Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detect breaches with Canary credit cards

blog.thinkst.com

Post reply on HN
Print view View original

21–30 of 158 posts

Re: Detect breaches with Canary credit cards

#21

Post by myself248 »

lazide wrote: post #18
voakbasda wrote: post #15

I have wanted something like this to give to scammers, to help aid in their detection and capture. This is part of that puzzle. Now if only law enforcement would give a shit and do something about all of the rampant fraud. Sadly, I do not believe that will ever happen.

Near as I can tell, a lot of the fraud is exploitation of the known and not yet solved ‘remote jurisdiction’ issue. When someone is far away, and in a different jurisdiction, it’s hard to track them down and do anything to them. Not likely to get better anytime soon, unfortunately.

I thought bounty hunters were supposed to solve that. They ignore our laws, we ignore theirs.

This leads to a hell of a dystopia, but spammers have left me no choice but to contemplate dystopias.

Re: Detect breaches with Canary credit cards

#22

Post by posix_compliant »

I’m dying to know how they implemented this. In order to have Visa or MasterCard process this transaction, they’d need to have a bank partner to issue the credit credit card with an issuer processor. There’s usually a large cost to keeping open credit cards on file, even if there’s no line of credit.

Re: Detect breaches with Canary credit cards

#23

Post by DerekBickerton »

This is tangential, but still related: a few years ago I could buy disposable VISA cards which were these vouchers you bought in a store and were preloaded with a fixed amount. They didn't even have to be in your legal name.

I put the numbers on e-crime forums for people to snap up, and it was funny watching what kinds of transactions were being made. Most people were using it to buy cryptocurrency.

Most of the transactions were vague though and didn't mention the merchant in question, but with a bit of digging I discovered they were so called 'Discreet Billing' companies which are largely used for adult websites and used to mask the fact you were buying porn to people casually glancing at your CC statement.

Re: Detect breaches with Canary credit cards

#24

Post by pelasaco »

myself248 wrote: post #20

The fact that the Payment Card Industry association hasn't been pushing this for decades, and it's up to some random infosec nerds to invent it, is yet more evidence that our entire payment infrastructure is fundamentally flawed.

Well to be honest Honey Tokens is being used since beginning of the 2000s, https://en.wikipedia.org/wiki/Honeytoken. I personally implemented them in a Bank, 20 years ago, generating some fake credit cards number (and other information) and having them being monitored in AV, IDS, IPS, Antifraud solutions like browser extensions, google search and etc.. So maybe we can say that I'm a random infosec nerd, but i guess, I'm not the only one, just that people and companies preferred to make it in silence, to actually catch the bad guys out there. We actually were able to catch internal people selling data and we could understand some ways data used to flow and work pretty tight with the Police to intercept and bust criminal groups.

Re: Detect breaches with Canary credit cards

#25

Post by lazide »

myself248 wrote: post #21
lazide wrote: post #18

Earlier quoted context omitted.

Near as I can tell, a lot of the fraud is exploitation of the known and not yet solved ‘remote jurisdiction’ issue. When someone is far away, and in a different jurisdiction, it’s hard to track them down and do anything to them. Not likely to get better anytime soon, unfortunately.

I thought bounty hunters were supposed to solve that. They ignore our laws, we ignore theirs. This leads to a hell of a dystopia, but spammers have left me no choice but to contemplate dystopias.

Bounty hunters are not really a thing in the way you’re thinking - they can’t just go to Japan, investigate someone, arrest them and bring back someone from there for instance. They’re for returning someone already arrested who jumped bail somewhere. And they typically don’t work internationally, as their legality is dubious even within a specific jurisdiction.

For something major, it’s generally already possible to investigate and get someone extradited already, for instance, when the cultural gaps aren’t too large and the cultures have a common agreement on what a ‘major crime’ is and looks like. Murder, for instance.

The issue is the bar for ‘major enough’ gets higher and higher the more jurisdictions/cultures you cross, and it is super easy now to scam across a large enough gap there that no one is going to arrest or participate in investigating all but the largest and most blatant scams.

Good luck getting someone arrested in Russia, Nigeria, China, etc. for wire fraud, for example.

Re: Detect breaches with Canary credit cards

#26

Post by 411111111111111 »

pelasaco wrote: post #24
myself248 wrote: post #20

The fact that the Payment Card Industry association hasn't been pushing this for decades, and it's up to some random infosec nerds to invent it, is yet more evidence that our entire payment infrastructure is fundamentally flawed.

Well to be honest Honey Tokens is being used since beginning of the 2000s, https://en.wikipedia.org/wiki/Honeytoken . I personally implemented them in a Bank, 20 years ago, generating some fake credit cards number (and other information) and having them being monitored in AV, IDS, IPS, Antifraud solutions like browser extensions, google search and etc.. So maybe we can say that I'm a random infosec nerd, but i guess,…

Yeah, trust self important HN commentators like myself248 to imply incompetence throughout an entire industry while being completely ignorant about said industry.

Re: Detect breaches with Canary credit cards

#27

Post by pelasaco »

411111111111111 wrote: post #26
pelasaco wrote: post #24

Earlier quoted context omitted.

Well to be honest Honey Tokens is being used since beginning of the 2000s, https://en.wikipedia.org/wiki/Honeytoken . I personally implemented them in a Bank, 20 years ago, generating some fake credit cards number (and other information) and having them being monitored in AV, IDS, IPS, Antifraud solutions like browser extensions, google search and etc.. So maybe we can say that I'm a random infosec nerd, but i guess,…

Yeah, trust self important HN commentators like myself248 to imply incompetence throughout an entire industry while being completely ignorant about said industry.

people normally imagine that finance and specially banks, are just COBOL, mainframe and legacy, and even though it is part of their BAU, there are lot of innovation there, specially in the infosec/antifraud segments.

Re: Detect breaches with Canary credit cards

#28

Post by rich_sasha »

I find it crazy that making a payment requires giving your full details. Using a credit card is less writing a cheque, more handing over a chequebook and saying "help yourself".

I dream of a payment system where payment generates some token, which the intended recipient can redeem, perhaps bearer ones for casual transactions, with support for periodic payments, revoking existing tokens or placing per-token limits.

One day perhaps...

Re: Detect breaches with Canary credit cards

#29

Post by boramalper »

I wonder if the BIN/IIN (Bank/Issuer Identification Number[0]) of canary cards give it away. For this to work against sophisticated attackers, I'd expect a canary card to be indistinguishable from a regular one, though I still love the ingenuity of it.

edit: They mention this in the article, I missed it.

[0] https://en.wikipedia.org/wiki/Payment_card_number#Issuer_ide...

Post reply on HN