Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Criminals can guess Visa number and security code in six seconds, experts find

independent.co.uk

Post reply on HN
Print view View original

91–100 of 166 posts

Re: Criminals can guess Visa number and security code in six seconds, experts find

#91

Post by adrr »

preinheimer wrote: post #12

So criminals can guess a valid CC/CVC/Zip in 6 seconds, and merchants that get nothing but green lights across the board from their credit card processor will be left holding the bag when the card holder disputes the charge. Merchants doing everything they can need better protection from this crap.

I designed the fraud prevention for a major ecommerce site(PCI Level 1). We used to get hit with lots of card testing including bot nets. They are easily mitigated. First thing is detune your error messages. Combine all the errors into one generic message. This includes AVS, CVN, and Expiration. I've see so many sites return the raw message back from the processor.

We also actively black holed large blocks IP addresses including TOR exit nodes and open proxies. Before all the privacy people make comments. We're a store. If you show up wearing a ski mask we aren't going to sell to you.

Sometimes we go on the offense and detect the patterns/attributes for the botnets that allowed us distinguish them from real traffic. We didn't block them, we fed them bad data. That made them go away fast.

Most important take away: Mitigating fraud will lead to higher auth success rates as you build up the reputation on your MID(Merchant ID). Its not only important in preventing chargebacks but increasing revenue.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#92

Post by digler999 »

Freestyler_3 wrote: post #33
coldcode wrote: post #4

Earlier quoted context omitted.

Matercard supposedly has a single back end but VISA does not, according to the article. Given the distributed nature of the attack I imagine only the card processors could detect it; if you pick sufficiently broad set of web site to test with the chances of them sharing a server that could detect something is probably low.

I remember seeing the VISA security centre, where they monitor threats etc. It was a huge high tech facility. I would think that they flag if a card is attempted a lot of times in short time span.

As another poster said, you don't run one card 1000 times. You run 100 cards 10 times and achieve almost the same probability of guessing one without burning the card.

On another note, I wish they'd get rid of the number + exp + cvv. Quit concatenating more codes and just go to an alpha numeric model. You could have fewer digits and a bigger probability space. Even when you remove certain letters that sound alike.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#93

Post by mannykannot »

throwaway2016a wrote: post #85
mannykannot wrote: post #50

Earlier quoted context omitted.

Actually, I have worked on the development of security software, but if you want a source, I suggest you start with the work of the researchers mentioned in the article. Among the facts there, you can find that Mastercard is apparently capable of detecting these guessing attempts, so as we are on the subject of sources, what is your source for your suggestion that this is an insurmountable volume-related problem? You…

> your source for your suggestion that this is an insurmountable volume-related problem I wasn't. But a problem not being insurmountable does not make you incompetent for not solving it (yet). Curing cancer is not insurmountable yet we don't call scientist incompetent for not having it done yet (at least I don't). And before you say it. No, I am not saying this is as difficult as curing cancer. I don't know enough ab…

The situation is not remotely like the scenario you are concerned about. We (the e-commerce industry collectively) have a history of making many of the same basic security mistakes repeatedly, even though both the mistakes and the ways to avoid them are well-documented (SQL injection is a classic example, as is the use of easily-guessable secrets.) In my opinion (the source of which is me) the industry should be held accountable for its complacency and, yes, lapses in competence. Of course, being criticized by me in an HN comment is hardly being held accountable.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#94

Post by caf »

StephanTLavavej wrote: post #88
erikpukinskis wrote: post #75

Earlier quoted context omitted.

They don't have to use the same number. 100 attempts at 100 numbers is just as likely to turn up a hit as 10000 attempts on one number.

Actually, it's not even close. 10,000 attempts to guess a 4-digit number are certain to succeed. 100 attempts to guess 100 4-digit numbers have a good chance of resulting in no hits. For each 4-digit number, you produce 100 different guesses (with no repeated guesses for that number, because that would be silly). There's a 100/10,000 chance of a hit, and 9,900/10,000 chance of a miss. The chance of missing on all 100…

Guessing 100 numbers, there's a chance to produce 2 or more hits, of course.

..to the point that the expected value should converge to the same amount, right?

Re: Criminals can guess Visa number and security code in six seconds, experts find

#95

Post by aquadrop »

ctrl-j wrote: post #72
adolph wrote: post #19

Earlier quoted context omitted.

For any valid card number yes. I'd bet that almost all don't have three numbers all the same and that there are probably more rules/conventions that would reduce the search space. http://m.wolframalpha.com/input/?i=count+of+permutations+of+...

> I'd bet that almost all don't have three numbers all the same and that there are probably more rules/conventions that would reduce the search space. You're correct that almost all don't have three identical digits, but that's just because there's only 10 of them - 000, 111, 222, 333, 444, 555, 666, 777, 888, 999 10/1000 = 1% I doubt they would make up rules for determining the cvv, as it would only improve security…

I think they can be same, but they always > 99 (at least I never saw a card with CVV starting with 0)

Re: Criminals can guess Visa number and security code in six seconds, experts find

#96

Post by aquadrop »

erikpukinskis wrote: post #75
rcthompson wrote: post #26

Shouldn't this be easy to detect, though? Every attempt to use a credit card number online involves a request to the bank providing that card to determine if it's valid, right? So the bank would see thousands of attempts across hundreds of websites for the same card number in a matter of seconds, which is clearly impossible for a human, and flag the card as "stolen". Or maybe I'm just way too optimistic about how thi…

They don't have to use the same number. 100 attempts at 100 numbers is just as likely to turn up a hit as 10000 attempts on one number.

But that means you have pretty low conversion rate. You have 1000 numbers of stolen cards, and you only going to get 10 of them? It reduces profitability substantially. And even 100 attempts is enough to mark card as stolen if bank is watching it.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#97

Post by cherryblakes »

Hello guys and how are you doing today, Do you need require the services of an accomplished and professional hacker for any of the following:

-Facebook account hacking -Instagram account hacking -Mobile phone hacking -Whatsapp hacking -Kik account hacking -GPS tracking -Website hacking -Bank account hacking -Account recovery -DDOS attack -Email account hacking

Then you should contact:danielwellingtonhacks@gmail.com for his professional services. He is one of the best hackers out there.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#98

Post by girvo »

aquadrop wrote: post #95
ctrl-j wrote: post #72

Earlier quoted context omitted.

> I'd bet that almost all don't have three numbers all the same and that there are probably more rules/conventions that would reduce the search space. You're correct that almost all don't have three identical digits, but that's just because there's only 10 of them - 000, 111, 222, 333, 444, 555, 666, 777, 888, 999 10/1000 = 1% I doubt they would make up rules for determining the cvv, as it would only improve security…

I think they can be same, but they always > 99 (at least I never saw a card with CVV starting with 0)

I have, it was a Visa.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#100

Post by nikatwork »

preinheimer wrote: post #12

So criminals can guess a valid CC/CVC/Zip in 6 seconds, and merchants that get nothing but green lights across the board from their credit card processor will be left holding the bag when the card holder disputes the charge. Merchants doing everything they can need better protection from this crap.

Kogan charge your card a slightly lower random amount than the transaction total and ask you to verify the exact figure before they will fulfill the order. Simple and clever.
Post reply on HN