Researchers from Newcastle University, UK while exposing the flaws in the VISA payment system found neither the network nor the back was able to detect attackers making various, invalid attempts to get payment card data. The attack is so-called “Distributed Guessing Attack” which can bypass every security feature that is implemented to protect online users in a matter of seconds. This technique works by automatically generating variations of the card security data across multiple websites until hackers are able to land on a “Hit” for each required piece of information. Investigators claim that this technique is likely to have been used in the recent Tesco cyber attack which the team describes as “frighteningly easy if you have a laptop and an internet connection.” Mohammed Ali, a PhD student at Newcastle University said “This sort of attack exploits two weaknesses that on their own are not too severe but when used together, present a serious risk to the whole payment system” He also said, “Firstly, the current online payment system does not detect multiple invalid payment requests from different websites”. “This allows unlimited guesses on each card data field, using up to the allowed number of attempts – typically 10 or 20 guesses – on each website,” “This allows unlimited guesses on each card data field, using up to the allowed number of attempts – typically 10 or 20 guesses – on each website,” “Secondly, different websites ask for different variations in the card data fields to validate an online purchase. This means it’s quite easy to build up the information and piece it together like a jigsaw” “The unlimited guesses, when combined with the variations in the payment data fields make it frighteningly easy for attackers to generate all the card details one field at a time,” “Each generated card field can be used in succession to generate the next field and so on”. “If the hits are spread across enough websites then a positive response to each question can be received within two seconds – just like any online payment” “So even starting with no details at all other than the first six digits – which tell you the bank and card type and so are the same for every card from a single provider – a hacker can obtain the three essential pieces of information to make an online purchase within as little as six seconds” https://www.youtube.com/watch?v=uwvjZGKwKvY So, hackers use online payment websites to guess the data and the reply to the transaction will confirm whether the guess was right or not. By this way, hackers can easily gain credit/debit card details. However, the team found that currently, the VISA network was vulnerable. So, you can get full details on the research paper that were published in the academic journal IEEE Security and Privacy.
