am willing to be corrected.
- throwaway2016a 10y ago> your source for your suggestion that this is an insurmountable volume-related problem I wasn't. But a problem not being insurmountable does not make you incompetent for not solving it (yet). Curing cancer is not insurmountable yet we don't call scientist incompetent for not having it done yet (at least I don't). And before you say it. No, I am not saying this is as difficult as curing cancer. I don't know enough about the issue to correct you or not. I just know a lot of great software engineers who have poured their sweat and blood into systems only to be called incompetent. I've also seen open source developers develop brilliant pieces of software and then get called incompetent for a single bug. Because the bug was "obvious" (in hindsight) That kind of attitude keeps people from taking risks. I personally think we need to encourage people to go into the tough problems and a lot of people won't if they risk being ridiculed for not solving them.
- coldcode 10y agoThe power of distributed attacks. Of course they can only guess a random correct credit card + exp + code not yours. Given the relative limited number of codes for each bank, I wonder what the odds are for them to wind up with yours.
- userbinator 10y agoIt's like winning the lottery --- someone always wins, even if it's not you. If guessing is free and you get an effectively unlimited number of guesses in parallel, it's pretty obvious that you will win quite easily. Some related reading here: https://en.wikipedia.org/wiki/Payment_card_number https://en.wikipedia.org/wiki/Payment_card_number
- xtiansimon 10y ago...for every valid/correct credit card? The answer is a ratio of 1:x_1, where x_1 is every correct cc. And each correct cc is a ratio to the total number of cc vulnerable to the system of attack, 1:x_2; and this is in turn a ratio of 1:x_3, for all the currently valid cc, etc.etc. Right? But what's more concerning is all of the successful fraudulant activity is adding to the loss those banks are adding to their books, which in turn will be passed on to customers as bank fees and other costs.
- tyingq 10y ago>the loss those banks are adding to their books There is no loss to the banks, assuming the fraudulent purchases are "card not present". The loss goes to the selling merchant. Your point of it being collectively passed on to the consumer is still true, of course.
- julianj 10y agoAcceptable storage is usually first 6 and last 4 [1]. I wonder if this would make it easier to go through some Luhn checked generated numbers to target an individual. [1] PCI DSS requirement 3.3
- hughw 10y agoThese attackers are probably brilliant enough to make their mark in the honest tech business world. I suppose they are driven by the challenge of the crime.
- linkmotif 10y agoI suspect they live in countries without the rule of law so they have little incentive to make an "honest" living.
- user5994461 10y agoThere are only a very few places in the world where you can get good jobs in tech: SV & NY... If you're not American, you're screwed because you can't get to America legally. That leaves fraud as a very serious make-a-living option =)
- burfog 10y agoSV and NY are not the best places to go once you consider quality of life. Better choices: San Antonio, TX Provo, UT Huntsville, AL Melbourne, FL Nashua, NH Salt Lake City, UT Charleston, SC Arlington, VA Alexandria, VA Wichita, KS These are places with greater freedom. Most of them are less crowded and less expensive, usually by a huge amount.
- cs702 10y agoThere are well-specified rules for coming up with valid credit card account numbers, and at most, say, 60 valid expiration dates (12 months × 5 years into the future). Once an attacker has a valid credit card number and expiration date, there are only 10⁴ = 10,000 four-digit security codes possible, which the attacker tries with parallel requests to hundreds of websites. Each website gives the attacker at least a few tries to enter valid credit card information. Worst case, it takes only 10,000 parallel requests to guess the correct security code. Worst case. I don't know whether to cringe or laugh at this.
- vorticalbox 10y agoIn the UK they are 3 digits on the back, 3000 is a worse case.
- skosch 10y agoIsn't that (almost) 1000? All numbers between 001 and 999?
- adolph 10y agoFor any valid card number yes. I'd bet that almost all don't have three numbers all the same and that there are probably more rules/conventions that would reduce the search space. http://m.wolframalpha.com/input/?i=count+of+permutations+of+3+digits&x=0&y=0 http://m.wolframalpha.com/input/?i=count+of+permutations+of+...
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- throwaway2016a 10y agoI had a card one that was three of the same. Obviously an anecdote, though.
- preinheimer 10y agoSo criminals can guess a valid CC/CVC/Zip in 6 seconds, and merchants that get nothing but green lights across the board from their credit card processor will be left holding the bag when the card holder disputes the charge. Merchants doing everything they can need better protection from this crap.
- hibikir 10y agoTransaction processors also face fines if the dispute percentage is too high. They don't have forbidden business lists just because they don't like pornography or sex toys. They can also be defrauded by merchants too: Make a fake business, make some fake purchases to yourself and after you get your money, disappear. Then a financial institution is the one holding the bag. That said, it's absolutely true that an online merchant needs protection from fraud, way past what anyone that isn't Amazon-sized can do on their own. There's third parties that do check prior to any processor. You can also rely on a processor that does more checking, or allows the merchant to made adjustments based on the level of risk they want.
- MichaelBurge 10y ago> They don't have forbidden business lists just because they don't like pornography or sex toys. Those are "high-risk" mainly because of "reputational risk", not because of chargebacks. Which I imagine is code for Visa or the banks thinking "If too many people with traditional morals get into political office, they'll start cracking down on us if we do business with the sex toy companies." https://en.wikipedia.org/wiki/Operation_Choke_Point https://en.wikipedia.org/wiki/Operation_Choke_Point There's also some bad history with old porn sites, since they used 0-days to install dialers on people's computers to rack up tons of money when they used their dialup to connect to the internet. Hence the old "I think my computer has a virus", "Quit browsing those weird porn sites" retort you may have heard. They did other shady things which got Visa in a bit of trouble. It doesn't happen much anymore, but I suspect the organizational scars remain. You've insinuated that pornography or sex toys are often "forbidden" because they have a high chargeback rate. But if you have 0 chargebacks after a few years, you still won't be able to negotiate a lower rate or to use a service like Paypal or Stripe. Because chargebacks aren't the reason. Visa and MasterCard charge you $500/year each as an extra fee too, so I suspect the Stripes and Paypals of the world can't combine them into their aggregate account. A fee like that would seem to preclude even a specialized aggregate account, without a special agreement with Visa. Also, if chargebacks were the issue, I would expect companies that only take debit cards to be in a different risk category than those that take credit cards. Debit cards have reduced fraud protection, so a Paypal or Stripe's underwriting should be more lenient for them. But I've never heard of Stripe letting you sell porn or of Visa waiving the fee if you only take debit cards. It could just be uncommon though. Plus, I believe both Paypal and Stripe ban selling porn even using e-checks, which is more evidence against chargebacks being the issue. There shouldn't be any restrictions on the ACH system, and even if there usually were somebody could set up a state credit union in Oregon or similar to handle it.
- acomjean 10y agoI'm no means on expert on this, but having delt a little with online transactions from testing responses from a payment processor. The things that needed to match also involved the customers street address, zip and name. If I recall these were scored and if the match wasn't good (zip was entered wrong) the transaction was rejected. Maybe different payment processors have different thresholds for rejecting a transaction? https://help.chargify.com/payment-gateways/Error-FAQ.html https://help.chargify.com/payment-gateways/Error-FAQ.html
- sirn 10y agoMy memory is fuzzy, but I believe this depends on an issuers and acquirers. There are acquirers who do not check for anything but card number, expiration date and optionally CVC. And there are issuers who do not have AVS (address verification) support, which I think is almost all issuers outside the States. Most modern payment gateways will enforce CVC check, and require the name to be present, though.
- tyingq 10y agoFor US based transactions, AVS failures (address, zip) don't typically fail the transactions. Most often, the api has 3 possible return values "Success", "Success With Warnings" and "Failure". The "Success with Warnings" will have some error codes for AVS failures (street address, zip). Usually the same for invalid CVV2. I've also noticed that cardholder name matching isn't universally supported...AMEX does it well, but VISA/MC is hit or miss. Most merchants choose to allow for "Success with Warnings" and then manually check them. It's hard to automate, because it's very typical for real customers to mistype billing addresses, CVV2, etc. One good example is small business owners. They, very often, use their business address as billing, even when the billing address is actually their home address. In short, you can configure for hard failure on address mismatch or CVV2 mismatch, but you're throwing away a lot of legit transactions if you do so.
- BillinghamJ 10y agoOnly Amex has the ability to check the cardholder name. Visa & Mastercard don't pass this data to the issuer.
- maemre 10y agoA solution that some banks provide is to enable a credit card for only transactions using 3-D Secure [1], in which you are expected to enter a 2FA code sent to your phone by the bank during transaction to a webpage of the bank that gets opened. Unfortunately, some (most) websites don't support 3-D Secure. I remember that almost all Turkish e-commerce sites I shopped supported it but almost none of the American sites supported it. [1]: https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure
- egeozcan 10y agoIn Turkey, it became a requirement from nearly all banks supporting online transactions. I couldn't find out though if it was forced by BDDK (Turkish authority of banking regulation and inspection) though.
- vxNsr 10y agoVisa has this for large (ie >$1000) transactions. But I'm not sure if every online merchant is set up to make it work...
- sirn 10y agoThis is most likely the merchant choose to enable 3-D Secure for large transactions so they're not liable for frauds. 3-D Secure flow is separate from the normal authorization flow and require the merchant (or payment gateway) to set it up. The merchant (or the gateway) is required to build or purchase an MPI from an approved vendors to make it work.
- sirn 10y agoDoes your bank also reject all non 3-D Secure transactions? Unless this is the case, having 3-D Secure only benefits merchants as the liability will now be shifted from the merchant to the cardholder (e.g. the cardholder is now liable for fraud) while the (stolen) card can still be used for a non 3-D Secure payments.
- vertex-four 10y ago
- rcthompson 10y agoShouldn't this be easy to detect, though? Every attempt to use a credit card number online involves a request to the bank providing that card to determine if it's valid, right? So the bank would see thousands of attempts across hundreds of websites for the same card number in a matter of seconds, which is clearly impossible for a human, and flag the card as "stolen". Or maybe I'm just way too optimistic about how this all works.
- tyingq 10y agoSadly, the banks don't do much about it, because for US card-not-present transactions...they have no risk. Any fraud is paid for by the merchant seller. It's too bad, because if there was an anti-fraud system that had access to ALL transactions + ALL data, it would obviously work better than any other solution.
- baldeagle 10y agoI'm sure the IRS and a number of other groups would love access to this data.
- tyingq 10y agoFor the most part, the data is already centralized. It just isn't used for anti fraud measures that would help online merchants. The cc companies and banks do leverage aggregated data when they are the ones that hold the bag....like card present transactions.
- seanp2k2 10y agoYep, it would cost them to implement and maintain, and they have no financial incentive to do so. It's not like they have a brand to ruin either; everyone already hates them, but Visa and MasterCard run the US market (and much of the global market), so they can do whatever they want to consumers without fear of backlash / loss of business.
- user5994461 10y ago
- deleted 10y ago[deleted]
- mataug 10y agoAnother one of those technologies which hasn't kept up with the evolving tech landscape.
- swiley 10y agoIt's pretty unfortunate that there is absolutely no federated, popular, and secure payment system in the US due to consumers and merchants simply sticking with older systems simply because "it's what we've always done."
- ian0 10y agoThere are many parties that would gain from a better payments system. However the logistics of improving it are significant due to the number of highly regulated and kinda-fat and kinda-happy entities running the infrastructure. Interestingly what has happened in India and China (success of non-bank payment wallets VS cards) is injecting a lot of the traditional players with a sense of urgency. Before this it would have taken a states intervention (Eg MEPS in Sing/MY) to improve acceptance through the launch of a new payments system.
- hanoz 10y agoI find it impossible to believe distributed enumeration of card numbers via ecommerce sites was used to defraud 9000 Tesco customers over a weekend.
- BillinghamJ 10y agoThe article stated that Tesco weren't protecting against distributed card testing because they didn't track failures on the same card across different merchants. Thus I think it would be very plausible. The people running the scam would choose a specific IIN/BIN known to suffer from this problem.
- seanwilson 10y agoWouldn't asking for the name on the card as well stop this? You're not going to be able to randomly generate the correct name.
- tyingq 10y agoUnfortunately, at least in the US, cardholder name matching doesn't work for most transactions. Only AMEX supports it. Edit: Offtopic rant, but as an online merchant this is the sort of thing that pisses me off about the CC situation. They don't support other obvious things either, like passing in the shipping address and ip address so they can be used for fraud detection. Yes, there are outboard services (MaxMind,etc) you can use, but they are working with a small subset of transactions, so their algorithms and blacklists are incomplete.
- ScottBurson 10y agoName matching doesn't work??! I guess you must be right, or this attack wouldn't be possible, but holy shit that is fucked up.
- tyingq 10y ago100% true. Does not work, outside of AMEX cards. You can put anything you want in the cardholder name fields.
- debt 10y agoLaughed out loud after reading this headline
- deleted 10y ago[deleted]
- cherryblakes 10y agoHello guys and how are you doing today, Do you need require the services of an accomplished and professional hacker for any of the following: -Facebook account hacking -Instagram account hacking -Mobile phone hacking -Whatsapp hacking -Kik account hacking -GPS tracking -Website hacking -Bank account hacking -Account recovery -DDOS attack -Email account hacking Then you should contact:danielwellingtonhacks@gmail.com for his professional services. He is one of the best hackers out there.
- fiatjaf 10y agoThis is a good argument to be used against the creditcardization (war on cash[1]) of the world some governments are promoting. [1]: https://www.google.com.br/search?q=war+on+cash https://www.google.com.br/search?q=war+on+cash
- fjarlq 10y agoThe paper: Ali, Mohammed Aamir and Arief, Budi and Emms, Martin and van Moorsel, Aad (2016) Does The Online Card Payment Landscape Unwittingly Facilitate Fraud? IEEE Security & Privacy http://eprint.ncl.ac.uk/file_store/production/230123/19180242-D02E-47AC-BDB3-73C22D6E1FDB.pdf http://eprint.ncl.ac.uk/file_store/production/230123/1918024...
- lisper 10y agoSecuring the current protocol for credit card transactions is completely hopeless. It is inherently insecure because the "secret" information used to authorize a transaction is not bound to that transaction, and so it's reusable. Even if you were able to secure the system against brute-force attacks like this one, you can never secure against phishing. The only way to fix it is to change the protocol to one that relies on public-key cryptography and secure digital signatures. http://blog.rongarret.info/2013/02/a-simple-solution-to-credit-card-fraud.html http://blog.rongarret.info/2013/02/a-simple-solution-to-cred...
- ian0 10y agoEMV tokens and virtual card numbers attempt to mitigate against the re-use factor. 3D secure adds a layer of auth to the regular method (at some expense). There is a large infrastructure (acceptance, processing, acquiring, clearing, issuing) running on card numbers so the solutions mentioned above all attempt to build on top of them as oppose to replace them with something better. As the logistics of doing so tend to be prohibitive.
- ForFreedom 10y agoIf you total the credit card numbers for any particular card the answer would be the same. For example: totaling the visa credit card number might be 32. The hackers would have to guess the 3 set of numbers if they get the fourth set. So my guess is they would try out different combination with the available expiry date/cvv number
- mamon 10y agoThat's why you should enable two factor authentication on your credit card: online transactions would require confirmation with single-use password you receive by SMS.
- seanp2k2 10y agoWhat cards allow this? I would do it in a second if that was a thing I could actually have. Not 100% foolproof but I'd bet it would stop almost all fraud.
- CmdrSprinkles 10y agoNot aware of any cards specifically (outside of European chip-and-pin, but I don't think those usually work online), but this is the big argument for things like android/apple/firebomb pay. Make a purchase, then sign off on your phone (or fingerprint reader on your laptop). It obviously won't resolve the issue posed in the article, but it is definitely a step in the right direction and many of the major CC companies are integrating more and more. In five or six years I can easily see Chase and the like giving an option to only let the physical card be used in chip-and-pin mode and to require the use of an approved service for any contactless/online orders. Obviously the approved services thing is a concern, but not a huge one.
- mamadrood 10y agoI don't know if you're talking about the 3-D Secure / Verified by Visa system, but the major flaw of this technology is that the merchant is the only one responsible for putting it up or not. I used to work in e-commerce and my company simply disabled the SMS protection because it would harm sales and the platform would sometimes completely crash. On the other hand there is no way (that I know of) that I, as a customer, could prevent my card being used in non secured websites. So this system makes legitimate purchases harder and doesn't prevent fraud. We need a different technology than credit card for online payments, they are not secured enough and any layer of security that we add around them won't work.