- New research reveals the ease with which criminals can hack an account without ANY of the card details
- Dubbed the Distributed Guessing Attack, the team from Newcastle University, UK, say it can take just six seconds to find the card number, the expiry date and the CVV using nothing more than a laptop and an internet connection
- Circumventing all the security features put in place to protect online payments from fraud, investigators on the recent Tesco cyberattack believe that hackers used a 'guessing attack' method to defraud Tesco customers of £2.5m
Working out the card number, expiry date and security code of any Visa credit or debit card can take as little as six seconds and uses nothing more than guesswork, new research has shown.
New research reveals the ease with which criminals can hack an account without ANY of the card details. Expiry date and security code of any Visa credit or debit card can take as little as six. Contactless Payment Card Hack Affects Apple Pay, Visa. A team of researchers has demonstrated a new attack method that affects iPhone owners who use Apple Pay and Visa payment cards. The vulnerabilities exploited in the attack remain unpatched, but the impacted vendors say they are not concerned. The research was conducted by researchers at the.
Research published in the academic journal IEEE Security & Privacy, shows how the so-called Distributed Guessing Attack is able to circumvent all the security features put in place to protect online payments from fraud.
Exposing the flaws in the VISA payment system, the team from Newcastle University, UK, found neither the network nor the banks were able to detect attackers making multiple, invalid attempts to get payment card data.
By automatically and systematically generating different variations of the cards security data and firing it at multiple websites, within seconds hackers are able to get a 'hit' and verify all the necessary security data.
Investigators believe this guessing attack method is likely to have been used in the recent Tesco cyberattack which the Newcastle team describe as 'frighteningly easy if you have a laptop and an internet connection.'
And they say the risk is greatest at this time of year when so many of us are purchasing Christmas presents online.
'This sort of attack exploits two weaknesses that on their own are not too severe but when used together, present a serious risk to the whole payment system,' explains Mohammed Ali, a PhD student in Newcastle University's School of Computing Science and lead author on the paper.
'Firstly, the current online payment system does not detect multiple invalid payment requests from different websites. This allows unlimited guesses on each card data field, using up to the allowed number of attempts - typically 10 or 20 guesses - on each website.
'Secondly, different websites ask for different variations in the card data fields to validate an online purchase. This means it's quite easy to build up the information and piece it together like a jigsaw.
'The unlimited guesses, when combined with the variations in the payment data fields make it frighteningly easy for attackers to generate all the card details one field at a time.
'Each generated card field can be used in succession to generate the next field and so on. If the hits are spread across enough websites then a positive response to each question can be received within two seconds - just like any online payment.
'So even starting with no details at all other than the first six digits - which tell you the bank and card type and so are the same for every card from a single provider - a hacker can obtain the three essential pieces of information to make an online purchase within as little as six seconds.'
How the Distributed Guessing Attack works
To obtain card details, the attack uses online payment websites to guess the data and the reply to the transaction will confirm whether or not the guess was right.
Different websites ask for different variations in the card data fields and these can be divided into three categories: Card Number + Expiry date (the absolute minimum); Card Number + Expiry date + CVV (Card security code); Card Number + Expiry date + CVV.
Because the current online system does not detect multiple invalid payment requests on the same card from different websites, unlimited guesses can be made by distributing the guesses over many websites.
However, the team found it was only the VISA network that was vulnerable.
'MasterCard's centralised network was able to detect the guessing attack after less than 10 attempts - even when those payments were distributed across multiple networks,' says Mohammed.
At the same time, because different online merchants ask for different information, it allows the guessing attack to obtain the information one field at a time.
Mohammed explains: 'Most hackers will have got hold of valid card numbers as a starting point but even without that it's relatively easy to generate variations of card numbers and automatically send them out across numerous websites to validate them.
'The next step is the expiry date. Banks typically issue cards that are valid for 60 months so guessing the date takes at most 60 attempts.
'The CVV is your last barrier and theoretically only the card holder has that piece of information - it isn't stored anywhere else.
'But guessing this three-digit number takes fewer than 1,000 attempts. Spread this out over 1,000 websites and one will come back verified within a couple of seconds. And there you have it - all the data you need to hack the account.'
Protecting ourselves from fraud
An online payment - or 'card not present' transaction - is dependent on the customer providing data that only the owner of the card could know.
Visa Hacker
But unless all merchants ask for the same information then, says the team, jigsaw identification across websites is simple.
So how can we keep our money safe?
'Sadly there's no magic bullet,' says Newcastle University's Dr Martin Emms, co-author on the paper.
'But we can all take simple steps to minimise the impact if we do find ourselves the victim of a hack. For example, use just one card for online payments and keep the spending limit on that account as low as possible. If it's a bank card then keep ready funds to a minimum and transfer over money as you need it.
'And be vigilant, check your statements and balance regularly and watch out for odd payments.
'However, the only sure way of not being hacked is to keep your money in the mattress and that's not something I'd recommend!'
###
Note: Hacking credit cards is an illegal act, this is only informational post and I am not responsible for any actions done by you after reading this tutorial. This post is for educational purposes only.
Lets start with some easy terms.
What is credit card ?
Credit cards are of two types:
- Debit Card
- Credit Card
1. Debit means u have a sum of amount in it and u can use them.
2. Credit means u have a credit line limit like of $10000 and you can use them and by the end of month pay it to bank.
To use a credit card on internet u just not need cc number and expiry but u need many info like :
- First name
- Last name
- Address
- City
- State
- Zip
- Country
- Phone
- CC number
- Expiry
- CVV2 ( this is 3digit security code on backside after signature panel )
If you get that info you can use that to buy any thing on internet, like software license, porn site membership, proxy membership, or any thing (online services usually, like webhosting, domains).
If u want to make money $ through hacking then you need to be very lucky? you need to have a exact bank and bin to cash that credit card through ATM machines.
Let me explain how ?
First study some simple terms.
BINS = first 6 digit of every credit card is called 'BIN' (for example cc number is : 4121638430101157 then its bin is '412163'), i hope this is easy to understand.
Now the question is how to make money through credit cards. Its strange?, well you cant do that, but there is specific persons in world who can do that. They call them selves 'cashiers'. You can take some time to find a reliable cashiers.
Be sure cashiers are legit, because many cashiers r there which take your credit card and rip u off and don't send your 50% share back.
You can also find some cashiers on mIRC *( /server irc.unixirc.net:6667 ) channel : #cashout, #ccpower
Well, check the website where u have list of bins and banks mostly 101% cashable. If u get the credit card of the same bank with same bin, then u can cashout otherwise not . Remember for using credit card on internet u don't need PIN ( 4 words password which u enter in ATM Machine ), but for cashout u need. You can get pins only by 2nd method of hacking which i still not post but i will. First method of sql injection and shopadmin hacking don't provide with pins, it only give cc numb cvv2 and other info which usually need for shopping not for cashing.
- Credit Card Hacking
- CC (Credit Cards) can be hacked by two ways:
- Credit Card Scams ( usually used for earning money , some times for shopping )
- Credit Card Shopadmin Hacking ( just for fun, knowledge, shopping on internet )
1. Shopadmin Hacking
This method is used for testing the knowledge or for getting the credit card for shopping on internet, or for fun, or any way but not for cashing ( because this method don?t give PIN - 4 digit passcode ) only gives cc numb , cvv2 and other basic info.
Shopadmins are of different companies, like: VP-ASP , X CART, etc. This tutorial is for hacking VP-ASP SHOP.
I hope u seen whenever u try to buy some thing on internet with cc, they show u a well programmed form, very secure. They are carts, like vp-asp xcarts. Specific sites are not hacked, but carts are hacked.
Below I?m posting tutorial to hack VP ASP cart. Now every site which use that cart can be hacked, and through their *mdb file u can get their clients 'credit card details', and also login name and password of their admin area, and all other info of clients and comapny secrets.
Lets start:
- Type: VP-ASP Shopping Cart
- Version: 5.00
- How to find VP-ASP 5.00 sites?
- Finding VP-ASP 5.00 sites is so simple?
1. Go to google.com and type: VP-ASP Shopping Cart 5.00
2. You will find many websites with VP-ASP 5.00 cart software installed
Now let's go to the exploit..
The page will be like this: ****://***.victim.com/shop/shopdisplaycategories.asp
The exploit is: diag_dbtest.asp
Now you need to do this: ****://***.victim.com/shop/diag_dbtest.asp
A page will appear contain those:
- xDatabase
- shopping140
- xDblocation
- resx
- xdatabasetypexEmailxEmail NamexEmailSubjectxEmailSy stemxEmailTypexOrdernumber
Example:
The most important thing here is xDatabase
xDatabase: shopping140
Visa Hack Tool Download
Ok, now the URL will be like this: ****://***.victim.com/shop/shopping140.mdb
If you didn?t download the Database, try this while there is dblocation:
xDblocation
resx
the url will be: ****://***.victim.com/shop/resx/shopping140.mdb
If u see the error message you have to try this :
****://***.victim.com/shop/shopping500.mdb
Download the mdb file and you should be able to open it with any mdb file viewer, you should be able to find one at download.com, or use MS Office Access.
Inside you should be able to find credit card information, and you should even be able to find the admin username and password for the website.
The admin login page is usually located here: ****://***.victim.com/shop/shopadmin.aspIf you cannot find the admin username and password in the mdb file or you can but it is incorrect, or you cannot find the mdb file at all, then try to find the admin login page and enter the default passwords which are:
Username: admin
password: admin
Visa Debit Card Hack
OR
Username: vpasp
Visa Hack Download
password: vpaspMirror Download