Guessing Credit Card Security Details
Researchers have found that they can guess various credit-card-number security details by spreading their guesses around multiple websites so as not to trigger any alarms.
From a news article:
Mohammed Ali, a PhD student at the university’s School of Computing Science, said: “This sort of attack exploits two weaknesses that on their own are not too severe but when used together, present a serious risk to the whole payment system.
“Firstly, the current online payment system does not detect multiple invalid payment requests from different websites.
“This allows unlimited guesses on each card data field, using up to the allowed number of attempts—typically 10 or 20 guesses—on each website.
“Secondly, different websites ask for different variations in the card data fields to validate an online purchase. This means it’s quite easy to build up the information and piece it together like a jigsaw.
“The unlimited guesses, when combined with the variations in the payment data fields make it frighteningly easy for attackers to generate all the card details one field at a time.
“Each generated card field can be used in succession to generate the next field and so on. If the hits are spread across enough websites then a positive response to each question can be received within two seconds—just like any online payment.
“So even starting with no details at all other than the first six digits—which tell you the bank and card type and so are the same for every card from a single provider—a hacker can obtain the three essential pieces of information to make an online purchase within as little as six seconds.”
That’s card number, expiration date, and CVV code.
From the paper:
Abstract: This article provides an extensive study of the current practice of online payment using credit and debit cards, and the intrinsic security challenges caused by the differences in how payment sites operate. We investigated the Alexa top-400 online merchants’ payment sites, and realised that the current landscape facilitates a distributed guessing attack. This attack subverts the payment functionality from its intended purpose of validating card details, into helping the attackers to generate all security data fields required to make online transactions. We will show that this attack would not be practical if all payment sites performed the same security checks. As part of our responsible disclosure measure, we notified a selection of payment sites about our findings, and we report on their responses. We will discuss potential solutions to the problem and the practical difficulty to implement these, given the varying technical and business concerns of the involved parties.
BoingBoing post:
The researchers believe this method has already been used in the wild, as part of a spectacular hack against Tesco bank last month.
MasterCard is immune to this hack because they detect the guesses, even though they’re distributed across multiple websites. Visa is not.
Subscribe to comments on this entry
Stan Smith • December 5, 2016 7:41 AM
Another attack vector may be automated scripting to 1800 authorization systems.