Slashdot Mirror
Crooks Need Just Six Seconds To Guess A Credit Card Number (independent.co.uk)
schwit1 quotes The Independent: Criminals can work out the card number, expiration date, and security code for a Visa debit or credit card in as little as six seconds using guesswork, researchers have found...
Fraudsters use a so-called Distributed Guessing Attack to get around security features put in place to stop online fraud, and this may have been the method used in the recent Tesco Bank hack...
According to a study published in the academic journal IEEE Security & Privacy, fraudsters could use computers to systematically fire different variations of security data at hundreds of websites simultaneously. Within seconds, by a process of elimination, the criminals could verify the correct card number, expiration date and the three-digit security number on the back of the card.
One of the researchers explained this attack combines two weaknesses into one powerful attack. "Firstly, current online payment systems do not detect multiple invalid payment requests from different websites... Secondly, different websites ask for different variations in the card data fields to validate an online purchase. This means it's quite easy to build up the information and piece it together like a jigsaw puzzle."
According to a study published in the academic journal IEEE Security & Privacy, fraudsters could use computers to systematically fire different variations of security data at hundreds of websites simultaneously. Within seconds, by a process of elimination, the criminals could verify the correct card number, expiration date and the three-digit security number on the back of the card.
One of the researchers explained this attack combines two weaknesses into one powerful attack. "Firstly, current online payment systems do not detect multiple invalid payment requests from different websites... Secondly, different websites ask for different variations in the card data fields to validate an online purchase. This means it's quite easy to build up the information and piece it together like a jigsaw puzzle."
WTF is going on with the verification process? If the card hits verification even 10 times in the same minute from different sites it should be locked up. Crappy back end.
when will you realize that every site that uses this popup window trick is a menace and must be shut down?
Brute-forcing arbitrary card numbers from hundreds of different sites cannot be mitigated, but doing the same for a single number should be quite easy to spot and block. Even setting a timeout of, say 15 minutes, after 3 incorrect attempts would probably be enough to spot the unusual behavior before correct details are guessed. A more robust way would be to force two-factor authentication for all online purchases, rendering knowing random card details useless.
Doesn't the online verification process use an address? I don't see that mentioned here.
The article didn't mention billing address, but I don't think I've ever entered my credit card number into any website that didn't include billing address as a set of required fields. Shipping address is always an additional set of optional fields.
Now, I suppose if the backend doesn't validate billing address then you could use a fake addresses for the brute force part of the job, but when you go to use the card isn't a fake billing address going to be a dead giveaway that the transaction was a fraud and therefore guarantee a successful charge back with zero questions?
But if Visa has any sense they ought to require billing address verification as part of the preauthorization step for all card not present transactions.
I find it hard to believe that they are able to guess my number in 6 seconds. Anyone can guess A single number, and verify if it's a credit card number. And then guess the exp and security codes. The summary is very sensational.
-- these are only opinions and they might not be mine.
This is a good opportunity to talk about why security through obscurity is bad:
Your typical credit card number has a theoretical 16 digits that are available. That's a huge number (9,999,999,999,999,999) that makes it look effectively impossible to guess. Let's pare that number down to size.
First, you aren't guessing anywhere near 16 digits. It turns out there's a lot you already know (1st digit is 4 for visa, 5 for mastercard etc.). That reduces the typical address space from 16 to 15 digits. That first number turns out to actually just be part of the bank identification number which is typically 6 digits long. All of the rest of it except for last digit is the actual account number. The last number itself is used for a checksum (Luhn) that is used to verify the number is good.
In other words to get the account number right you've only got an address space of 999,999,999. That's a significant reduction in magnitude to start with. Now let's go back to that Luhn checksum (it isn't a hash). Due to this detail you can easily validate the number to make sure that you haven't mistyped it (Luhn precedes using magnetic tape for credit cards).
The Luhn check uses a Mod 10 algorithm that excludes 90% of the previous address space. You now have 99,999,999 numbers to guess against. Your malicious actor isn't starting work in a quadrillion space number, they're working in the millions. All of that is just from the industry standards themselves. Now remember that each bank is going to have their own formulas for generating credit card numbers and that card thieves have data sets of the tens of millions - old dumps are good for providing data that can show patterns. This is a good example of how data at the aggregate level carries risk that it doesn't at the micro level.
Chances are the account number for the card itself isn't at all random. Chances are really good that the formulas used to generate these numbers for a number of large popular banks have been reverse engineered by any number of parties. You also have policies at many banks such as never reusing a number that also reduce this address space. All the malcious actor has to do is look for patterns. Patterns have a way of reducing the order of magnitude once you learn them.
The expiration dates themselves are typically within 2 years giving a range of only 24 to pick from for the typical transaction. Guess a valid account number, try it at 24 websites and chances are really good one of them will work. That leaves the CVC2 number itself, which of course isn't random either.
The system is broken, it's just a matter of time before industry must recalibrate how it works.
More below for those who are curious:
http://www.creditcards.com/cre...
http://datagenetics.com/blog/j...
http://www.darkcoding.net/cred...
http://blog.opensecurityresear...
http://www.ibm.com/support/kno...
It sounds from the article like having Mastercard would mitigate the attack since they use a centralized system.
It's almost 2017 and banks that still don't enforce two-factor authentication are just begging to be hacked.
rate control at the root check node
Geez.... they can't guess your CC# - only your CVV and Expiration Date in 6 seconds.
The headline is grossly incorrect clickbait. Shame on you, Slashdot, but I know EditorDavid has no shame, nor any journalistic integrity.
Kudos to EditorDavid for posting some interesting articles, rather than trolling political fight bait. I was about to give up on /., but maybe there's hope.
I've lived happily for decades without that movie entering my mind, and then you come long. THX!
Here in India I'm required to enter an OTP sent to my mobile, for my other card provider I'm redirected to a website which asks for a password I have preset earlier on the bank website.. why is this so hard?
Uh, sure - if you have a valid card number as a starting point, the other data points are trivial... But if you don't, "guessing" the remaining 10 digits of a valid credit card number quickly becomes a non-trivial task because the only way to separate a "correct" credit card number (which can be proven algorithmically) from a validly-issued credit card is to supply the proposed "correct" credit card number to multiple sites with all 60 possible expiry dates and each of the nearly one thousand CVV numbers from the back... (See below)
So, when the headline says "Credit Card" they only mean Visa, everyone else blocks cards after as few as a dozen failed attempts, and the key ingredient to "cracking" a credit card is to start with a valid credit card number, all 16 digits, then find a list of e-commerce websites that will let you keep pitching hundreds and hundreds of credit card transactions at them so you can go through all 60,000 combination of expiry date and CVV to find the right one. Oh, then you need to make sure the attempted purchase in under the card's available spending limit.
But hey, yeah, credit cards are easy to brute-force hack, if you start with a valid, active, complete 16 digit credit card number - as long as it is a Visa card and Visa doesn't update their software.
Ken
But wouldn't this 'attack' be really trivial to detect on the credit card processor's side? There isn't a legitimate use case that would explain multiple attempts at the same time?
Basically some payment systems allow 10-20 human errors per valid card number before triggering a fraud alert. 10 seems understandable for all those old folks with arthritis and poor eyesight. 20 seems like someone didn't know what they were doing or didn't change it during deployment from QA.
So what the article is saying is that it is theoretically possible for someone to write a program to submit random numbers to various sites and by the law of big numbers, figure out a valid CC & data in under 6 seconds.
Not really a big return there. Nor can this be used in mass, eventually the payment systems will see you as spam and if not them, the upstream will block the payment system because it is sending in too many invalid queries.
Even with a CC number, usage would still need to go through the rest of the fraud detection system. If this ever becomes a problem the obvious immediate answer is to lower the attempts to 5-10 or block repeat attempts for x seconds.
There are easier ways to get a lot more card numbers...
You can ask your card service to set up requirements, like checking signature, ID check, etc. Most people don't because they don't want to to be inconvenienced.
Think DDoS. If there is a threshold of N false tries for locking a card with a given cardnumber it only takes N*1000000 tries to lock one million cards. It would not be much of a challenge for someone with a botnet to keep millions of cards locked 24/7 just for fun.
How many of the tens of thousands of small businesses on whose websites crooks are trying millions of credential combinations can afford an annual subscription to said "commercially available data validation software packages"?
Whenever I use my credit card I have to authorize each transaction on my smartphone. Even if a thief stole my wallet, as long as they don't have my unlocked phone they can't use my credit card anyways,.
https://www.youtube.com/watch?...
Fascism: An authoritarian and nationalistic right-wing system of government and social organization. See also: NAZI's