5 ms·

Hotel hackers redirect guests to fake Booking.com to steal cards

52 points by gslin 3y ago

ilaksh 3y ago
Digital signatures should have made credit cards obsolete a long time ago. It's a very dated system.
- resolutebat 3y ago
  How would that help in this case, where customers are entering their own CCs into the phishing page?
  - isaacfung 3y ago
    Dont send the cc info. Use private key to authenticate yourself. Digitally sign the transaction id and the date so people cant record the info and reuse it. I guess the issue is that people may lose or forget their keys or people can gain access to the signing device. It is harder to understand than using password for verification so people like my parents do not trust it.
    - thehappypm 3y ago
      This is exactly how it works when you tap to pay. It would be really cool if computers let you to tap to pay.
  - 0xDEAFBEAD 3y ago
    If we were using digital signatures, you wouldn't need to give the number you use for authentication to every party you transact with.
    - mindslight 3y ago
      ... so the fraudulent link has the same exact message, but prompting you to "redo" the digital signature - eg stick your credit card into the reader again. Digital signatures are a red herring. The only way to "solve" this on the consumer side is to change the semantics and make electronic payments like cash. If a customer paid a hotel in cash, and a person in the lobby said "hey there was a problem with your cash, give it to us 'again'", the customer would rightly balk. But why would a customer ever want that? Especially for something like hotel bookings where one isn't able to sit down at a fully-fledged computer and spend time picking over the request details and account transactions with a fine tooth comb? Reversibility means any fraud can be detected after you're done traveling.
      - 0xDEAFBEAD 3y ago
        > ... so the fraudulent link has the same exact message, but prompting you to "redo" the digital signature - eg stick your credit card into the reader again. This caps the fraud amount at the money transacted. Also, maybe you could educate users to look for a confirmation message, and never duplicate a transaction if they already received a confirmation message. (And force a fraudster to generate a quick confirmation message if they want to get any money.) I don't think digital signatures are mutually exclusive with reversible transactions.
skilled 3y ago
The original research, https://www.akamai.com/blog/security-research/sophisticated-phishing-campaign-targeting-hospitality https://www.akamai.com/blog/security-research/sophisticated-...
- resolutebat 3y ago
  The original research downplays that it's specifically Booking.com customers who are targeted here.
  - hackernewds 3y ago
    The specific example in the article shows and states that a Booking.com site is emulated. That would be helpful info for a reader.
  - skilled 3y ago
    Ok, I edited my comment to simply point to the original source.
heavenlyblue 3y ago
I am currently staying at a Steigenberger hotel in Luxor, Egypt. Their account on booking.com is hacked so badly that right at the moment booking is made they send you a message to not reply to any messages coming from them asking to pay on the website outside booking.com. Several months later they messaged me asking to pay on the dodgy website completely copying the UI of booking.com.
tetris11 3y ago
Any idea or motivation where all these hacks the last week are coming from?

52 points by gslin 3y ago

ilaksh 3y ago

Digital signatures should have made credit cards obsolete a long time ago. It's a very dated system.

resolutebat 3y ago
How would that help in this case, where customers are entering their own CCs into the phishing page?
- isaacfung 3y ago
  Dont send the cc info. Use private key to authenticate yourself. Digitally sign the transaction id and the date so people cant record the info and reuse it. I guess the issue is that people may lose or forget their keys or people can gain access to the signing device. It is harder to understand than using password for verification so people like my parents do not trust it.
  - thehappypm 3y ago
    This is exactly how it works when you tap to pay. It would be really cool if computers let you to tap to pay.
- 0xDEAFBEAD 3y ago
  If we were using digital signatures, you wouldn't need to give the number you use for authentication to every party you transact with.
  - mindslight 3y ago
    ... so the fraudulent link has the same exact message, but prompting you to "redo" the digital signature - eg stick your credit card into the reader again. Digital signatures are a red herring. The only way to "solve" this on the consumer side is to change the semantics and make electronic payments like cash. If a customer paid a hotel in cash, and a person in the lobby said "hey there was a problem with your cash, give it to us 'again'", the customer would rightly balk. But why would a customer ever want that? Especially for something like hotel bookings where one isn't able to sit down at a fully-fledged computer and spend time picking over the request details and account transactions with a fine tooth comb? Reversibility means any fraud can be detected after you're done traveling.
    - 0xDEAFBEAD 3y ago
      > ... so the fraudulent link has the same exact message, but prompting you to "redo" the digital signature - eg stick your credit card into the reader again. This caps the fraud amount at the money transacted. Also, maybe you could educate users to look for a confirmation message, and never duplicate a transaction if they already received a confirmation message. (And force a fraudster to generate a quick confirmation message if they want to get any money.) I don't think digital signatures are mutually exclusive with reversible transactions.

skilled 3y ago

The original research, https://www.akamai.com/blog/security-research/sophisticated-phishing-campaign-targeting-hospitality https://www.akamai.com/blog/security-research/sophisticated-...

resolutebat 3y ago
The original research downplays that it's specifically Booking.com customers who are targeted here.
- hackernewds 3y ago
  The specific example in the article shows and states that a Booking.com site is emulated. That would be helpful info for a reader.
- skilled 3y ago
  Ok, I edited my comment to simply point to the original source.

heavenlyblue 3y ago

I am currently staying at a Steigenberger hotel in Luxor, Egypt. Their account on booking.com is hacked so badly that right at the moment booking is made they send you a message to not reply to any messages coming from them asking to pay on the website outside booking.com. Several months later they messaged me asking to pay on the dodgy website completely copying the UI of booking.com.

tetris11 3y ago

Any idea or motivation where all these hacks the last week are coming from?