School of Computing Science<\/a> and lead author on the paper.<\/p>\n\u201cFirstly, the current online payment system does not detect multiple invalid payment requests from different websites. This allows unlimited guesses on each card data field, using up to the allowed number of attempts – typically 10 or 20 guesses – on each website.<\/p>\n
\u201cSecondly, different websites ask for different variations in the card data fields to validate an online purchase. This means it\u2019s quite easy to build up the information and piece it together like a jigsaw.<\/p>\n
\u201cThe unlimited guesses, when combined with the variations in the payment data fields make it frighteningly easy for attackers to generate all the card details one field at a time.<\/p>\n
\u201cEach generated card field can be used in succession to generate the next field and so on. If the hits are spread across enough websites then a positive response to each question can be received within two seconds \u2013 just like any online payment.<\/p>\n
\u201cSo even starting with no details at all other than the first six digits \u2013 which tell you the bank and card type and so are the same for every card from a single provider \u2013 a hacker can obtain the three essential pieces of information to make an online purchase within as little as six seconds.\u201d<\/p>\n
Distributed Guessing Attack<\/h3>\n
To obtain card details, the attack uses online payment websites to guess the data and the reply to the transaction will confirm whether or not the guess was right.<\/p>\n
Different websites ask for different variations in the card data fields and these can be divided into three categories: Card Number + Expiry date (the absolute minimum); Card Number + Expiry date + CVV (Card security code); Card Number + Expiry date + CVV.<\/p>\n
Because the current online system does not detect multiple invalid payment requests on the same card from different websites, unlimited guesses can be made by distributing the guesses over many websites.<\/p>\n
However, the team found it was only the VISA network that was vulnerable.<\/p>\n
\u201cMasterCard\u2019s centralised network was able to detect the guessing attack after less than 10 attempts \u2013 even when those payments were distributed across multiple networks,\u201d says Mohammed.<\/p>\n
At the same time, because different online merchants ask for different information, it allows the guessing attack to obtain the information one field at a time.<\/p>\n
Mohammed explains: \u201cMost hackers will have got hold of valid card numbers as a starting point but even without that it\u2019s relatively easy to generate variations of card numbers and automatically send them out across numerous websites to validate them.<\/p>\n
\u201cThe next step is the expiry date. Banks typically issue cards that are valid for 60 months so guessing the date takes at most 60 attempts.<\/p>\n
\u201cThe CVV is your last barrier and theoretically only the card holder has that piece of information \u2013 it isn\u2019t stored anywhere else.<\/p>\n
\u201cBut guessing this three-digit number takes fewer than 1,000 attempts. Spread this out over 1,000 websites and one will come back verified within a couple of seconds. And there you have it \u2013 all the data you need to hack the account.\u201d<\/p>\n