12 ms·
Detect breaches with Canary credit cards
- lanuk 4y agoI am still seeing the error "Credit Card Rate-Limiting currently in place. Please try again later." This tool is broken.
- madsbuch 4y agoVery neat! I can definitely see that adding a couple of these to ones password manager would be hugely valuable!
- jay-barronville 4y agoTrue, but if your password vault becomes compromised, you have significantly bigger problems than credit cards being compromised.
- philsnow 4y agoIn that case you're almost completely screwed... but you would want to know sooner rather than later, right?
- deleted 4y ago[deleted]
- remram 4y agoThose are free? Wouldn't those cost them something to create or operate?
- detaro 4y agoThe Canarytokens service is clearly more or less an advertising expense for them. People that know and use it are more likely to buy their commercial offerings.
- whstl 4y agoThis is a late-2000s story but: I once worked for a small-time credit card emitter and the only money leaving us was the money from the transactions themselves. It was quite interesting, AFAIK we had a range of CC numbers that we could use, and we had to "answer" to an API call (a "lower-level webhook", it wasn't HTTP) that provided all the user data for verification, and we had to authorize in a maximum amount of time (hard real-time). The verification happened entirely on our side, so it was even possible to reuse numbers by changing the CVV or expiration date, for example. At least that was how it was explained to me, someone could chime in and correct some mistakes here! :) This feature later enabled some banks to allow the customer to change their "credit limit" as much as they wanted, or to block/unblock the card using a toggle in the app. But "real time confirmation" wasn't possible because of the hard-real-time constraint we had. I remember we had to reply very fast at the time, and could get punished if we had too many timeouts. This might not be the reality on every country or region, but by giving everyone a dummy credit card in those conditions, the costs would be only of servers + personnel. Of course, a partnership with zero dollars worth of transactions would make zero sense to the partnering bank, so they would obviously complain. But this here seems to be a special case where there's a previous agreement.
- remram 4y agoVery interesting! Given the fees charged to sellers, I assumed that Visa/MasterCard/... would tax the banks as well.
- ocal5 4y agoLooks neat and thanks for sharing idea. Aren't professionnal going to just discard all numbers associated with this "bank", then ?
- lights0123 4y ago> Savvy attackers may start looking for patterns in the bank identification numbers (BINs) that we issue, and proactively deleting or excluding them from their dumps. For this reason we are in discussions with a number of banks to onboard their BINs to the system too, further mixing in legitimate cards with tokens. > It’s a compelling argument: “Would you like attackers to first remove your bank’s cards from dumps they steal?”
- ocal5 4y agowin - win : )
- philsnow 4y agoI've thought about something similar for spam calls: I can play whack-a-mole blocking individual numbers, but it won't scale fast enough and scammers will always get to me. I can rely on iphone's "scam likely" notification and just not answer those, which helps. If the latter (and whatever similar feature android has) were somehow perfect, scammers would have a bad time. But.. if they convinced (paid) some (more-)legitimate companies to have their outgoing calls show up as the same number as the scammers use, people would eventually learn that they have to pick up scam calls or else miss calls from their bank/pharmacy/whatever.
- paranoidrobot 4y ago> if they convinced (paid) some (more-)legitimate companies to have their outgoing calls show up as the same number as the scammers use In the US the STIR/SHAKEN[1] protocol adds source-verification. If/when this finally gets fully rolled out, spoofing caller ID without it being blocked is going to get much harder. But, I'm sure the next step for them is to just go after the millions of small-medium business IP telephony systems that are either poorly configured with default/guessable passwords, or have wide-open security holes. [1] https://en.wikipedia.org/wiki/STIR/SHAKEN https://en.wikipedia.org/wiki/STIR/SHAKEN
- sneak 4y agoWouldn't the attacker only charge these after charging dozens/hundreds of legitimate customer cards too? Seems to me this is the wrong solution to the problem this is trying to solve.
- sergioisidoro 4y agoThe responsibilities don't end when the breach happens. And while the cat is out of the bag, knowing it has happened is also important to contact customers, fulfil legal disclosure with regulators (eg. GDPR), and for triggering investigations and forensics.
- azeemba 4y agoUsually they test the set of cards with small charges. This allows them to sell pre-tested cards at higher value. So if you can find out that one of your canary cards have been tested, you can have some confidence that your whole set has been compromised.
- acdha 4y agoIt’s mitigation, not a perfect prevention, but those are extremely useful for security: if the attacker trips a warning after hundreds of charges are approved that still allows the bank to take action before the number is in the thousands of cards and makes it possible to retroactively revoke the transactions which were just approved. In the common case where someone is making purchases using stolen cards that allows goods never to leave the warehouse, and if the attacker slows their usage rate to avoid that they’re getting much less profit.
- ipython 4y agoOooo. This is fantastic. I’ll start using this with scam callers. Do they also give you the info on the entity that made the charge?
- voakbasda 4y agoI have wanted something like this to give to scammers, to help aid in their detection and capture. This is part of that puzzle. Now if only law enforcement would give a shit and do something about all of the rampant fraud. Sadly, I do not believe that will ever happen.
- lazide 4y agoNear as I can tell, a lot of the fraud is exploitation of the known and not yet solved ‘remote jurisdiction’ issue. When someone is far away, and in a different jurisdiction, it’s hard to track them down and do anything to them. Not likely to get better anytime soon, unfortunately.
- myself248 4y agoI thought bounty hunters were supposed to solve that. They ignore our laws, we ignore theirs. This leads to a hell of a dystopia, but spammers have left me no choice but to contemplate dystopias.
- lazide 4y agoBounty hunters are not really a thing in the way you’re thinking - they can’t just go to Japan, investigate someone, arrest them and bring back someone from there for instance. They’re for returning someone already arrested who jumped bail somewhere. And they typically don’t work internationally, as their legality is dubious even within a specific jurisdiction. For something major, it’s generally already possible to investigate and get someone extradited already, for instance, when the cultural gaps aren’t too large and the cultures have a common agreement on what a ‘major crime’ is and looks like. Murder, for instance. The issue is the bar for ‘major enough’ gets higher and higher the more jurisdictions/cultures you cross, and it is super easy now to scam across a large enough gap there that no one is going to arrest or participate in investigating all but the largest and most blatant scams. Good luck getting someone arrested in Russia, Nigeria, China, etc. for wire fraud, for example.
- deleted 4y ago
- 1970-01-01 4y agoVery interesting tool. I'm going to write the canary CC onto a physical card and swipe it first when shopping. If I ever see it randomly accessed, I'll know my 2nd card (actual payment card) is burnt. >Credit Card Rate-Limiting currently in place. Please try again later. Maybe tomorrow.
- deleted 4y ago[deleted]
- rsync 4y agoHmmm … I like the idea but my hunch was that disposable card numbers would fail at POS because the network knows that card should never have been issued physically? If you run this experiment, would you do a tell HN ?
- 1970-01-01 4y agoIt's still broken. IF it works, I'll tell
- myself248 4y agoThe fact that the Payment Card Industry association hasn't been pushing this for decades, and it's up to some random infosec nerds to invent it, is yet more evidence that our entire payment infrastructure is fundamentally flawed.
- pelasaco 4y agoWell to be honest Honey Tokens is being used since beginning of the 2000s, https://en.wikipedia.org/wiki/Honeytoken https://en.wikipedia.org/wiki/Honeytoken. I personally implemented them in a Bank, 20 years ago, generating some fake credit cards number (and other information) and having them being monitored in AV, IDS, IPS, Antifraud solutions like browser extensions, google search and etc.. So maybe we can say that I'm a random infosec nerd, but i guess, I'm not the only one, just that people and companies preferred to make it in silence, to actually catch the bad guys out there. We actually were able to catch internal people selling data and we could understand some ways data used to flow and work pretty tight with the Police to intercept and bust criminal groups.
- 411111111111111 4y agoYeah, trust self important HN commentators like myself248 to imply incompetence throughout an entire industry while being completely ignorant about said industry.
- pelasaco 4y agopeople normally imagine that finance and specially banks, are just COBOL, mainframe and legacy, and even though it is part of their BAU, there are lot of innovation there, specially in the infosec/antifraud segments.
- myself248 4y agoHow would the operator of an ecommerce website have gotten their hands on these things to seed their data with them? Is this something they would've known to ask for?
- posix_compliant 4y agoI’m dying to know how they implemented this. In order to have Visa or MasterCard process this transaction, they’d need to have a bank partner to issue the credit credit card with an issuer processor. There’s usually a large cost to keeping open credit cards on file, even if there’s no line of credit.
- jhfdbkofdchk 4y agoOnly Amex at the moment.
- DerekBickerton 4y agoThis is tangential, but still related: a few years ago I could buy disposable VISA cards which were these vouchers you bought in a store and were preloaded with a fixed amount. They didn't even have to be in your legal name. I put the numbers on e-crime forums for people to snap up, and it was funny watching what kinds of transactions were being made. Most people were using it to buy cryptocurrency. Most of the transactions were vague though and didn't mention the merchant in question, but with a bit of digging I discovered they were so called 'Discreet Billing' companies which are largely used for adult websites and used to mask the fact you were buying porn to people casually glancing at your CC statement.
- deleted 4y ago[deleted]
- rich_sasha 4y agoI find it crazy that making a payment requires giving your full details. Using a credit card is less writing a cheque, more handing over a chequebook and saying "help yourself". I dream of a payment system where payment generates some token, which the intended recipient can redeem, perhaps bearer ones for casual transactions, with support for periodic payments, revoking existing tokens or placing per-token limits. One day perhaps...
- bruce343434 4y agoiDeal is really nice and everywhere in the Netherlands. Giving out credit card details to websites is crazy to me. (https://www.ideal.nl/en/ https://www.ideal.nl/en/)
- mkinsella 4y agoUse Privacy.com for that!
- zenosmosis 4y agoI second this. In a year's worth of using Privacy.com, I've been very pleased with the service. I like how you can set a budget for a particular card, as well.
- legutierr 4y agoThis is part of the reason that a lot of people are excited about stablecoins and blockchain payments.
- acdha 4y agoIt’s a common marketing point but people aren’t using blockchains because they cost more, take longer, and have no fraud protection. If someone steals my credit card, I’ll likely lose nothing other than some mild inconvenience updating numbers - and I don’t even need to do that with the modern systems like Apple Pay which use unique per-merchant identifiers. That makes quite the contrast with the large sums routinely and irrecoverably stolen from blockchain users. If you want people to buy your random hashes, spend your time unbreaking the system instead of marketing it.
- boramalper 4y agoI wonder if the BIN/IIN (Bank/Issuer Identification Number[0]) of canary cards give it away. For this to work against sophisticated attackers, I'd expect a canary card to be indistinguishable from a regular one, though I still love the ingenuity of it. edit: They mention this in the article, I missed it. [0] https://en.wikipedia.org/wiki/Payment_card_number#Issuer_identification_number_(IIN) https://en.wikipedia.org/wiki/Payment_card_number#Issuer_ide...
- veleek 4y agoThe blog post specifically calls out BINs and their limitations and some things they are doing to improve it.
- boramalper 4y agoI only skimmed the article, you are absolutely right. Sorry!
- deleted 4y ago[deleted]
- 29athrowaway 4y agoOr canary admin accounts (marked in the db as admin but with exceptions at the app level so that they are effectively not admins).
- DueDilligence 4y ago.. lets see .. a penny for the peep show [canary token] or a dollar for the lap dance [privacy.com]. No argument here - lap dance it is.
- deleted 4y ago[deleted]
- europeanguy 4y agoThis idea has an obvious problem. It's a lot of hard work. How many people are going to be diligent in planting canaries etc? And if you are, can you be diligent for the next 1, 2, 3 decades? That's a lot of time spent on this. You know what would be better? If every bank provided as a service/feature the ability to create single-use (and single-merchant!) debit cards. Revolut can do it, why can't huge banks do it as well? (BTW if you know one that does, let me know.)
- bentcorner 4y agoCapital One can generate single/repeat use virtual cards, although it's for number-only transactions (online only?). I don't know if there's way to use them for tap/swipe transactions.
- b3morales 4y agoCapital One does still have these: https://www.capitalone.com/digital/eno/ https://www.capitalone.com/digital/eno/ though caveat the feature is only available via a browser plugin, I assume because they want to be able to scrape your shopping habits/history in the process.
- codetrotter 4y ago> Revolut can do it, why can't huge banks do it as well? FWIW, I use Revolut and am a fan of their service. However, the one time I tried to use the single-use feature it just didn’t work for some reason. So I had to enter my “permanent” card details instead in order to proceed with payment.
- deleted 4y ago[deleted]
- nubinetwork 4y agoDupe of https://news.ycombinator.com/item?id=34469471 https://news.ycombinator.com/item?id=34469471
- deleted 4y ago[deleted]
- jameshart 4y ago> Some places we recommend putting these include: Databases where you store customer payment information alarm klaxon sounds Why do you have a database containing customer payment information?
- loeg 4y agoReducing friction in repeated transactions? Someone needs to store it.
- jameshart 4y agoUnless you’re an actual payment platform, that someone should not be you.
- NavinF 4y agoThere's a tradeoff. Card numbers in your db are a lot easier to move between payment platforms than tokenized card numbers. So many merchants get screwed by payment platforms that lock them out right in the middle of a large sale because the sudden increase in transactions looks like fraud. You gotta look out for number one.
- croes 4y agoShopping sites?
- hn92726819 4y agoDo you think companies avoid storing this data? There's no reason for them not to, so they do it. Look at the target hack for an example of real word credit card info stored. Also, tons of companies have one-click payment options (ever order something from Chipoltle or Dominos app?) Edit: It should be disincentivised, but look at any "punishment" for a data leak and it's cheaper for them to just lose the data
- jameshart 4y agoPCI-DSS compliance auditing is not cheap. There’s the incentive right there. Individual retailers have no need to store actual cardholder information. All the payment platforms provide ways to persist cardholder information, in a way that allows it to be reused but never read.
- teilo 4y agoI use Privacy.com, which basically turns every card I use with them into a canary. The first time you charge on one of their virtual cards, they become merchant-locked. No other merchant can charge to that number, and if someone tries, I get an alert. I have uncovered flaws in online merchants this way, and notified them. They were usually grateful, especially so since the fraudulent charges failed.
- NavinF 4y agoWorth mentioning that several banks offer virtual credit card numbers as a built-in feature so you don't need a separate service: https://www.doctorofcredit.com/list-of-banks-which-offer-virtual-account-numbers/ https://www.doctorofcredit.com/list-of-banks-which-offer-vir... I've only used this for the sketchiest of vendors though. Chargebacks are pretty easy for the once-a-decade event where I get billed for something incorrectly.
- lxgr 4y agoPer that reference, it seems like only two major issuers still offer the feature.
- worble 4y agoIt's also frankly absurd that no such service exists for European customers. I've been looking the past few days for someone who does something like this and it's just not available, for what I can only assume are regulatory reasons.
- vlabakje90 4y agoRevolut has single use credit cards as part of their offering. You can either choose to create a new one for each transaction (disposable card) or a virtual credit card that you can use more than once but discard if something happens to it. Because both types are virtual prepaid type cards, some services (e.g. car rental) will not accept such cards.
- 4y ago
- brightball 4y agoI'm really glad to see this project. I used to do this all the time by hand when I was actively dealing with phishing sites. I'd submit credentials to the site and watch for it on our account login page to identify the perpetrator.
- welder 4y agoI use Stripe so this isn't much use to me, but looking at their other canary tokens I could see the AWS key canary being useful. https://docs.canarytokens.org/guide/ https://docs.canarytokens.org/guide/
- neilv 4y ago> Mix it in with your store of saved card data or on payment gateways. An attacker who plans to test the cards (as they normally do when obtaining them) or attackers who try to use them will immediately advertise their presence, and your response team can spring into action. Spring into action, to shut the barn door after the cows already got out? Getting alerted is good, but it's unfortunate that infosec practice still has so much band-aids, theatre, and reacting after that doesn't work.
- viraptor 4y agoIt's not a replacement for any prevention you apply first. It's not a band-aid. It's one more layer of what you can do and it is valuable to know when you were breached. It's basically an answer to: do you want to know that things went bad shortly after they did, or months later?
- neilv 4y agoI didn't like the connotation of "spring into action". That sounded like sitting on butts before.
- lobstersammich 4y agoDoes anyone have a good alternative to Privacy.com where your virtual credit card transaction data isn't sold to Wall Street? If you're unfamiliar with what a "virtual [credit] card" is here's the page from Privacy.com's website: https://privacy.com/virtual-card https://privacy.com/virtual-card I use the Privacy app on my mobile phone to create virtual cards (primarily for work subscriptions). Pro-tip: since each Privacy card can have its own name put a tag such as `[WORK_RECURRING]` into the card name and then you can search your email inbox for `[WORK_RECURRING]`, quickly and easily finding all of the transactions / charges that you may want to submit to your workplace for reimbursement. Privacy is owned / created by Lithic, but if you look at Lithic's investors you'll see that the plurality of the company's investors are in the private equity or VC space: Bessemer Ventures, Tusk Partner Ventures, Index Ventures, etc. You can see the Privacy.com / Privacy mobile app's funders here: https://www.crunchbase.com/organization/lithic-pay https://www.crunchbase.com/organization/lithic-pay Thus, I have no doubt that my transactions on cleverly-named Privacy app are being gifted or sold to Wall Street so that hedge funds can squeeze out a few addition drops of 'signal' from consumer purchase pattern data that would otherwise remain dark. (I'd imagine that many folks use the Privacy app to buy things that they'd rather not have show up on their regular credit card bills: 'adult websites', marijuana or tobacco products, etc. So, two questions: (1) Does anyone have a privacy-respecting alternative to Privacy.com's virtual credit cards? (2) Does anyone know of a recent blog post where these virtual credit card services are compared / contrasted by - the services that they offer, - the cost: free, paid, etc., - the terms of service: how your data is re-sold / who your data is transmitted to
- ok_dad 4y agoI would bet that all of your electronic transactions end up in some pool of data, no matter what you try. I believe only cash at a swap meet while wearing dark sunglasses and a hat is really private.
- asciimike 4y ago> (1) Does anyone have a privacy-respecting alternative to Privacy.com's virtual credit cards? Capital One offers virtual cards through Eno (https://www.capitalone.com/digital/eno/virtual-card-numbers/ https://www.capitalone.com/digital/eno/virtual-card-numbers/) that are merchant locked. They make it somewhat cumbersome to use, but I've really enjoyed using them. It doesn't block wall street knowing about what you're buying, but at least it's likely got one (or more) fewer middlemen looking at all your transactions.
- edarchis 4y agoI've been trying to use this technique to alert banks (in Belgium where I live) of online fraud for a while but failed. We are getting lots of phishing by text, email and hacked IMs. They use a bunch of redirections to get you to "login to your bank" with our security devices. In reality, they'll use MITM it and transfer money to some mules. If we could have people fill in some canary bank account that would trigger a fraud alert at the banks, we could stop those payments a lot more easily. The banks don't really seem to care because the payments are signed with the card and PIN of the owner, so they refuse to refund it. No loss to the bank, no action. :(
- nikolay 4y agoThis is a very shortsighted and short-lived idea - cyber criminals will find out the first digits of all these canary credit cards and never bother to test them. Even if multiple prefixes come into existence, unless they are mixed with normal credit cards, this won't ever make practical sense.
- mjg59 4y agoFrom the article: "Savvy attackers may start looking for patterns in the bank identification numbers (BINs) that we issue, and proactively deleting or excluding them from their dumps. For this reason we are in discussions with a number of banks to onboard their BINs to the system too, further mixing in legitimate cards with tokens."
- zackwu 4y agoTrue. But this only mitigate the problem, doesn't solve it. Whatever BINs they use, there must be some noticeable patterns, simply because these cards are NOT regular cards.
- nikolay 4y agoNo bank would mix their numbers with other service providers. Being in talks does not mean there will be a successful resolution.
- alberth 4y agoxPay (Apple/Google/etc Pay) Isn’t a major value prop of Apple Pay and the likes is your creditial can’t be stolen.
- lxgr 4y agoIt is, but not nearly all merchants accept Apple Pay or Google Pay. Apple also seems to have no interest in letting other browsers on macOS use it, and I do most of my shopping on my mac, so I end up using my plain card number in almost all cases. If the merchant seems particularly sketchy about security or not charging the card for more than what was agreed on (or makes it very hard to cancel their service), I need a one-time use card number anyway, since Apple and Google Pay don't yet protect against the latter.
- aembleton 4y agoI'm wondering if you could build something similar with Starling Bank. They have virtual cards [1] and an API [2]. This is something I will have to explore later. 1. https://www.starlingbank.com/features/virtual-cards/ https://www.starlingbank.com/features/virtual-cards/ 2. https://developer.starlingbank.com/docs https://developer.starlingbank.com/docs