Crooks Need Just Six Seconds To Guess A Credit Card Number (independent.co.uk) 110
schwit1 quotes The Independent: Criminals can work out the card number, expiration date, and security code for a Visa debit or credit card in as little as six seconds using guesswork, researchers have found...
Fraudsters use a so-called Distributed Guessing Attack to get around security features put in place to stop online fraud, and this may have been the method used in the recent Tesco Bank hack...
According to a study published in the academic journal IEEE Security & Privacy, fraudsters could use computers to systematically fire different variations of security data at hundreds of websites simultaneously. Within seconds, by a process of elimination, the criminals could verify the correct card number, expiration date and the three-digit security number on the back of the card.
One of the researchers explained this attack combines two weaknesses into one powerful attack. "Firstly, current online payment systems do not detect multiple invalid payment requests from different websites... Secondly, different websites ask for different variations in the card data fields to validate an online purchase. This means it's quite easy to build up the information and piece it together like a jigsaw puzzle."
According to a study published in the academic journal IEEE Security & Privacy, fraudsters could use computers to systematically fire different variations of security data at hundreds of websites simultaneously. Within seconds, by a process of elimination, the criminals could verify the correct card number, expiration date and the three-digit security number on the back of the card.
One of the researchers explained this attack combines two weaknesses into one powerful attack. "Firstly, current online payment systems do not detect multiple invalid payment requests from different websites... Secondly, different websites ask for different variations in the card data fields to validate an online purchase. This means it's quite easy to build up the information and piece it together like a jigsaw puzzle."
Why can't this be detected (Score:5, Insightful)
WTF is going on with the verification process? If the card hits verification even 10 times in the same minute from different sites it should be locked up. Crappy back end.
Re: (Score:2)
Indeed quite hard to believe. They just though of the situation where someone would keep guessing the number on the same website, but never thought someone might try different websites. Because, you know, it takes a whole lot of effort to open up a different website...
What I'm wondering, though, is how they can guess all the numbers. Sure, the useless three-digit protection code on the back of the card only takes 1000 guesses in the worst case. And the number of expiration dates is even less, 60 or so. But
Re: (Score:2, Informative)
One digit for typo checking. See Luhn algorithm [wikipedia.org].
Re: (Score:3)
that still leaves 100 million codes to check. Were they using 10 million e-commerce sites?
What you are missing is that they don't have to guess a specific number, just a valid number. So if there are 9 unknown digits, and Bank of America has 10 million customers, it will, on average, only take 100 guesses to get a hit.
Re: (Score:1)
But what about the name on the card, then? Doesn't that have to be correct?
Re:Why can't this be detected (Score:4, Interesting)
But what about the name on the card, then? Doesn't that have to be correct?
Many merchants do not verify the name. I recently made an online purchase and wanted it shipped to a friend, and I inadvertently set both the shipping and billing address to my friend's name and address. The transaction went through.
So some merchants verity the name, but not the CCV.
Some validate the CCV but not the name.
Some check the zipcode, others do not.
Re: (Score:2)
If the card does not go through (due to some minor mistype or similar) I just buy the stuff somewhere else.
As long as their share for the fraud cost is lower than revenue on extra sales for being convenient, they will continue being convenient.
Re: (Score:1)
Re: (Score:3)
If the card hits verification even 10 times in the same minute from different sites it should be locked up.
That seems like a simple, obvious solution. But it is not. Millions of credit card numbers would be "locked up" everyday, causing massive inconvenience for the card holders. The crooks could also just spread out their attempts to keep below the threshold, so instead of making a lot of attempts with one CC number before moving to the next CC number on the list, they would sweep through the list, making a few attempts each.
Re: Why can't this be detected (Score:2)
That is what "3D Secure" does. It allows the bank to implement whatever additional verification they want during the credit card transaction. In early implementations I saw additional passwords, but most banks in my country currently use SMS-based OTPs.
The banks have been enforcing the use of 3D-Secure or threatening to suspend merchants.
As usual, the U.S. is behind most of the world ...
Re: (Score:2)
That shouldn't cause a lot of false lockups since it has to be different sites. How often do you even use your credit card on 2 different sites within one minute?
The real issue is, as you say, the crooks will just go low and slow to avoid the lockout. It's the same problem with password guessing. Since they don't care which particular card is solved when, they can just do many in parallel, all just below the lockout threshold and still solve cards at a high rate.
Re: Why can't this be detected (Score:2)
Many credit card companies simply don't care about fraud. If fraudulent charges happen, they reverse the charges (leaving the merchant out the cost of whatever was bought).
My identity was stolen and Capital One let the account get opened despite numerous red flags (starting with an incorrect mother's maiden name ). When I notified them of the fraud, they gave me the runaround and asked if the account was actually opened by my wife without telling me. Then, they stonewalled both me and the police to prote
Re: (Score:2)
Many credit card companies simply don't care about fraud. If fraudulent charges happen, they reverse the charges (leaving the merchant out the cost of whatever was bought).
They also ding the merchant with a "charge-back" fee of about $25, although it actually costs the banks almost nothing to process. The banks actually benefit from CC fraud, which is why they are not proactive about preventing it. Consumers are ripped off if they don't notice the charges, but most of the cost is dumped onto the merchants, who are powerless to fix the problem.
Re: (Score:2)
If the merchant is in the US and moved to chip and signature, then in-person fraud is on the bank.
Re: (Score:1)
And how do you make a website that reads chips on customer's credit cards? (without requiring a special card reader, with dozens of different incompatible types to choose from)
Re:Why can't this be detected (Score:5, Informative)
Read the linked-to article, only Visa is vulnerable, MasterCard and others detect the widespread fraud after a few attempts and shut it down.
Re: Why can't this be detected (Score:2)
Because the 16 digit CC stays the same as you brute force guess the 1,000 possible CVC codes and 60 possible expiration month/year combination...
Site A gets 1111 2222 3333 4444 12/16 000
Site B gets 1111 2222 3333 4444 12/16 001
Site C gets 1111 2222 3333 4444 12/16 002
Site D gets 1111 2222 3333 4444 12/16 003
And, assuming 1111 2222 3333 4444 is a valid card number, the central computers at MasterCard notice a pattern and block that card for suspected fraud...
Re: (Score:3)
No safe-guards? (Score:1)
Re: (Score:2)
"verified By VISA" uses a two-factor authentication. I get a code by text I have to enter whenever I use my VISA on a website that have it enabled.
I really think a system like that should be mandatory for online sales and not just optional.
Of course, there are circumstances where two-factor might not be feasible, but at the very least have two-factor enabled by default and disable it where necessary and with good reason.
Re: (Score:2)
It should be possible to mitigate this almost completely. You create a secure phrase in advance that appears on the 3D-Secure verification page. This page will only load if given a copy of a token granted by the initial authorization request, so it would be impossible to MITM without compromising the actual authorization handling code on the server side. Injected scripts would not do it. The 3D-Secure page should also open communication back to the originating server to verify the page load is valid.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
I really think a system like that should be mandatory for online sales and not just optional.
It may be overkill for ALL online transactions. For instance, if I have bought from an online merchant before, and the shipping address matches my billing address, then it very unlikely to be fraud. But if the transaction is for a first time gold bullion purchase shipped to Moldavia, then sure, a text message is a good idea.
Re: (Score:2)
Re: (Score:2)
Why not just build 2 factor authentication into the card itself? They could offer a card with an in-built RSA token or a way to use a smartphone app for cards without token hardware.
Something tells me this is something we should have, but given the sparring and profiteering over getting chip enabled terminals in the US (I'm STILL swiping at many terminals). I suspect that it's not the two factor part that keeps it from happening but the terminals and merchant software costs combined with a bunch of middl
Address (Score:1)
Billing address? (Score:3)
The article didn't mention billing address, but I don't think I've ever entered my credit card number into any website that didn't include billing address as a set of required fields. Shipping address is always an additional set of optional fields.
Now, I suppose if the backend doesn't validate billing address then you could use a fake addresses for the brute force part of the job, but when you go to use the card isn't a fake billing address going to be a dead giveaway that the transaction was a fraud and therefore guarantee a successful charge back with zero questions?
But if Visa has any sense they ought to require billing address verification as part of the preauthorization step for all card not present transactions.
Re: (Score:2)
In some countries, people are allowed to change their address. This is called "moving" there. What about the people who can and do that?
Re: (Score:2)
On top of which, comparing addresses can be non-trivial. Is "37-3 St Simeon Ln, L.A., CA" the same address as "37 Saint Simeon Lane, Los Angeles, Calif, Apt 3?"
Re: (Score:2)
On top of which, comparing addresses can be non-trivial. Is "37-3 St Simeon Ln, L.A., CA" the same address as "37 Saint Simeon Lane, Los Angeles, Calif, Apt 3?"
There are commercially available data validation software packages for which that is indeed quite trivial to match up.
For how much a month? (Score:2)
How many of the tens of thousands of small businesses on whose websites crooks are trying millions of credential combinations can afford an annual subscription to said "commercially available data validation software packages"?
Re: (Score:2)
Re: (Score:1)
On top of which, comparing addresses can be non-trivial. Is "37-3 St Simeon Ln, L.A., CA" the same address as "37 Saint Simeon Lane, Los Angeles, Calif, Apt 3?"
Yes, they are the same. "37 Main Street, Apt 52" is also the same. "37 10256th Street, Suite 700" is also the same. Are you seeing a pattern? AVS can only validate 2 numbers, the first number of the address and the zip code. Everything else is completely ignored. Your name, additional address lines, your city, your state, even your country, cannot be validated.
Re: (Score:3)
Perhaps they aren't interested in entering into international sales agreements? What "services" do you want to buy from an American retailer that do not involve the movement of goods across international borders?
Are you trying to stream video? (They may only have licenses to provide streaming services in America)
Are you trying to buy software? (Again, they may only have a license for embedded code elements for domestic use, AKA security/encryption/compression, etc)
Are you trying to download an eBook? (singl
Re: (Score:2)
Maybe getting the card numbers (card, code, expiry) is just phase I of weakness with limited applicability for in-person transactions. Nobody asks my address at the electronics shop when I have a $800 TV in my cart.
And perhaps they have other databases that allow them to correlate incomplete card numbers with names and addresses to create useful online transactions where they info can be asked.
IMHO, the only useful solution to this is two factor RSA-style authentication. Go ahead and know all the card in
Re: Billing address? (Score:1)
Re: (Score:2)
Usually, however, it is the banks that get hurt the most. This includes small regional banks. Visa and MasterCard’s contracts generally put the burden of fraud reimbursement onto the bank.
Re: (Score:2)
Nobody asks my address at the electronics shop when I have a $800 TV in my cart.
That is a "card present" transaction. If the card is physically swiped or inserted they don't need your address because they can verify the transaction with the data from the mag-stripe or chip.
The fraud discussed in TFA is for online "card not present" transactions.
Re: (Score:2)
Creditcards are tied to people, not to locations. There are many cases where the billing address may want to differ from whereever the card is registered. Buying for a friend, someone else paying an invoice. And god forbid all my cards suddenly stop working at the very critical time of moving house.
Billing address has never been used to validate a credit card.
Re: (Score:2)
I hate to double post but in addition to the above concerns there's also the point the a billing address is a horrible choice for security.
Security should be based on something you have, something you are, and something you know. A billing address by definition needs to be handed over to vendors who may have your credit card. This instantly compromises both bits of information in one attack.
For proper security you need a process where one piece of information is not handed over to a party. e.g. verified by
Re: (Score:2)
The way it works is that if you're a merchant and you accept a fraudulent/stolen card, the onus is on you to prove that to the best of your knowledge the t
A number or Your number? (Score:2)
It's even easier than that (Score:5, Insightful)
This is a good opportunity to talk about why security through obscurity is bad:
Your typical credit card number has a theoretical 16 digits that are available. That's a huge number (9,999,999,999,999,999) that makes it look effectively impossible to guess. Let's pare that number down to size.
First, you aren't guessing anywhere near 16 digits. It turns out there's a lot you already know (1st digit is 4 for visa, 5 for mastercard etc.). That reduces the typical address space from 16 to 15 digits. That first number turns out to actually just be part of the bank identification number which is typically 6 digits long. All of the rest of it except for last digit is the actual account number. The last number itself is used for a checksum (Luhn) that is used to verify the number is good.
In other words to get the account number right you've only got an address space of 999,999,999. That's a significant reduction in magnitude to start with. Now let's go back to that Luhn checksum (it isn't a hash). Due to this detail you can easily validate the number to make sure that you haven't mistyped it (Luhn precedes using magnetic tape for credit cards).
The Luhn check uses a Mod 10 algorithm that excludes 90% of the previous address space. You now have 99,999,999 numbers to guess against. Your malicious actor isn't starting work in a quadrillion space number, they're working in the millions. All of that is just from the industry standards themselves. Now remember that each bank is going to have their own formulas for generating credit card numbers and that card thieves have data sets of the tens of millions - old dumps are good for providing data that can show patterns. This is a good example of how data at the aggregate level carries risk that it doesn't at the micro level.
Chances are the account number for the card itself isn't at all random. Chances are really good that the formulas used to generate these numbers for a number of large popular banks have been reverse engineered by any number of parties. You also have policies at many banks such as never reusing a number that also reduce this address space. All the malcious actor has to do is look for patterns. Patterns have a way of reducing the order of magnitude once you learn them.
The expiration dates themselves are typically within 2 years giving a range of only 24 to pick from for the typical transaction. Guess a valid account number, try it at 24 websites and chances are really good one of them will work. That leaves the CVC2 number itself, which of course isn't random either.
The system is broken, it's just a matter of time before industry must recalibrate how it works.
More below for those who are curious:
http://www.creditcards.com/cre... [creditcards.com]
http://datagenetics.com/blog/j... [datagenetics.com]
http://www.darkcoding.net/cred... [darkcoding.net]
http://blog.opensecurityresear... [opensecurityresearch.com]
http://www.ibm.com/support/kno... [ibm.com]
Re: (Score:2)
Yes, but add a chip and now it's uncrackable! That's why in the US we don't even bother with chip and pin, but rather allow chip and sign. Would the industry allow something so seemingly brain-dead if the system weren't secure?
Re: (Score:2)
So chip and pin is broken by the requirement to support chip and sign. Awesome.
Re: (Score:3)
Chip and pin really does help for card present transactions. Unfortunately it doesn't do much for card not present transactions (online). The article talks about the issues online merchants face.
Re: (Score:2, Informative)
The card-not-present-equivalent of chip and pin is "3D-secure", better known by its card-company-specific brand names like "Verified By Visa". When this is employed, the merchant's website delegates to the card company's website for part of the transaction, where the card company can then employ various techniques to verify the user's identity.
Exactly what authentication mechanism are used depends on the bank and card company. Some are just "enter another secret number", which at least increases the number
Re: (Score:2)
Agreed, Chip and pin is better, however it is also broken. The whole thing needs rebuilt.
2 factor should /always/ be required
Re: (Score:2)
That leaves the CVC2 number itself, which of course isn't random either.
Do you have a citation for this assertion that CVV2 numbers are not random?
Re: (Score:2)
Citations were in the sources I provided.
Re: It's even easier than that (Score:2)
They may not be chosen randomly, but they are indistinguishable from random if you don't have the encryption keys.
Re: (Score:2)
Every company chooses their own method of generation for this code. Some vendors use weak encryption, some might use strong encryption, some don't use encryption at all, and some issue the codes in batches. It really all comes down to the company, their risk policies and their expertise. That's why large card dumps are risky, they provide material that can be used to look for patterns. It's a bit scary how many companies have told me they secure their product with base64.
Re: (Score:2)
Thank you for this.
I've tried to explain this to quite a few people over the years (with limited success) but your explanation was clear and succinct. In the future I'll just send them the text of your post; it'll save a lot of time and misunderstanding.
As you said, the system is broken. Badly, badly broken.
Re: (Score:1)
Thanks, glad it's helpful :)
Re: (Score:2)
What does any of that have to do with security by obscurity? There is nothing obscure about how credit card transactions work.
Re: (Score:2)
Credit card transactions are fairly well documented (I'm a big fan of DUKPT myself and that is decently documented). However the process used to generate the account and CVC2 numbers themselves is obscure and proprietary to each bank. Most banks do not have the expertise or will to properly perform this function. They count on malicious actors not looking too hard at how they do things.
Unfortunately for the banks once you figure out how to generate these numbers you have broken the primary security used to
Re: (Score:2)
... then maybe one way to solve it is to have "credit card numbers" be ridiculously large, like 1024 digits. The mag stripe or pin wouldn't care if the number was large for card-present transactions, and you could scan the card number with a camera for online transactions.
Of course, the next step would be to generate a unique "credit card number" for each transaction, that was valid exactly once.
Re: (Score:2)
Credit card numbers that long aren't necessary. Changing how they are constructed is. Logically speaking the problem can be fixed (hashing etc.) The problem is that the infrastructure that supports it would also have to be changed and that would be a monumental undertaking. Which is why they are trying to avoid it at all costs. You also have the issue that the typical consumer is not going to tolerate an even longer number than they already have.
The unique credit card number solution has been offered by som
Re: (Score:2)
Do most desktop PCs have a suitable webcam? If not, buying one online may end up a Catch-22 once it comes time to pay.
Re: (Score:1)
Interesting post, but how does the Luhn check exclude 90% of the numbers? I can create cards running from '000000001x' to '999999999x' where 'x' is the appropriate check digit, and where the first nine digits guarantee uniqueness.
Mastercard (Score:1)
Incorrect headline (Score:1)
Geez.... they can't guess your CC# - only your CVV and Expiration Date in 6 seconds.
The headline is grossly incorrect clickbait. Shame on you, Slashdot, but I know EditorDavid has no shame, nor any journalistic integrity.
Thanks EditorDavid! (Score:2)
Kudos to EditorDavid for posting some interesting articles, rather than trolling political fight bait. I was about to give up on /., but maybe there's hope.
Re: (Score:2)
Because a lot of U.S. cardmembers still don't have mobile phones with unmetered incoming SMS.
Wow, all you need is... (Score:3)
Uh, sure - if you have a valid card number as a starting point, the other data points are trivial... But if you don't, "guessing" the remaining 10 digits of a valid credit card number quickly becomes a non-trivial task because the only way to separate a "correct" credit card number (which can be proven algorithmically) from a validly-issued credit card is to supply the proposed "correct" credit card number to multiple sites with all 60 possible expiry dates and each of the nearly one thousand CVV numbers from the back... (See below)
So, when the headline says "Credit Card" they only mean Visa, everyone else blocks cards after as few as a dozen failed attempts, and the key ingredient to "cracking" a credit card is to start with a valid credit card number, all 16 digits, then find a list of e-commerce websites that will let you keep pitching hundreds and hundreds of credit card transactions at them so you can go through all 60,000 combination of expiry date and CVV to find the right one. Oh, then you need to make sure the attempted purchase in under the card's available spending limit.
But hey, yeah, credit cards are easy to brute-force hack, if you start with a valid, active, complete 16 digit credit card number - as long as it is a Visa card and Visa doesn't update their software.
Re: (Score:2)
Oh, then you need to make sure the attempted purchase in under the card's available spending limit
This one is easy. Smash out small transactions until it passes, then spend up to known limits. This happend my last fraud case. A transaction worth $50ish followed immediately bu a transaction worth $4500 on my card with a $5000 limit.
shouldnt fraud detection catch these? (Score:3)
Re: (Score:2)
There's a difference between processor and originating bank. There are many processors, but each card has a single originating bank. The processors themselves only know a fraction of the attempts.
Processors with good systems underneath might make this harder to do though: For instance, a processor might decline because the ip making this request is suspicious. Websites that use really big processors underneath might have more information on the card colder than you'd think, and be able to see something clo
Sensational article. (Score:2)
Basically some payment systems allow 10-20 human errors per valid card number before triggering a fraud alert. 10 seems understandable for all those old folks with arthritis and poor eyesight. 20 seems like someone didn't know what they were doing or didn't change it during deployment from QA.
So what the article is saying is that it is theoretically possible for someone to write a program to submit random numbers to various sites and by the law of big numbers, figure out a valid CC & data in under 6 se
What good is that? (Score:2)
Whenever I use my credit card I have to authorize each transaction on my smartphone. Even if a thief stole my wallet, as long as they don't have my unlocked phone they can't use my credit card anyways,.
because.... (Score:2)
Re: (Score:2)