Criminals can guess Visa number and security code in six seconds, experts find
1–10 of 166 posts
Re: Criminals can guess Visa number and security code in six seconds, experts find
#2hindsight is 20/20 - but I'm awefully surprised that this would not be detected by the backend/backoffice systems processing cards.
Re: Criminals can guess Visa number and security code in six seconds, experts find
#3The power of distributed attacks. Of course they can only guess a random correct credit card + exp + code not yours. Given the relative limited number of codes for each bank, I wonder what the odds are for them to wind up with yours.
Re: Criminals can guess Visa number and security code in six seconds, experts find
#4hindsight is 20/20 - but I'm awefully surprised that this would not be detected by the backend/backoffice systems processing cards.
Matercard supposedly has a single back end but VISA does not, according to the article. Given the distributed nature of the attack I imagine only the card processors could detect it; if you pick sufficiently broad set of web site to test with the chances of them sharing a server that could detect something is probably low.
Re: Criminals can guess Visa number and security code in six seconds, experts find
#5These attackers are probably brilliant enough to make their mark in the honest tech business world. I suppose they are driven by the challenge of the crime.
Re: Criminals can guess Visa number and security code in six seconds, experts find
#6The power of distributed attacks. Of course they can only guess a random correct credit card + exp + code not yours. Given the relative limited number of codes for each bank, I wonder what the odds are for them to wind up with yours.
It's like winning the lottery --- someone always wins, even if it's not you. If guessing is free and you get an effectively unlimited number of guesses in parallel, it's pretty obvious that you will win quite easily.
Some related reading here: https://en.wikipedia.org/wiki/Payment_card_number
Re: Criminals can guess Visa number and security code in six seconds, experts find
#7There are well-specified rules for coming up with valid credit card account numbers, and at most, say, 60 valid expiration dates (12 months × 5 years into the future).
Once an attacker has a valid credit card number and expiration date, there are only 10⁴ = 10,000 four-digit security codes possible, which the attacker tries with parallel requests to hundreds of websites. Each website gives the attacker at least a few tries to enter valid credit card information.
Worst case, it takes only 10,000 parallel requests to guess the correct security code. Worst case.
I don't know whether to cringe or laugh at this.
Re: Criminals can guess Visa number and security code in six seconds, experts find
#8These attackers are probably brilliant enough to make their mark in the honest tech business world. I suppose they are driven by the challenge of the crime.
I suspect they live in countries without the rule of law so they have little incentive to make an "honest" living.
Re: Criminals can guess Visa number and security code in six seconds, experts find
#9There are well-specified rules for coming up with valid credit card account numbers, and at most, say, 60 valid expiration dates (12 months × 5 years into the future). Once an attacker has a valid credit card number and expiration date, there are only 10⁴ = 10,000 four-digit security codes possible, which the attacker tries with parallel requests to hundreds of websites. Each website gives the attacker at least a few…
In the UK they are 3 digits on the back, 3000 is a worse case.
Re: Criminals can guess Visa number and security code in six seconds, experts find
#10There are well-specified rules for coming up with valid credit card account numbers, and at most, say, 60 valid expiration dates (12 months × 5 years into the future). Once an attacker has a valid credit card number and expiration date, there are only 10⁴ = 10,000 four-digit security codes possible, which the attacker tries with parallel requests to hundreds of websites. Each website gives the attacker at least a few…
The data you'd gain from this is practically useless to anyone looking to commit fraud... so laugh at the article I guess?
Maybe you could abuse this to create a lot of netflix accounts, but you aren't really going to be able to buy anything with just the PAN/cvv/expiry.