181–190 of 199 posts
Earlier quoted context omitted.
Well, what you can do is notify the card issuer about those cards that went through, so they can mark them as stolen. That surely will make the hacker really happy, and discourage them of doing it again :)
So you mean you are keeping full card numbers somewhere in your logs to... fix some potential security issue...?
Earlier quoted context omitted.
I added custom captcha (simple math as slightly distorted pictures with audio alternative) on one of my forms, it prevents ~80% of spam submissions. less than 1% of spam passes, other ~20% are blocked on key words (like "sex", "passion", etc...).
Not sure why you’re telling me that. I’m not criticising CAPTCHA, my parent comment was.
Mitigating this is kind of pointless, because so many sites are vulnerable to this. I got subscription bombed from about a dozen .gov sites a while back. Healthcare.gov, Social Security Administration, WTC Health Program, FDA, National Institute of Mental Health, Medicare.gov. It's very easy for attackers to do this. Putting in effort to solve this for one site, and expecting any impact, is like trying to empty the o…
You mitigate because you want to be responsible and not contribute to a problem. One person has to be the first to do something better before it can become a thing that is a best practice throughout an entire industry.
I had my email stolen in such an attack, i still get random "you abandoned your cart!" Emails now and then, but luckily (?) they got my credit card at the same time and i cancelled it within minutes. So it's a little annoyance, but it doesn't really make sense to me that the flood works. At least not with American credit cards that are routinely flagging my own trips to microcenter lol Editing to add: almost 100% of…
How can an affected user recover from such an attack?
Report all received emails as spam, add a filter to get rid of the @domain.com emails, and probably add the entire service to the blacklist so it doesn't happen again. Probably get rid of any paid account on that service one might have laying around. If the email is targeted at a domain using mail servers from any major email provider (Gmail, Outlook), the user will probably find most emails into their spam folder an…
Earlier quoted context omitted.
You have to think hard about the problem and apply individual solutions. Cloudflare didn’t work for the author anyway. Even if they had more intrusive settings enabled it would have just added captchas, which wouldn’t likely have stopped this particular attacker (and you can do on your own easily anyway). In this case I assume the reason the attacker used the change credit card form was because the only other way to…
None of your solutions seem useful in this case, especially a $150 hold. Site-wide rate limiting for payment processing? Too complicated, high-maintenance, and easy to mess up. You can't block 100% of these attempts, but you can block a large class of them by checking basic info for the attempted card changes like they all have different names and zip codes. Combine that with other (useful) mitigations. Maybe getting…
Attackers are going after small charges. That's the reason they're going after these guys in the first place.
>Site-wide rate limiting for payment processing? Too complicated, high-maintenance, and easy to mess up.
And then you give a solution that is 10x as complicated, high maintenance, and easy to mess up.
>You can't block 100% of these attempts, but you can block a large class of them by checking basic info for the attempted card changes like they all have different names and zip codes.
This is essentially a much more complex superset of rate limiting.
Earlier quoted context omitted.
A $150 hold would clearly be noticed by the victim, so the attacker wouldn't even try it.
Maybe if my bank emailed me, otherwise I doubt it. Local gas stations routinely use $200 holds and I'd have to go way out of my way to see it happen.
Earlier quoted context omitted.
A $150 hold would clearly be noticed by the victim, so the attacker wouldn't even try it.
Yeah… no it wouldn’t. I’ve watched users have their bank accounts emptied (by accident) because they kept refreshing. A measly £150 isn’t going to register until it’s too late anyway.
Whether every user notices it or not, attackers are looking for the ability to do small charges, and if you remove that they'll move on.
Earlier quoted context omitted.
You mitigate because you want to be responsible and not contribute to a problem. One person has to be the first to do something better before it can become a thing that is a best practice throughout an entire industry.
Like I said, it's pointless.
Earlier quoted context omitted.
> I have around 20 or 30 google accounts attached where i am the backup email address. Those people forget their passwords or stop using their accounts and i get email notifications about that. No confirmation from my side necessary. Does google not require a verification when you setup a backup email address?!
Yes they do, so I’m not sure how that could be possible. Unless it’s a back up email address for some other email service that doesn’t require it.