Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Criminals can guess Visa number and security code in six seconds, experts find

independent.co.uk

Post reply on HN
Print view View original

81–90 of 166 posts

Re: Criminals can guess Visa number and security code in six seconds, experts find

#81

Post by Terretta »

jamiesonbecker wrote: post #70
user5994461 wrote: post #63

Earlier quoted context omitted.

1) Pick a bank that gives expiration dates within 3 years. 60 => 36 combinations 2) Security codes are always 3 digits. I don't know why you think 4? 9999 => 999 combinations.

To your second point, AMEX uses 4 digit CVV's[1]. However, it's easy to tell the difference between an AMEX and a VISA/MC from the card number alone. 1. https://www.cvvnumber.com/

For AMEX, there's still a 3 digit CSC code on the back which you will need from time to time.

The 4 digit code on the front is their CID, asked for by most merchants.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#82

Post by contingencies »

closeparen wrote: post #73
nine_k wrote: post #18

Earlier quoted context omitted.

You can potentially issue an old-style mag-stripe credit card knock-off, and pay with it in an offline store. IDK if it's worth the effort: the card should look reasonable physically, too.

No, there's an analogue of the CVV2, the CVV1, which is only present on the magnetic stripe. The information you'd get from an online transaction is not enough to print a working magstripe.

There are still offline processors that don't read magstripe and just take a copy of the card and a signature.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#83

Post by ScottBurson »

tyingq wrote: post #76
seanwilson wrote: post #62

Wouldn't asking for the name on the card as well stop this? You're not going to be able to randomly generate the correct name.

Unfortunately, at least in the US, cardholder name matching doesn't work for most transactions. Only AMEX supports it. Edit: Offtopic rant, but as an online merchant this is the sort of thing that pisses me off about the CC situation. They don't support other obvious things either, like passing in the shipping address and ip address so they can be used for fraud detection. Yes, there are outboard services (MaxMind,et…

Name matching doesn't work??! I guess you must be right, or this attack wouldn't be possible, but holy shit that is fucked up.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#85

Post by throwaway2016a »

mannykannot wrote: post #50
throwaway2016a wrote: post #42

Earlier quoted context omitted.

Source? Do you audit credit card security systems or are in a related industry? I personally tend to air on the side of NOT assuming people I have never met working on a problem I have never had to try to solve (and therefor may not see all the complexity) are incompetent. I find it way more likely they are competent it is just a problem that is significantly more complex when dealing with the kind of big-data volume…

Actually, I have worked on the development of security software, but if you want a source, I suggest you start with the work of the researchers mentioned in the article. Among the facts there, you can find that Mastercard is apparently capable of detecting these guessing attempts, so as we are on the subject of sources, what is your source for your suggestion that this is an insurmountable volume-related problem? You…

> your source for your suggestion that this is an insurmountable volume-related problem

I wasn't. But a problem not being insurmountable does not make you incompetent for not solving it (yet). Curing cancer is not insurmountable yet we don't call scientist incompetent for not having it done yet (at least I don't).

And before you say it. No, I am not saying this is as difficult as curing cancer.

I don't know enough about the issue to correct you or not. I just know a lot of great software engineers who have poured their sweat and blood into systems only to be called incompetent.

I've also seen open source developers develop brilliant pieces of software and then get called incompetent for a single bug. Because the bug was "obvious" (in hindsight)

That kind of attitude keeps people from taking risks. I personally think we need to encourage people to go into the tough problems and a lot of people won't if they risk being ridiculed for not solving them.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#86

Post by tyingq »

ScottBurson wrote: post #83
tyingq wrote: post #76

Earlier quoted context omitted.

Unfortunately, at least in the US, cardholder name matching doesn't work for most transactions. Only AMEX supports it. Edit: Offtopic rant, but as an online merchant this is the sort of thing that pisses me off about the CC situation. They don't support other obvious things either, like passing in the shipping address and ip address so they can be used for fraud detection. Yes, there are outboard services (MaxMind,et…

Name matching doesn't work ??! I guess you must be right, or this attack wouldn't be possible, but holy shit that is fucked up.

100% true. Does not work, outside of AMEX cards. You can put anything you want in the cardholder name fields.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#87

Post by ticoombs »

mjevans wrote: post #78
erikpukinskis wrote: post #77

Earlier quoted context omitted.

> Worse, the merchant does not appear to be able to really know when payment from a credit card is actually final. This is why I find it strange when people wring their hands over Bitcoin's 10 minute settlement window... Credit card transactions are regularly open for weeks if not months!

From the consumer perspective CC transactions are effectively instant, at least for the strip transaction. Even introducing the short delay that the chips involve has been very unpopular. (Why they went with chip+sig is clearly some form of non-security motivation.) The solution to bitcoin, ironically, would be bitcoin+signature. The signature is forming a contract, a promise to pay. This is different from waiting fo…

From my limited use of Bitcoin, the merchants only required the transaction to be broadcast They didn't care if it had 0 or 1 or 100 confirmations. They only cared that it was broadcast. Which makes sense. Considering they all apparently only did 4 Bitcoin transactions a month if not less. (2 cafes and a pub)

This is completely different to how online stores have processed my Bitcoin. Usually waiting for 1-2 confirmations before shipping (Trezor is my example here)

Re: Criminals can guess Visa number and security code in six seconds, experts find

#88

Post by StephanTLavavej »

erikpukinskis wrote: post #75
rcthompson wrote: post #26

Shouldn't this be easy to detect, though? Every attempt to use a credit card number online involves a request to the bank providing that card to determine if it's valid, right? So the bank would see thousands of attempts across hundreds of websites for the same card number in a matter of seconds, which is clearly impossible for a human, and flag the card as "stolen". Or maybe I'm just way too optimistic about how thi…

They don't have to use the same number. 100 attempts at 100 numbers is just as likely to turn up a hit as 10000 attempts on one number.

Actually, it's not even close. 10,000 attempts to guess a 4-digit number are certain to succeed. 100 attempts to guess 100 4-digit numbers have a good chance of resulting in no hits. For each 4-digit number, you produce 100 different guesses (with no repeated guesses for that number, because that would be silly). There's a 100/10,000 chance of a hit, and 9,900/10,000 chance of a miss. The chance of missing on all 100 4-digit numbers is (9,900/10,000)^100 = 0.366 = 36.6%. That's substantial!

Guessing 100 numbers, there's a chance to produce 2 or more hits, of course.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#89

Post by tyingq »

mjevans wrote: post #79
tyingq wrote: post #55

Earlier quoted context omitted.

It does, but the only allowable reason is "not authorized". Of course, for this type of fraud, that's the reason that matters. Thought it worth mentioning though, because in the CC world, a lot of the fraud is return fraud. Like "Item Not Received" or "Not as Described" being used when they aren't true.

I wonder how much of "Item Not Received" is due to poor transport security, like delivering the item to someone's 'property' but just leaving it outside, unattended and unsecured.

That's part of it. The chargeback system is a complete joke, however. I had one guy that I was very suspicious about, so I hired a PI to see if the item was visible in his small business, and take a picture.

The tracking number showed the item delivered to the person, signed for with an known employee's name. I submitted this, as well as a picture of the item in the guy's shop. I still lost the chargeback. Got my revenge in the end though...see below.

A tip for anyone that's has a particular chargeback where they know they were screwed. If the issuing bank has any presence in your state...sue the cardholder's bank (or perhaps Visa/MC/AMEX) in small claims. In my case, Chase settled for the amount I sued for, which I made sure was on the high side. They don't like to spend money on corporate lawyers going to small claims.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#90

Post by Mz »

cs702 wrote: post #7

There are well-specified rules for coming up with valid credit card account numbers, and at most, say, 60 valid expiration dates (12 months × 5 years into the future). Once an attacker has a valid credit card number and expiration date, there are only 10⁴ = 10,000 four-digit security codes possible, which the attacker tries with parallel requests to hundreds of websites. Each website gives the attacker at least a few…

there are only 10⁴ = 10,000 four-digit security codes possible

Yeah, that's not a big number, even manually, much less for a hacker.

I went to school for two months and the TV in my dorm room had been locked down to a few channels by some parental security crap, presumably by a previous occupant. With nothing better to do, I manually went through codes until I found the right one and unlocked it to open up more channels for myself.

It was only intimidating when I was entering random guesses at first. As soon as I decided to just methodically go through all possible combinations, it only took me something like two or three days of doing this when I wasn't in class and was watching TV anyway.

I am so glad I never tried to use BS like that with my own kids.

Post reply on HN