Skip to main content

Credit cards can be hacked


Beware! Your Credit/Debit Card Can Be Hacked In Just 6 Seconds

Card number, expiry date, CVV2, address -- everything is guessable

     A new attack mechanism, called Distributed Guessing Attack, can steal your credit and debit card details in as few as six seconds. This assault exploits two basic security flaws in the online payment systems–unlimited guesses on payment pages and variation in the payment data fields.

Today, different kinds of cards have become the de facto means of online payments. This has also resulted in an increase in the number of online frauds taking place every month. The current situation, automatically, presents before us the question — what security methods are being taken to ensure a safe cashless transaction?

The researchers from the University of Newcastle have carried out a research and published their result in the IEEE Security & Privacy Journal. The study shows how an attack mechanism, called Distributed Guessing Attack, can bypass all the security measures deployed to ensure the safety of online transactions.

Surprisingly, this invasion can help the cyber criminals fetch your credit card numbers, security codes, expiry dates, and other information in as few as 6 seconds.

How Distributed Guessing Attack works?

The attack makes use of the reply (positive or negative) of web merchant’s payment page to guess the data. It exploits two weaknesses. First, the current payment systems don’t detect multiple invalid requests on the same card from different websites. It implies that unlimited guesses can be made by “distributing” the guesses over tons of websites. Second, as different merchants provide various fields for entering data, the attack scales well and the hacker can use the guessing attack to get information from one field at a time.

These two characteristics that look like a flaw, make things easy for the attackers to get all the credit card details. Within seconds, this attack can be launched on various payment pages. With the help of elimination, the correct card number, security code and CVV number can be verified.

Screenshot of the website bot, farming CVV2 from multiple sites.

In the study, the attack was carried out using automated scripts written in Java Selenium browser automation framework. All the experiments were performed on Mozilla’s open source Firefox web browser.

After the study, the researchers have notified Visa and other affected sites. While some websites have hardened their security settings, many chose to ignore this warning.

In order to enhance the personal security, the researchers have suggested that the card-holders should use a single card for online payments and minimize the spending limit to as low as possible.

What do you suggest? Are our current cashless payment systems secure? Don’t forget to drop your views in the comments section belo

Labels

Labels:

Comments

Post a Comment

Popular posts from this blog

Create a key logger using cmd

Here is a basic  keylogger  script for beginners to understand the basics of how keylogging works in notepad. This script should be used for research purposes only. @echo off color a title Login cls echo Please Enter Email Adress And Password echo. echo. cd "C:Logs" set /p user=Username: set /p pass=Password: echo Username="%user%" Password="%pass%" >> Log.txt start >>Program Here<< exit Step 1:  Now paste the above code into Notepad and save it as a  Logger.bat  file. Step 2:  Make a new folder on the desktop and name it Logs ( If the folder is not called Logs, then it will not work.) Step 3:  Drag that folder in to the  C: Step 4:  Test out the  Logger.bat ! Related  All-in-one Messenger - FacebookMessenger, WhatsApp, Skype and many more in one window Step 5:  Alright, now once you test it, you will go back into the Logs folder in the  C: and a  .txt  file w...
Post a Comment
Read more

What is DNS

D NS stands for Domain Name System is used to as the medium to translate domain names to their respective IP addresses when a client initiates a request query. DNS stores the database of all the domain names and their IP addresses which are registered on the network. Most of us are quite familiar with the term DNS or Domain Name System. DNS can be thought of as an attendance register for various websites present over the internet. In the case of DNS, it maintains the database of all the websites Domain Names and their IP (Internet Protocol) addresses that are operational all over the world. Historical Notes The origins of DNS date back to the time of the ARPANET  when there were only a few computers to get an entry in the database. A HOSTS.TXT file was maintained by Stanford Research Institute, which constituted the data of all the machines, and was copied by all the host machines to remain updated. Jon Postel from the Information Sciences Institute requested Pau...
Post a Comment
Read more

Perform cmd death attack

 A ping packet can also be malformed to perform denial of service attack by sending continuous ping packets to the target IP address. A continuous ping will cause buffer overflow at the target system and will cause the target system to crash.  We often use the CMD command “Ping” to mostly check if a server or a gateway is up and running. But, ping command can also be used for some other purposes. If we look at the basic level, then a ping packet is generally of size 56 bytes or 84 bytes (including IP header as well). However, a ping packet can also be made as large as up to 65536 bytes. Well, that’s the negative side of the ping packet. When we increase the size of the ping packet unnaturally, forming a malformed ping packet to attack a computer system, this type of attack is called “Ping of death” attack. How Ping of Death attack works? Not all computers can handle data larger than a fixed size. So, when a ping of death packet is sent f...
Post a Comment
Read more