4 ms·
I think this is a good example of "poisoning the well" in practice, and I was in a similar position as you describe when I was working in incident response at a
by dsacco 9y ago
I think this is a good example of "poisoning the well" in practice, and I was in a similar position as you describe when I was working in incident response at a consumer bank a few years ago.
That said, this is a very particular scenario, and I don't think you can generalize the effectiveness of the technique from this example. In situations where attackers are looking for boolean responses, i.e. to verify email addresses, credit cards, usernames, etc, this can work well.
But in most situations a crawler is looking for particular data. Moreover, it will have a strong expectation (and understanding) about what this data should look like. Poisoning the well is not going to work as well in that scenario, because a scraper will be aware that the data is incorrect.
In contrast, people testing credit cards don't need your data, they just need data from somewhere that verifies the card numbers. In that case it's easier to just keep rotating targets until they've tested all the cards instead of bootstrapping an in-house team to write bespoke crawlers.
- civilian 9y agoMan. I really like that idea, but is giving a random "success" to a supposed credit card charge PCI compliant?
- linkregister 9y agoPCI is largely misunderstood. Spoofing a success on a transaction has nothing to do with proper storage and transmission of credit card information. Most e-commerce sites will use a payment processor such as Braintree or Stripe so they don't even have to deal with PCI. PCI applies to entities who store and process their own payments, e.g. Target, Amazon.
- adrr 9y agoPCI doesn't care about what i return to the customer. It covers protecting the card number. It could be in the merchant agreement but most of those rules are never enforced. Its against card brand rules to require a person to show an ID but all merchants do it. Merchant account agreement requires you to prevent fraudulent purchases and that part is heavily enforced which is why the card brands turn a blind eye to the merchants asking for an ID.