Mohammed explains: "Most hackers will have got hold of valid card numbers as a starting point but even without that it's relatively easy to generate variations of card numbers and automatically send them out across numerous websites to validate them. "MasterCard's centralised network was able to detect the guessing attack after less than 10 attempts - even when those payments were distributed across multiple networks," says Mohammed.Īt the same time, because different online merchants ask for different information, it allows the guessing attack to obtain the information one field at a time. However, the team found it was only the VISA network that was vulnerable. To obtain card details, the attack uses online payment websites to guess the data and the reply to the transaction will confirm whether or not the guess was right.ĭifferent websites ask for different variations in the card data fields and these can be divided into three categories: Card Number + Expiry date (the absolute minimum) Card Number + Expiry date + CVV (Card security code) Card Number + Expiry date + CVV.īecause the current online system does not detect multiple invalid payment requests on the same card from different websites, unlimited guesses can be made by distributing the guesses over many websites. How the Distributed Guessing Attack works "So even starting with no details at all other than the first six digits - which tell you the bank and card type and so are the same for every card from a single provider - a hacker can obtain the three essential pieces of information to make an online purchase within as little as six seconds."
If the hits are spread across enough websites then a positive response to each question can be received within two seconds - just like any online payment. "Each generated card field can be used in succession to generate the next field and so on.
"The unlimited guesses, when combined with the variations in the payment data fields make it frighteningly easy for attackers to generate all the card details one field at a time.
This means it's quite easy to build up the information and piece it together like a jigsaw. "Secondly, different websites ask for different variations in the card data fields to validate an online purchase. This allows unlimited guesses on each card data field, using up to the allowed number of attempts - typically 10 or 20 guesses - on each website. "Firstly, the current online payment system does not detect multiple invalid payment requests from different websites. "This sort of attack exploits two weaknesses that on their own are not too severe but when used together, present a serious risk to the whole payment system," explains Mohammed Ali, a PhD student in Newcastle University's School of Computing Science and lead author on the paper. Investigators believe this guessing attack method is likely to have been used in the recent Tesco cyberattack which the Newcastle team describe as "frighteningly easy if you have a laptop and an internet connection."Īnd they say the risk is greatest at this time of year when so many of us are purchasing Christmas presents online. Research published in the academic journal IEEE Security & Privacy, shows how the so-called Distributed Guessing Attack is able to circumvent all the security features put in place to protect online payments from fraud.Įxposing the flaws in the VISA payment system, the team from Newcastle University, UK, found neither the network nor the banks were able to detect attackers making multiple, invalid attempts to get payment card data.īy automatically and systematically generating different variations of the cards security data and firing it at multiple websites, within seconds hackers are able to get a 'hit' and verify all the necessary security data.
#Bank of america visa credit card hack code
Working out the card number, expiry date and security code of any Visa credit or debit card can take as little as six seconds and uses nothing more than guesswork, new research has shown. Circumventing all the security features put in place to protect online payments from fraud, investigators on the recent Tesco cyberattack believe that hackers used a 'guessing attack' method to defraud Tesco customers of £2.5m.Dubbed the Distributed Guessing Attack, the team from Newcastle University, UK, say it can take just six seconds to find the card number, the expiry date and the CVV using nothing more than a laptop and an internet connection.New research reveals the ease with which criminals can hack an account without ANY of the card details.
0 kommentar(er)
