New research has shown that working out the card number, expiry date and security code of any Visa credit or debit card can take as little as six seconds and that’s just by guessing. This Distribute Guessing Attack as it’s called, can bypass all security features put in place to prevent fraud with your credit cards online.
A team from the Newcastle University in the UK, found that neither the network nor the banks can detect attackers making multiple, invalid attempts to get the data for your credit cards online. By using a program that automatically and systematically generates different variations of the cards security data and firing it at tons of websites all over the world, hackers can get your credit card details within seconds and verify all the necessary security data.
Investigators believe, this attack was used to steal 2.5 million Franks, the Newcastle team described the attack as “frightfully easy if you have a laptop and an internet connection.” What makes things worse is the time of year, we’re making it easier for these hackers by doing shopping online during Xmas season.
“This sort of attack exploits two weaknesses that on their own are not too severe but when used together, present a serious risk to the whole payment system,” explains the lead author on the paper, a Ph.D. student in Newcastle University, Mohammed Ali.
“Firstly, the current online payment system does not detect multiple invalid payment requests from different websites. This allows unlimited guesses on each card data field, using up to the allowed number of attempts, typically 10 or 20 guesses on each internet site.”
“Secondly, different sites ask for different variations in the card data fields to validate an online purchase. This means it’s quite easy to build up the information and piece it together like a jigsaw.”
“The unlimited guesses, when combined with the variations in the payment data fields make it frighteningly easy for attackers to generate all the card details on one field at a time.”
“Each generated card field can be used in succession to generate the next field and so on. If the hits are spread across enough website, then a positive response to each question can be received within two seconds, just like any online payment.”
“So even starting with no details at all other than the first six digits – which tell you the bank and card type are the same for every card from a single provider – a hacker can obtain the three essential pieces of information to make an online purchase in as little as six seconds.”
To get people’s details for credit cards online, hackers use websites that require payment to guess the data and the reply to the transaction will confirm whether or not the guessing is right. You see, different websites ask for different types variations in the credit card fields, and these can be divided into three different categories: Card number + expiry date (absolute minimum); Card number + Expiry date + CVV; Card number + CVV + expiry date.
Because none of these online systems can’t pick up on multiple invalid payment requests on the same card from different websites, one can make unlimited guesses over and over again using many different websites. But as it turns out, only the VISA network is vulnerable.
“MasterCard’s centralized network was able to detect the guessing attack after less than ten attempts – even when those payments were distributed across multiple networks,” said Mohammed.
What makes it worse, online merchants all ask for different information. Thus the guessing attack can obtain the information one field at a time.
According to Mohammed: “Most hackers would have got hold of valid card numbers as a starting point but even without that it’s relatively easy to generate variations of card numbers and automatically send them out to numerous websites to validate them.
“The next step is the expiry date. Banks typically issue cards that are valid for 60 months so guessing the date takes at most 60 attempts.”
“The CVV is your last barrier, and theoretically only the card holder has that piece of information, it isn’t stored anywhere else.”
“But guessing this three-digit number takes fewer than 1,000 attempts. Spread this out over 1,000 websites, and one will come back verified within a couple of seconds. And there you have it, all the data you need to hack the account.”
Using credit cards online or “card not present” transactions is dependent on you providing data that only you, the owner of the card, can know. So, should merchants ask for the same information then the jigsaw identification across the web is very simple.
Unfortunately, there is no magic bullet that will keep your card safe.
Dr. Martin Emms, a co-author on the paper, said: “But we can all take simple steps to minimize the impact if we do find ourselves the victim of a hack. For example, use just one card for online payments and keep the spending limit on that account as low as possible. If it’s a bank card, then keep ready funds to a minimum and transfer over money as you need it.
“And be vigilant, check your statements and balance regularly and watch out for odd payments.
“However, the only sure way of not being hacked is to keep your money in the mattress, and that’s not something I’d recommend!”
