Brute Force attack to get credit card numbers.

About Crackers using brute force to validate credit card numbers.

Date: Jan-2009

We were recently contacted by a Comersus user to report an attack with certain particularities.

The person who attacked his store had not found a security breach or had stolen data from his database but tried to make payments over and over again.

From a superficial analysis we noticed that the attacker was not trying to get merchandise since he did not even want to pass unnoticed. He created hundreds of users using the same data, placed orders with quantities that would have caught the attention in any type of store and did not even bother to use a name that looked real.

What was the purpose of this attack?

The attacker for sure had obtained partial credit card data from another store and was trying to fill in the gaps of that information to make fraudulent purchases. He probably didn't have the CVV2 or the ZIP code of the billing address.

In any case, the store owner was extremely upset since his database was being flooded with spurious information, the store performance had decreased due to the number of transactions generated by a bot script used by the attacker and last but not least: his payment gateway kept on charging for every transaction, even for those that had been rejected.

What to do in a similar case?

There isn't necessarily a failure in the shopping cart since the cart is allowing the posting of orders and payments.

The main action that an admin should take is to enable the Comersus functions that block these attacks. It's possible to block the attacker's IP, block the keywords he uses in his name or e-mail address and block the orders for more than certain amount (attackers typically place orders for high amounts to also determine the credit available in the card)

This helps preventing some attacks but others keep taking place since the attackers change IPs, keywords and in some cases, they even attack the payment script.

In these cases we advise you to:

1. Install a custom patch for the payment script so as to determine it belongs to a valid session, to an active and logged-in customer and to an order having a pending payment.

2. Install a captcha verification code on the payment script. That is, the customer will have to enter a verification code before making a payment.

3. Change payment gateways and use one that does not charge for rejected transactions.

If you need assistance with these tasks, Comersus customization services are available.

Lastly, please take into account the basic security recommendations before putting your shopping cart in production mode.

A. If you use Access database: rename the database folder, rename the mdb file and request your hosting provider tech support to prevent that file from being downloaded through the web.

B. Use strong passwords for your FTP, control panel, database and BackOffice. Use combinations of letters and numbers avoiding the use of common words.

C. Rename the backoffice folder.

D. Keep only strictly necessary scripts in your website. If you are not using the BackOffice Lite, delete the folder. If you don't use off-line credit cards, delete the comersus_offLinePaymentForm.asp script, etc. If you don't use PayPal, delete the comersus_gatewayPayPal.asp script.

E. Never leave your store in "automatic" mode. Log in to your BackOffice frequently and check that the payment, e-mail address and admin settings are being kept.

F. Update to the latest release of Comersus Cart

Comersus Open Technologies

>> Download Free Comersus ASP Shopping Cart here...

>> Visit our online demo here...

>> Contact Comersus here...