8 ms·

Takeaways from the $566M BriansClub Breach

77 points by QuitterStrip 7y ago

stevespang 7y ago
The main takeaway is all wise people should regularly call up their credit card co's and tell them their credit cards are lost or stolen, I do it every 6 months. They give me a new card with a new number for free, much less likely to have made it onto any carders list.
solotronics 7y ago
Why don't credit/debit cards use elliptic curve cryptography?
- piracy1 7y ago
  They're getting there. We have PKE in the form of chips.
- miohtama 7y ago
  Chip cards (EMV) use crypto - the signing of the transaction happens in the chip, with an embedded private key.
sekasi 7y ago
Open question; What's the long game on securing the way credit cards work? Who's working on something interesting that could thwart the whole 'name+number+ccv' leak thing that's been perpetuating in this industry for decades? I'm just reaching out for anyone who knows about any grand plans, initiatives or rehabs of how credit cards currently work. Keen to read more.
- chx 7y ago
  This is a solved problem, really, some banks are less keen on implementing it: generate single use / single purpose credit card numbers in your ebank / mobile app. Leaks are total useless. Also, more than a decade ago already many European banks were sending a text SMS above a treshold and only approved on a positive reply. Today you'd likely offer sending a push notification. You have 16 digits on a Visa/MasterCard, the first six is the bank identifier and the last is a checksum digit thus you have 9 digits to "waste" -- and you can recycle them.
  - SaberTail 7y ago
    Bank of America has discontinued their ShopSafe system for single-use credit cards. Citibank seems to still have their virtual credit card system, but it requires Flash. Are any banks currently embracing it? The impression I've gotten is that since most of the costs of fraud are on the bank, rather than the cardholder, there's not much incentive for the cardholder to go through the trouble of using single-use cards. And so it's a better investment for the bank to develop good fraud detection algorithms. In my anecdotal experience, the fraud detection has gotten really good. Every time in the past decade that someone's gotten hold of my credit card number, the bank's caught it nearly immediately.
    - SamReidHughes 7y ago
      Also, since they now just text you, they can make the algorithm more stringent. I've had BoA fraud detection ping me about a monthly rent check before, so I'm not sure it's really good.
  - aytekin 7y ago
    Can they handle monthly subscriptions?
    - lhuser123 7y ago
      I learned about privacy.com here on HN and it has been very helpful for me. You can create virtual cards for single-use or recurring payments. Each card can only be used by one vendor. You also set a max amount.
      - chx 7y ago
        Exactly, some implementations can even lock it to a single "message" (what you see on the credit card statement) so that it can't be used for a different purchase. Needs cooperation from the merchant not to put the subscription date in the message but otherwise, it's not exactly rocket science.
  - shkkmo 7y ago
- tyoma 7y ago
  Apple Pay generates a token that can only be used by the merchant for the authorized amount. More details: https://squareup.com/us/en/townsquare/what-does-tokenization-actually-mean https://squareup.com/us/en/townsquare/what-does-tokenization...
rajacombinator 7y ago
I find this kind of black hat cybercrime stuff fascinating. If I wanted to learn more about it (just for learning sake) what would be some good resources?
- deleted 7y ago
  [deleted]
- newguy1234 7y ago
  Honestly, join these groups and read what they talk about on the forum. Look up what the bigger fraud marketplaces are. Go on tor and read stuff in the dark net markets. All of them more or less talk about methods they're using and they help each other out. This type of stuff ranges from low level script kiddie (copy cat) people to high-level hackers that develop their own methods, search out vulnerabilities and so on. A good podcast I would recommend is called dark net diaries. They have lots of episodes on cryber crime. Episode 32 specifically talks about carding and how the secret service took down a guy who acquires the credit card numbers. Most of it involves putting malware on point of sale machines or hacking companies. https://darknetdiaries.com/ https://darknetdiaries.com/
- rwmurrayVT 7y ago
  Learn Russian and read their forums. Otherwise it'll be a bit more difficult. If you don't know anyone involved in fraud it can be difficult to get inside. You really won't get anywhere if you don't have much to offer.
newguy1234 7y ago
Are these idiots really still using bitcoin for doing shady stuff lol? Bitcoin can totally be traced. Most people using it are so weak in terms of their security.
- malux85 7y ago
  If you don’t know something as basic as how to make bitcoin untraceable, then you’re the idiot.
  - grepthisab 7y ago
    I don't know anything about Bitcoin. Am I an idiot?
    - malux85 7y ago
      No, that's an unwarranted extrapolation of what I said.
      - shkkmo 7y ago
        It doesn't seem like an extrapolation given how you phrased it. If you meant to say that "it is only idiocy if you don't know how to anonymize your Bitcoin usage", that is not at all how your comment comes across.
        malux85 7y ago
        The parent comment cast the first stone by calling the bitcoin users idiots because bitcoin is traceable. The gap between knowing enough to trace bitcoin, and knowing enough to make bitcoin untraceable is tiny, which means anyone understanding enough to know that bitcoin is traceable bit not bothering to research how it can be untraceable is an idiot (when they go online and call all users idiots, dsspite not having done a tiny bit of research into something pretty well known int the community). Not normally my choice of words, but I chose to use the language of the comment to humble him a little. And I was talking to the commenter directly, not generalizing to all bitcoin users. THAT IS an unwarranted extrapolation.
cantrevealname 7y ago
> KrebsOnSecurity [has] a link to 26 million credit and debit cards. So far the banking sector is [not in a hurry for] re-issuing cards. Krebs should publish those card numbers to light a fire under the feet of the bankers to re-issue the cards and get them to demand better security on merchant terminals or servers or wherever the info came from. Of course he should publish only the numbers, without the associated names, CVVs, expiry dates, PINs, or other security info. I don't think there is a risk in publishing just numbers, is there? The search space for valid card numbers is so tiny that I find it hard to believe that anyone could generate a false transaction with just the number and no other associated info. Krebs could go a step further and provide a verification site à la haveibeenpwned.com where your enter your card number, or the last ten digits or something, and it tells you whether you've been pwned.

77 points by QuitterStrip 7y ago

The main takeaway is all wise people should regularly call up their credit card co's and tell them their credit cards are lost or stolen, I do it every 6 months. They give me a new card with a new number for free, much less likely to have made it onto any carders list.

solotronics 7y ago

Why don't credit/debit cards use elliptic curve cryptography?

piracy1 7y ago
They're getting there. We have PKE in the form of chips.
miohtama 7y ago
Chip cards (EMV) use crypto - the signing of the transaction happens in the chip, with an embedded private key.

sekasi 7y ago

Open question; What's the long game on securing the way credit cards work? Who's working on something interesting that could thwart the whole 'name+number+ccv' leak thing that's been perpetuating in this industry for decades? I'm just reaching out for anyone who knows about any grand plans, initiatives or rehabs of how credit cards currently work. Keen to read more.

chx 7y ago
This is a solved problem, really, some banks are less keen on implementing it: generate single use / single purpose credit card numbers in your ebank / mobile app. Leaks are total useless. Also, more than a decade ago already many European banks were sending a text SMS above a treshold and only approved on a positive reply. Today you'd likely offer sending a push notification. You have 16 digits on a Visa/MasterCard, the first six is the bank identifier and the last is a checksum digit thus you have 9 digits to "waste" -- and you can recycle them.
- SaberTail 7y ago
  Bank of America has discontinued their ShopSafe system for single-use credit cards. Citibank seems to still have their virtual credit card system, but it requires Flash. Are any banks currently embracing it? The impression I've gotten is that since most of the costs of fraud are on the bank, rather than the cardholder, there's not much incentive for the cardholder to go through the trouble of using single-use cards. And so it's a better investment for the bank to develop good fraud detection algorithms. In my anecdotal experience, the fraud detection has gotten really good. Every time in the past decade that someone's gotten hold of my credit card number, the bank's caught it nearly immediately.
  - SamReidHughes 7y ago
    Also, since they now just text you, they can make the algorithm more stringent. I've had BoA fraud detection ping me about a monthly rent check before, so I'm not sure it's really good.
- aytekin 7y ago
  Can they handle monthly subscriptions?
  - lhuser123 7y ago
    I learned about privacy.com here on HN and it has been very helpful for me. You can create virtual cards for single-use or recurring payments. Each card can only be used by one vendor. You also set a max amount.
    - chx 7y ago
      Exactly, some implementations can even lock it to a single "message" (what you see on the credit card statement) so that it can't be used for a different purchase. Needs cooperation from the merchant not to put the subscription date in the message but otherwise, it's not exactly rocket science.
- shkkmo 7y ago
tyoma 7y ago
Apple Pay generates a token that can only be used by the merchant for the authorized amount. More details: https://squareup.com/us/en/townsquare/what-does-tokenization-actually-mean https://squareup.com/us/en/townsquare/what-does-tokenization...

rajacombinator 7y ago

I find this kind of black hat cybercrime stuff fascinating. If I wanted to learn more about it (just for learning sake) what would be some good resources?

deleted 7y ago
[deleted]
newguy1234 7y ago
Honestly, join these groups and read what they talk about on the forum. Look up what the bigger fraud marketplaces are. Go on tor and read stuff in the dark net markets. All of them more or less talk about methods they're using and they help each other out. This type of stuff ranges from low level script kiddie (copy cat) people to high-level hackers that develop their own methods, search out vulnerabilities and so on. A good podcast I would recommend is called dark net diaries. They have lots of episodes on cryber crime. Episode 32 specifically talks about carding and how the secret service took down a guy who acquires the credit card numbers. Most of it involves putting malware on point of sale machines or hacking companies. https://darknetdiaries.com/ https://darknetdiaries.com/
rwmurrayVT 7y ago
Learn Russian and read their forums. Otherwise it'll be a bit more difficult. If you don't know anyone involved in fraud it can be difficult to get inside. You really won't get anywhere if you don't have much to offer.

newguy1234 7y ago

Are these idiots really still using bitcoin for doing shady stuff lol? Bitcoin can totally be traced. Most people using it are so weak in terms of their security.

malux85 7y ago
If you don’t know something as basic as how to make bitcoin untraceable, then you’re the idiot.
- grepthisab 7y ago
  I don't know anything about Bitcoin. Am I an idiot?
  - malux85 7y ago
    No, that's an unwarranted extrapolation of what I said.
    - shkkmo 7y ago
      It doesn't seem like an extrapolation given how you phrased it. If you meant to say that "it is only idiocy if you don't know how to anonymize your Bitcoin usage", that is not at all how your comment comes across.
      - malux85 7y ago
        The parent comment cast the first stone by calling the bitcoin users idiots because bitcoin is traceable. The gap between knowing enough to trace bitcoin, and knowing enough to make bitcoin untraceable is tiny, which means anyone understanding enough to know that bitcoin is traceable bit not bothering to research how it can be untraceable is an idiot (when they go online and call all users idiots, dsspite not having done a tiny bit of research into something pretty well known int the community). Not normally my choice of words, but I chose to use the language of the comment to humble him a little. And I was talking to the commenter directly, not generalizing to all bitcoin users. THAT IS an unwarranted extrapolation.

cantrevealname 7y ago

> KrebsOnSecurity [has] a link to 26 million credit and debit cards. So far the banking sector is [not in a hurry for] re-issuing cards. Krebs should publish those card numbers to light a fire under the feet of the bankers to re-issue the cards and get them to demand better security on merchant terminals or servers or wherever the info came from. Of course he should publish only the numbers, without the associated names, CVVs, expiry dates, PINs, or other security info. I don't think there is a risk in publishing just numbers, is there? The search space for valid card numbers is so tiny that I find it hard to believe that anyone could generate a false transaction with just the number and no other associated info. Krebs could go a step further and provide a verification site à la haveibeenpwned.com where your enter your card number, or the last ten digits or something, and it tells you whether you've been pwned.