Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Criminals can guess Visa number and security code in six seconds, experts find

independent.co.uk

Post reply on HN
Print view View original

11–20 of 166 posts

Re: Criminals can guess Visa number and security code in six seconds, experts find

#11

Post by Zyst »

coldcode wrote: post #4
avh02 wrote: post #2

hindsight is 20/20 - but I'm awefully surprised that this would not be detected by the backend/backoffice systems processing cards.

Matercard supposedly has a single back end but VISA does not, according to the article. Given the distributed nature of the attack I imagine only the card processors could detect it; if you pick sufficiently broad set of web site to test with the chances of them sharing a server that could detect something is probably low.

That frankly sounds like a strong security argument to use MasterCard over Visa. But more research on how MasterCard would handle a similar attack might be necessary.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#12

Post by preinheimer »

So criminals can guess a valid CC/CVC/Zip in 6 seconds, and merchants that get nothing but green lights across the board from their credit card processor will be left holding the bag when the card holder disputes the charge.

Merchants doing everything they can need better protection from this crap.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#13

Post by imaginenore »

avh02 wrote: post #2

hindsight is 20/20 - but I'm awefully surprised that this would not be detected by the backend/backoffice systems processing cards.

It's absolutely insane. Setting up a distributed key-value system with some basic API shouldn't take more than a few days.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#14

Post by imaginenore »

ryanlol wrote: post #10
cs702 wrote: post #7

There are well-specified rules for coming up with valid credit card account numbers, and at most, say, 60 valid expiration dates (12 months × 5 years into the future). Once an attacker has a valid credit card number and expiration date, there are only 10⁴ = 10,000 four-digit security codes possible, which the attacker tries with parallel requests to hundreds of websites. Each website gives the attacker at least a few…

The data you'd gain from this is practically useless to anyone looking to commit fraud... so laugh at the article I guess? Maybe you could abuse this to create a lot of netflix accounts, but you aren't really going to be able to buy anything with just the PAN/cvv/expiry.

You can buy all kinds of valuables online, which you then resell. Gift cards are quite common.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#15

Post by skosch »

vorticalbox wrote: post #9
cs702 wrote: post #7

There are well-specified rules for coming up with valid credit card account numbers, and at most, say, 60 valid expiration dates (12 months × 5 years into the future). Once an attacker has a valid credit card number and expiration date, there are only 10⁴ = 10,000 four-digit security codes possible, which the attacker tries with parallel requests to hundreds of websites. Each website gives the attacker at least a few…

In the UK they are 3 digits on the back, 3000 is a worse case.

Isn't that (almost) 1000? All numbers between 001 and 999?

Re: Criminals can guess Visa number and security code in six seconds, experts find

#16

Post by mannykannot »

avh02 wrote: post #2

hindsight is 20/20 - but I'm awefully surprised that this would not be detected by the backend/backoffice systems processing cards.

This does not require hindsight - it is literally the first thing you would ask about in an audit of the system's security. The real issue is what it says about the competence of the people running these systems.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#17

Post by xtiansimon »

coldcode wrote: post #3

The power of distributed attacks. Of course they can only guess a random correct credit card + exp + code not yours. Given the relative limited number of codes for each bank, I wonder what the odds are for them to wind up with yours.

...for every valid/correct credit card? The answer is a ratio of 1:x_1, where x_1 is every correct cc. And each correct cc is a ratio to the total number of cc vulnerable to the system of attack, 1:x_2; and this is in turn a ratio of 1:x_3, for all the currently valid cc, etc.etc. Right? But what's more concerning is all of the successful fraudulant activity is adding to the loss those banks are adding to their books, which in turn will be passed on to customers as bank fees and other costs.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#18

Post by nine_k »

ryanlol wrote: post #10
cs702 wrote: post #7

There are well-specified rules for coming up with valid credit card account numbers, and at most, say, 60 valid expiration dates (12 months × 5 years into the future). Once an attacker has a valid credit card number and expiration date, there are only 10⁴ = 10,000 four-digit security codes possible, which the attacker tries with parallel requests to hundreds of websites. Each website gives the attacker at least a few…

The data you'd gain from this is practically useless to anyone looking to commit fraud... so laugh at the article I guess? Maybe you could abuse this to create a lot of netflix accounts, but you aren't really going to be able to buy anything with just the PAN/cvv/expiry.

You can potentially issue an old-style mag-stripe credit card knock-off, and pay with it in an offline store. IDK if it's worth the effort: the card should look reasonable physically, too.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#19

Post by adolph »

skosch wrote: post #15
vorticalbox wrote: post #9

Earlier quoted context omitted.

In the UK they are 3 digits on the back, 3000 is a worse case.

Isn't that (almost) 1000? All numbers between 001 and 999?

For any valid card number yes. I'd bet that almost all don't have three numbers all the same and that there are probably more rules/conventions that would reduce the search space.

http://m.wolframalpha.com/input/?i=count+of+permutations+of+...

Re: Criminals can guess Visa number and security code in six seconds, experts find

#20

Post by acomjean »

I'm no means on expert on this, but having delt a little with online transactions from testing responses from a payment processor.

The things that needed to match also involved the customers street address, zip and name. If I recall these were scored and if the match wasn't good (zip was entered wrong) the transaction was rejected. Maybe different payment processors have different thresholds for rejecting a transaction?

https://help.chargify.com/payment-gateways/Error-FAQ.html

Post reply on HN