Slashdot Mirror
Hacking Retail Gift Cards Remains Scarily Easy (wired.com)
Willium Caput, a researcher for the firm Evolve Security, examined a stack of gift cards he obtained from a major Mexican restaurant chain and noticed a pattern: aside from the final four digits of the cards that appeared to be random, the rest remained constant except one digit that appeared to increase by one with every card he examined. Andy Greenberg explains how Caput plans to defraud the system in his report via WIRED (Warning: source may be paywalled; alternative source): "You take a small sample of gift cards from restaurants, department stores, movie theaters, even airlines, look at the pattern, determine the other cards that have been sold to customers and steal the value on them," says Caput. To pull off the trick, Caput says he has to obtain at least one of the target company's gift cards. Unactivated cards often sit out for the taking at restaurants and retailers, or he can just buy one. (Not all cards change by a value of one, as that first Mexican restaurant did. But Caput says obtaining two or three cards can help to determine the patterns of those that don't.) Then he simply visits the web page that the store or restaurant uses for checking a card's value. From there, he runs the bruteforcing software Burp Intruder to cycle through all 10,000 possible values for the four random digits at the end of the card's number, a process that takes about 10 minutes. By repeating the process and incrementing the other, predictable numbers, the site will confirm exactly which cards have how much value. "If you can find just one of their gift cards or vouchers, you can bruteforce the website," he says.
Once a thief has determined those activated, value-holding card numbers, he or she can use them on the retailer's ecommerce page, or even in person; Caput's written them to a blank plastic card with a $120 magnetic-strip writing device available on Amazon, and found that most retailers accept his cards without questions. (Caput only asks the store or restaurant to check the card's balance, rather than spend any money from the cards belonging to actual victims.) "It's a pretty anonymous attack," Caput says. "I can go in, order food, and walk out. The person's card says it has $50 on it, and then it's gone." Caput said he plans to present his findings at the Toorcon hacker conference this weekend.
Once a thief has determined those activated, value-holding card numbers, he or she can use them on the retailer's ecommerce page, or even in person; Caput's written them to a blank plastic card with a $120 magnetic-strip writing device available on Amazon, and found that most retailers accept his cards without questions. (Caput only asks the store or restaurant to check the card's balance, rather than spend any money from the cards belonging to actual victims.) "It's a pretty anonymous attack," Caput says. "I can go in, order food, and walk out. The person's card says it has $50 on it, and then it's gone." Caput said he plans to present his findings at the Toorcon hacker conference this weekend.
with a hex editor last week giving my kid $100,000,000 so he could buy a cat directly. Should I apply for doing a in-depth presentation on Toorcon as well?
I guess if the gift card website even allows part of that to happen, someone should be fired ?
Walk into restaurant, in person, on camera, and obtain an unusual number of gift cards.
Send 10k suspicious requests to the gift card website from your home IP.
Go to restaurant again, in person, on camera, greet host, interact with waitstaff and/or customers, eat meal, use gift card.
Risk balance disappearing or true owner eating at same time/ day.
All this for a modest sum, unless you want to load up a suspicious amount.
Also do this with a blank card that would never be accepted for actual payment.
Yup, pretty anonymous.
Bluntly, the reason that these do not have better security is that, while the security is crap, the amount of fraud done against gift cards is relatively small (and a lot of the people who perpetrate the small amount of fraud they do find have not taken care and get caught)
As long as it costs companies less to fix and write off the fraud than it would cost to implement a more secure system, then they are likely to stick with the cheap, easy to hack system.
Since these gift cards have to be printed out individually anyway, couldn't they be produced using uuidgen (or the like)? Seems like a single algorithm would solve the problem for all retailers at once.
There's my suggestion.
figured out how to count
The restaurant chain will probably reward him for bringing it to their attention by giving him a gift card to the restaurant.
I've help some smarter vendors with this in the past but I would guess that the vast majority are still using a checksum. It makes the verification easy and most companies are not organized enough to keep track of the cards that don't have money on them.
Something very like this happened to me during the holidays last year. My manager gave me a $100 gift card, and when I went to use it the card had been drained. A colleague (who reported to the same manager) experienced the same thing. When we contacted the gift card company we were given the run around and didn't get our balances back. Nice of them isn't it? Pro tip: Make sure that they use the card immediately, order it online or give them cash instead :)
Donald... is that you?
News at 11. Who would have thought it, huh?
Seriously... what the fuck difference does it make that it's easy to do? It's still fucking illegal. Speeding is easy to do too, easier, I would dare say, by no less than at least an order of magnitude than this hack, but that doesn't mean that you shouldn't be responsible for it if you do it.
What's really sad about this is that the guy went out of his way to *deliberately* find a way to do something that anyone with half a brain should know is illegal.
I have no words....
File under 'M' for 'Manic ranting'
Most just hang on racks. "Borrow" them and copy the numbers. Or just take a picture. It's harder to do a bulk 10000 card search but the issue is still there. Some cards are now sold in cardboard envelopes. That's a partial solution.
All nice what he did, but I would be impressed if he would not cycle through them, but where able to determine these last 4. My bet is that there is some sort of verification used. No idea how the numbers are build, but I can imagine that they use any of the known verifications.
The fact that they increase by one is also normal. Having a random number (with verification) would need to be verified if it was not already handed out and if it where not already used.
So what verification was used? Standard Credit Card would already reduce the 10.000 to 100. And that would be with the most ones if they use the last two as control.
I can also imagine that these are handled by an external company and then you would get perhaps something like CompanyVoucherAmountVerification Some extra like branch could be in it as well, so to do some analysis on the vouchers coming in.
Don't fight for your country, if your country does not fight for you.
"Caput's written them to a blank plastic card with a $120 magnetic-strip writing device available on Amazon, and found that most retailers accept his cards without questions."
This is the scary part. And obviously counterfeit gift card, but accepted without question because it could be swipped?
Would the retailer accept obviously counterfeit cash just because it said "Cash" on it?
The managers SHOULD take the case of cards and shuffle them.
Better yet, the warehouse SHOULD shuffle the year's supply.
Thus, finding the pattern would not be so easy.
Having worked with Credit, Debit and Gift Card processors they have security in place to make any gift card number void if it is ever had the balance checked before the card is activated. Also the online balance check would require the four digit security code which is random and only known to the processor. This might only work if a retail company was using an in-house card program and didn't implement their own security protections.
My wife and I both had debit cards, and hers was exactly mine + 1. In reality that means the last two digits were changed since the last digit is the checksum. I always wondered, though, if all their cards were numbered serially, since it would then be trivial to come up with a list of card numbers. With a three digit CVV it would be as easy to guess card numbers based on a single CVV value as vice versa.
Do you have ESP?
Require the CSC or CVV2 for balance requests. THAT is not predictable, so far as I can see.
There are a multitude of reasons why cards have predictable numbering, and none of these are going away. Just use the existing security (CVV2CSC) and let the fraud checking and auth systems do their work.
deleting the extra space after periods so i can stay relevant, yeah.
News flash: Being a thief is not difficult. That any particular thievery is based on technology does not make it cool, intrinsically interesting, or OK.
I can think of dozens ways to steal things that are "scarily easy". Like knocking down an old lady and grabbing her purse.
The second thing would be to put a time-activation lock on numbers tried by ip address
So the criminal just switches to one of the other 18 quintillion IP addresses that his IPv6-aware ISP hands out.
The only real solution is a good quality captcha
If handled poorly, that's a good way to get sued by blind advocacy groups. See National Federation of the Blind v. Target Corp.
BE SMART AND BECOME RICH IN LESS THAN 3 DAYS....It all depends on how fast you can be to get the new PROGRAMMED blank ATM card that is capable of hacking into any ATM machine, anywhere in the world. I got to know about this BLANK ATM CARD when I was searching for job online about a month ago.. It has really changed my life for good and now I can say I'm rich and I can never be poor again. The least money I get in a month with it is about $50,000.(fifty thousand USD). Everyday I keep pumping money into my account. Though it is illegal, there is no risk of being caught, because it has been programmed in such a way that it is not traceable, it also has a technique that makes it impossible for the CCTV's to detect you.. For details on how to get yours today, email the hackers on: johnhart0022@gmail.com. Tell your loved ones too, and start to live large. That's the simple testimony of how my life changed for good... Love you all... The email address again is johnhart0022@gmail.com