3 ms·

This is the second very similar report on HN where the end-goal was ApplePay. There must be something poorly done in their card linking/payment process that hac

This is the second very similar report on HN where the end-goal was ApplePay. There must be something poorly done in their card linking/payment process that hackers are targetting. I don't use it, so I'm not familiar. Collectively, we software engineers that have security focus, have done a piss-poor job with 2FA. Users should've been trained from day-one that 2FA codes sent to their email or SMS should never, EVER, be repeated back to a human. All the additional text sent with the code should clearly and emphatically state that this number is between you and a website that you are reasonably certain represents a secured entity and that you explicitly requested during a login flow. It's like the combination to a safe: that code is between you and the dial on the safe, if it ever verbally leaves your mouth, you're doing something wrong. Any orgs that use 2FA codes to authenticate a user to a CSR are screwing it up for everyone. Don't do that: you should be able to mutually authenticate using shared knowledge that a hacker isn't likely to have (not an address, FFS), like the previous transactions thing the OP requested. 2FA codes are for computers only.

ant6n 5y ago
What pisses me off to no end in Europe is that some banking systems require, in order to do a credit card payment, to provide the online bank account password and online bank account 2fa generated transaction code — requiring that both be entered as part of the payment process on any merchants website. It’s so goddamn stupid I can’t believe this exists. It’s so easy to fake this and use some sort of man in the middle attack to transfer all money away from an account. Plus it teaches ppl that it’s okay to enter one’s online banking credentials one-time generated transaction codes into random websites selling u random crap for 3€… I don’t understand security researchers. Is it all just a bunch of hooey they sell or what?
- eythian 5y ago
  > It’s so goddamn stupid I can’t believe this exists. It’s so easy to fake this and use some sort of man in the middle attack to transfer all money away from an account An MitM attack is significantly harder than "I have your CC number and I'll use it with no authentication", therefore it does increase the difficulty for fraud. Though I haven't seen a requirement to enter the bank's password, my one requires me to confirm the transaction by opening the credit card provider's app on my phone which isn't vulnerable in the way you're describing.
- sofixa 5y ago
  Banks are supposed to do MFA. Some, apparently, are crap and require you to login while doing a payment, but most ask for a confirmation with an SMS code or the banks app, both of which contain who the payment is towards, and the amount.
rowls66 5y ago
I don't know for sure, but I suspect, that the reason that ApplePay is being targeted is because other means of credit card fraud at point of sale have become much more difficult with chip cards. ApplePay itself is also quite secure, but the process of enrolling a card in ApplePay is probably the weakest link. The card chip does not provide any added security in the process. I think that most banks use PAN and card security code combined with one time password by email or mobile to verify the cardholder. If a fraudster can crack this nut, and get a card fraudulently enrolled into ApplePay on a phone, they can use the card at point of sale, and point of sale is the ideal fraud target since the fraudster can remain mostly anonymous, and walk out of the shop with the stollen goods.

ant6n 5y ago

What pisses me off to no end in Europe is that some banking systems require, in order to do a credit card payment, to provide the online bank account password and online bank account 2fa generated transaction code — requiring that both be entered as part of the payment process on any merchants website. It’s so goddamn stupid I can’t believe this exists. It’s so easy to fake this and use some sort of man in the middle attack to transfer all money away from an account. Plus it teaches ppl that it’s okay to enter one’s online banking credentials one-time generated transaction codes into random websites selling u random crap for 3€… I don’t understand security researchers. Is it all just a bunch of hooey they sell or what?

eythian 5y ago
> It’s so goddamn stupid I can’t believe this exists. It’s so easy to fake this and use some sort of man in the middle attack to transfer all money away from an account An MitM attack is significantly harder than "I have your CC number and I'll use it with no authentication", therefore it does increase the difficulty for fraud. Though I haven't seen a requirement to enter the bank's password, my one requires me to confirm the transaction by opening the credit card provider's app on my phone which isn't vulnerable in the way you're describing.
sofixa 5y ago
Banks are supposed to do MFA. Some, apparently, are crap and require you to login while doing a payment, but most ask for a confirmation with an SMS code or the banks app, both of which contain who the payment is towards, and the amount.

rowls66 5y ago

I don't know for sure, but I suspect, that the reason that ApplePay is being targeted is because other means of credit card fraud at point of sale have become much more difficult with chip cards. ApplePay itself is also quite secure, but the process of enrolling a card in ApplePay is probably the weakest link. The card chip does not provide any added security in the process. I think that most banks use PAN and card security code combined with one time password by email or mobile to verify the cardholder. If a fraudster can crack this nut, and get a card fraudulently enrolled into ApplePay on a phone, they can use the card at point of sale, and point of sale is the ideal fraud target since the fraudster can remain mostly anonymous, and walk out of the shop with the stollen goods.