Slashdot Mirror
Hacking Retail Gift Cards Remains Scarily Easy (wired.com)
Willium Caput, a researcher for the firm Evolve Security, examined a stack of gift cards he obtained from a major Mexican restaurant chain and noticed a pattern: aside from the final four digits of the cards that appeared to be random, the rest remained constant except one digit that appeared to increase by one with every card he examined. Andy Greenberg explains how Caput plans to defraud the system in his report via WIRED (Warning: source may be paywalled; alternative source): "You take a small sample of gift cards from restaurants, department stores, movie theaters, even airlines, look at the pattern, determine the other cards that have been sold to customers and steal the value on them," says Caput. To pull off the trick, Caput says he has to obtain at least one of the target company's gift cards. Unactivated cards often sit out for the taking at restaurants and retailers, or he can just buy one. (Not all cards change by a value of one, as that first Mexican restaurant did. But Caput says obtaining two or three cards can help to determine the patterns of those that don't.) Then he simply visits the web page that the store or restaurant uses for checking a card's value. From there, he runs the bruteforcing software Burp Intruder to cycle through all 10,000 possible values for the four random digits at the end of the card's number, a process that takes about 10 minutes. By repeating the process and incrementing the other, predictable numbers, the site will confirm exactly which cards have how much value. "If you can find just one of their gift cards or vouchers, you can bruteforce the website," he says.
Once a thief has determined those activated, value-holding card numbers, he or she can use them on the retailer's ecommerce page, or even in person; Caput's written them to a blank plastic card with a $120 magnetic-strip writing device available on Amazon, and found that most retailers accept his cards without questions. (Caput only asks the store or restaurant to check the card's balance, rather than spend any money from the cards belonging to actual victims.) "It's a pretty anonymous attack," Caput says. "I can go in, order food, and walk out. The person's card says it has $50 on it, and then it's gone." Caput said he plans to present his findings at the Toorcon hacker conference this weekend.
Once a thief has determined those activated, value-holding card numbers, he or she can use them on the retailer's ecommerce page, or even in person; Caput's written them to a blank plastic card with a $120 magnetic-strip writing device available on Amazon, and found that most retailers accept his cards without questions. (Caput only asks the store or restaurant to check the card's balance, rather than spend any money from the cards belonging to actual victims.) "It's a pretty anonymous attack," Caput says. "I can go in, order food, and walk out. The person's card says it has $50 on it, and then it's gone." Caput said he plans to present his findings at the Toorcon hacker conference this weekend.
I guess if the gift card website even allows part of that to happen, someone should be fired ?
Bluntly, the reason that these do not have better security is that, while the security is crap, the amount of fraud done against gift cards is relatively small (and a lot of the people who perpetrate the small amount of fraud they do find have not taken care and get caught)
As long as it costs companies less to fix and write off the fraud than it would cost to implement a more secure system, then they are likely to stick with the cheap, easy to hack system.
Since these gift cards have to be printed out individually anyway, couldn't they be produced using uuidgen (or the like)? Seems like a single algorithm would solve the problem for all retailers at once.
The restaurant chain will probably reward him for bringing it to their attention by giving him a gift card to the restaurant.
I've help some smarter vendors with this in the past but I would guess that the vast majority are still using a checksum. It makes the verification easy and most companies are not organized enough to keep track of the cards that don't have money on them.
Something very like this happened to me during the holidays last year. My manager gave me a $100 gift card, and when I went to use it the card had been drained. A colleague (who reported to the same manager) experienced the same thing. When we contacted the gift card company we were given the run around and didn't get our balances back. Nice of them isn't it? Pro tip: Make sure that they use the card immediately, order it online or give them cash instead :)
Well that's the difference between a white hat researcher who's trying to demonstrate a point, and a nefarious actor who's trying to commit fraud...
Someone out to commit fraud will not take the cards to the restaurant themselves, instead they'll do other things with gift cards like:
Spend them online to have goods sent to a suitably anonymous location.
Recruit mules to do the risky work of actually using the cards in person.
Sell the cards to unsuspecting third parties.
And probably do all of these things while operating in a country outside of the reach of the law enforcement agencies that their victims are likely to contact.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
I'm guessing you don't own a business or have ever worked front of house at a nice restaurant. Walking in and buying a 1000 dollars worth of gift cards happens more often than you think and is not out of the ordinary. Shit just a couple months ago I bought 500 bucks in Tim Hortons gift cards.
News at 11. Who would have thought it, huh?
Seriously... what the fuck difference does it make that it's easy to do? It's still fucking illegal. Speeding is easy to do too, easier, I would dare say, by no less than at least an order of magnitude than this hack, but that doesn't mean that you shouldn't be responsible for it if you do it.
What's really sad about this is that the guy went out of his way to *deliberately* find a way to do something that anyone with half a brain should know is illegal.
I have no words....
File under 'M' for 'Manic ranting'
Most just hang on racks. "Borrow" them and copy the numbers. Or just take a picture. It's harder to do a bulk 10000 card search but the issue is still there. Some cards are now sold in cardboard envelopes. That's a partial solution.
All nice what he did, but I would be impressed if he would not cycle through them, but where able to determine these last 4. My bet is that there is some sort of verification used. No idea how the numbers are build, but I can imagine that they use any of the known verifications.
The fact that they increase by one is also normal. Having a random number (with verification) would need to be verified if it was not already handed out and if it where not already used.
So what verification was used? Standard Credit Card would already reduce the 10.000 to 100. And that would be with the most ones if they use the last two as control.
I can also imagine that these are handled by an external company and then you would get perhaps something like CompanyVoucherAmountVerification Some extra like branch could be in it as well, so to do some analysis on the vouchers coming in.
Don't fight for your country, if your country does not fight for you.
"Caput's written them to a blank plastic card with a $120 magnetic-strip writing device available on Amazon, and found that most retailers accept his cards without questions."
This is the scary part. And obviously counterfeit gift card, but accepted without question because it could be swipped?
Would the retailer accept obviously counterfeit cash just because it said "Cash" on it?
I'm guessing you don't own a business or have ever worked front of house at a nice restaurant.
I was thinking the same thing. My employer easily gives out a thousand dollars worth of Dunkin' Donuts gifts cards each month to employees as part of various incentive programs (the Dunkin' cards are the runner-up prizes)
"His name was James Damore."
Having worked with Credit, Debit and Gift Card processors they have security in place to make any gift card number void if it is ever had the balance checked before the card is activated. Also the online balance check would require the four digit security code which is random and only known to the processor. This might only work if a retail company was using an in-house card program and didn't implement their own security protections.
My wife and I both had debit cards, and hers was exactly mine + 1. In reality that means the last two digits were changed since the last digit is the checksum. I always wondered, though, if all their cards were numbered serially, since it would then be trivial to come up with a list of card numbers. With a three digit CVV it would be as easy to guess card numbers based on a single CVV value as vice versa.
Do you have ESP?
Require the CSC or CVV2 for balance requests. THAT is not predictable, so far as I can see.
There are a multitude of reasons why cards have predictable numbering, and none of these are going away. Just use the existing security (CVV2CSC) and let the fraud checking and auth systems do their work.
deleting the extra space after periods so i can stay relevant, yeah.
News flash: Being a thief is not difficult. That any particular thievery is based on technology does not make it cool, intrinsically interesting, or OK.
I can think of dozens ways to steal things that are "scarily easy". Like knocking down an old lady and grabbing her purse.
The second thing would be to put a time-activation lock on numbers tried by ip address
So the criminal just switches to one of the other 18 quintillion IP addresses that his IPv6-aware ISP hands out.
The only real solution is a good quality captcha
If handled poorly, that's a good way to get sued by blind advocacy groups. See National Federation of the Blind v. Target Corp.