Slashdot Mirror
OnePlus Customers Report Credit Card Fraud After Buying From the Company's Website (androidpolice.com)
If you purchased a OnePlus smartphone recently from the official OnePlus website, you might want to check your transactions to make sure there aren't any you don't recognize. "A poll was posted on the OnePlus forum on Thursday asking users if they had noticed fraudulent charges on their credit cards since purchasing items on the OnePlus site," reports Android Police. "More than 70 respondents confirmed that they had been affected, with the majority saying they had bought from the site within the past 2 months." From the report: A number of FAQs and answers follow, in which OnePlus confirms that only customers who made credit card payments are affected, not those who used PayPal. Apparently, card info isn't stored on the site but is instead sent directly to a "PCI-DSS-compliant payment processing partner" over an encrypted connection. [...] OnePlus goes on to say that intercepting information should be extremely difficult as the site is HTTPS encrypted, but that it is nevertheless carrying out a complete audit. In the meantime, affected customers are advised to contact their credit card companies immediately to get the payments canceled/reversed (called a chargeback). OnePlus will continue to investigate alongside its third-party service providers, and promises to update with its findings as soon as possible.
According to infosec firm Fidus, there is actually a brief window in which data could be intercepted. Between entering your card details into the form and hitting 'submit,' the details are apparently hosted on-site, which could give attackers all the time they need to steal those precious digits and head off on a spending spree. Fidus also notes that the company doesn't appear to be PCI-compliant, but that directly contradicts OnePlus' own statement. We'll have to wait until more details emerge before we pass judgment. Here's OnePlus' official statement on the matter: "At OnePlus, we take information privacy extremely seriously. Over the weekend, members of the OnePlus community reported cases of unknown credit card transactions occurring on their credit cards post purchase from oneplus.net. We immediately began to investigate as a matter of urgency, and will keep you updated. This FAQ document will be updated to address questions raised."
According to infosec firm Fidus, there is actually a brief window in which data could be intercepted. Between entering your card details into the form and hitting 'submit,' the details are apparently hosted on-site, which could give attackers all the time they need to steal those precious digits and head off on a spending spree. Fidus also notes that the company doesn't appear to be PCI-compliant, but that directly contradicts OnePlus' own statement. We'll have to wait until more details emerge before we pass judgment. Here's OnePlus' official statement on the matter: "At OnePlus, we take information privacy extremely seriously. Over the weekend, members of the OnePlus community reported cases of unknown credit card transactions occurring on their credit cards post purchase from oneplus.net. We immediately began to investigate as a matter of urgency, and will keep you updated. This FAQ document will be updated to address questions raised."
â
To be fair, if you bought Apple you have already been scammed. No point in scamming someone twice.
This is exactly why, despite their other practices, I use paypal to buy things.
Sure, the company is shady in their own right, however I still trust PP more than most online retailers. So I pay with PP (or Amazon if that's a choice).
if the problem didn’t arise due to the end-user (e.g. password reuse from some other compromised sites), a OnePlus server compromise seems more likely than data being intercepted in transit. Although I guess you could call that “intercepted data” too, in a manner of speaking.
#DeleteChrome
"OnePlus Customers Report Credit Card Fraud After Buying From the Company's Website"
or
"OnePlus customers report credit card fraud after buying from the company's website"
Which is easier to read? Which is pretentious? Why does Slashdot need to be pretentious? Year after year they assault us with these stupid 1920 style headlines that are hard to decode.
...omphaloskepsis often...
Everyone else is doing it so why can't we?
If people used sane web browsers (those that don't support arbitrary remote code execution and show the URL to which a form will be submitted), then this wouldn't have happened.
The first time they sent the new card number to most businesses who had the old number. Unsurprisingly there were more fraudulent charges on the new card within two weeks.
I did buy a OnePlus phone last year, though not within the last two months.
Do you all see why it is I started using cash for everything I possibly can? Because 'data breaches' like this keep happening, and there's no end in sight.
For all in-person purchases possible I use cash.
The next step in my overall strategy will be to find a prepaid debit card (i.e. not linked to any of my accounts) that I can recharge when I need to make online purchases. Put just enough money in it to do what I need to do. If it gets compromised, cut it up and get another one.
Pre-emptive strike on (the usual) comments:
* Don't care if you think 'carrying cash is dangerous'. Never been robbed, don't go anywhere I'd get robbed, don't give a damn what you say about it.
* Don't care what you say about 'the world going cashless' and neither do I beleive it'll happen anyway; don't bother even saying it won't discuss it.
* Don't give a damn about your personal insults (calling me a 'luddite', which is totally inaccurate, calling me an 'old man', or whatever). You're wasting your time won't even read your silly insults just save yourself the time.
* Don't care if you think I'm paranoid. Doesn't affect you, why should you even care, mind your own business. See above: 'Insults'.
* Do you just argue to argue? Nothing better to do? Get another hobby, not interested in being your entertainment.
* Not telling any of you to carry cash, calm the hell down, do whatever you want -- but be aware of YOUR risk factor.
* Trollololol? Go away, you've been spotted.
Between entering your card details into the form and hitting 'submit,' the details are apparently hosted on-site
This doesn't make sense. When you enter your CC details into the form they haven't left your browser, unless there is some Javascript grabbing those details. If that is the case then the site has been compromised.
(\(\
(^.^)
(")")
*This is the cute bunny virus, please copy this into your sig so it can spread
Thanks for posting this, I purchased a OnePlus on 12/19, and sure enough 1/11 and 1/12 have fraudulent charges.
Probably not coincidentally, I've had a fraudulent order placed at Walmart.com on 1/10 and had someone attempt to hijack my Spotify account on 1/11, all of which use the same email/password combination as the OnePlus site. I had a feeling that some site must have been compromised and stored there details in plain text...
But their intentions seem better than most companies. Can you imagine Samsung, LG, or Apple admitting possible fault and noting that they're investigating it? Not a chance, unless the issue was all over the news. The whole generation of LG G4 phones had a motherboard flaw which caused most of them to fry after six months, and LG didn't even affordable repair. You were totally out of luck, unless you bought it with a warranty. (Depending on the country, phones are sometimes sold without a warranty.) Manufacturer defects do not normally require a warranty--this is like when you buy a TV, take it home, and find it doesn't work the next day. But did LG do the right thing? No.
Another good example of fixing its mistake: when their Android O release was ready, the OTA installer accidentally made data hard to access/recover for users with an unlocked bootloader. In the next OTA update, they put a warning message in that explained what users with unlocked bootloaders should do to prevent problems. Another manufacturer would simply have decided those users don't matter because we're in the minority.
A cat can't teach a dog to bark.
But they have already scammed people 12 times.
Maybe not, but I've definitely not hired people who prefer to develop on Macs. They are universally incompetent, often smug, and always condescending.
HTTPS is Not secure. To make it secure you need certificate pinning or you are suspectible to mitm.
What I would like is that either 2tier security, where they send me an SMS with a code to congirm, is either the persons choice or obligatory for every purchase.
At this moment it is not. It is up to the merchant. That together with a PIN would make it very hard to use the card, even if you have the number.
I already have 'save CC details' off where I can.
Don't fight for your country, if your country does not fight for you.
In a poll of people that recently suffered credit card fraud, 100% of them had within the previous month been breathing air.
In a poll of Slashdot users, 100% of those that suffered credit card fraud had recently been using Slashdot.
Sorry but 'closed community finds out that the thing they share in common with people in that community is the community' is hardly fucking devastating evidence of something.
using cash for everything I possibly can? {...} For all in-person purchases possible I use cash.
Great idea, except that's going to be hard in a world where nearly all transaction with significant amount are done online.
At least where I live, most of the time in-person cash purchase are only used for transaction like buying coffee from the corner shop.
Want to pay rent ? e-banking money transfer.
Want to buy some big piece of equipment ? Credit-card, paypal or money-transfer. VERY few of the online shop send actual bill that you can pay at the post-office counter.
etc.
The next step in my overall strategy will be to find a prepaid debit card (i.e. not linked to any of my accounts) that I can recharge when I need to make online purchases. Put just enough money in it to do what I need to do.
...which is the way most decent credit cards work here around. (Europe).
They either prepaid (but the issuing bank usually takes a nice cut on each recharge).
Or just entirely different banking accounts (it doesn't tap into your normal salary account, if it maxes out, it's just *that* separate account getting maxed out).
Also speaking about decent credit cards : what you even more definitely need is some form of 2-factors authentication / out-of-band transation confirmation.
e.g.: One of my cards provider has an app that I install on my smartphone. Whenever I do any significant transaction (either single big amount, or several small transaction), I need to confirm it with the app.
If the credit cards gets compromised: well, good luck doing anything with it (I'll certainly NOT authorise your transaction, though you might manage to get away with the 2 first coffees you pay contact less).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I guess the recent /. spam posts linking to the oneplus website were bait for this...
They take user privacy in such a regard that CA's blacklisted for issuing certs on behalf of google are trusted in their ROMs.