3 ms·

So what happens when one of the White Hats figures out how to access the interface used to add value to his/her card?

by jballanc 15y ago

wmf 15y ago
He goes to prison? But seriously, I wouldn't even look for holes in any payment system without prior indemnification.
- daeken 15y ago
  Hell, I work as a security consultant for a living and any time I touch live finance systems I tread very lightly. Any significantly complex system with money directly involved is going to have too many variables to predict its behavior. I wouldn't touch something like this with a ten foot clown pole.
  - tptacek 15y ago
    Presumably this is being run through a real bank with a real underwriting department. A VISA card that works at ATMs is not fun-and-games; it's not a Facebook feature.
    - daeken 15y ago
      Yea, this is well into the realm of going to jail for a long time if you touch anything. Find it pretty doubtful that anyone will even try.
    - nbpoole 15y ago
      Indeed. It's a Chase Visa card :)
proexploit 15y ago
From what I understand, it looks like basically a branded VISA gift card. The interface to add value to the card is going to be something VISA controls, not Facebook. So searching for weaknesses to add value to the card is equivalent to searching for weaknesses in the VISA network. If that's incorrect, someone who knows more can correct me.
- mrtron 15y ago
  That is correct.
stock_toaster 15y ago
His hat changes color?
nbpoole 15y ago
The card is a Chase Paymentcard (https://www.mychasepaymentcard.com/ https://www.mychasepaymentcard.com/). None of us have authorization to mess with Chase's applications. ;-)
rmc 15y ago
Since Facebook has only given money to 81 people so far, I'm going to guess this is a very manual procedure. There's probably only one guy somewhere that can authorise these things. It's not like they have (or can have) an automated 'bug bounty software'.

3 ms·

So what happens when one of the White Hats figures out how to access the interface used to add value to his/her card?

by jballanc 15y ago

So what happens when one of the White Hats figures out how to access the interface used to add value to his/her card?

wmf 15y ago
He goes to prison? But seriously, I wouldn't even look for holes in any payment system without prior indemnification.
- daeken 15y ago
  Hell, I work as a security consultant for a living and any time I touch live finance systems I tread very lightly. Any significantly complex system with money directly involved is going to have too many variables to predict its behavior. I wouldn't touch something like this with a ten foot clown pole.
  - tptacek 15y ago
    Presumably this is being run through a real bank with a real underwriting department. A VISA card that works at ATMs is not fun-and-games; it's not a Facebook feature.
    - daeken 15y ago
      Yea, this is well into the realm of going to jail for a long time if you touch anything. Find it pretty doubtful that anyone will even try.
    - nbpoole 15y ago
      Indeed. It's a Chase Visa card :)
proexploit 15y ago
From what I understand, it looks like basically a branded VISA gift card. The interface to add value to the card is going to be something VISA controls, not Facebook. So searching for weaknesses to add value to the card is equivalent to searching for weaknesses in the VISA network. If that's incorrect, someone who knows more can correct me.
- mrtron 15y ago
  That is correct.
stock_toaster 15y ago
His hat changes color?
nbpoole 15y ago
The card is a Chase Paymentcard (https://www.mychasepaymentcard.com/ https://www.mychasepaymentcard.com/). None of us have authorization to mess with Chase's applications. ;-)
rmc 15y ago
Since Facebook has only given money to 81 people so far, I'm going to guess this is a very manual procedure. There's probably only one guy somewhere that can authorise these things. It's not like they have (or can have) an automated 'bug bounty software'.