That allowed him to carry out the same bruteforce attacks, find the numbers of activated cards, and exploit them just as he had in 2015. He found that many gift card purveyors now use a CAPTCHA on their card value-checking page that he can strip away simply by disabling javascript elements on the page, using the software tool Burp Proxy. Potential targets, including Trader Joe's, Macy's, and Taco Bell, have all responded by either taking down their gift card value-checking web pages and requiring users to check their gift cards by phone or by adding CAPTCHAs to their card value-checking web pages, designed to prevent automated programs from bruteforcing gift card numbers.But other restaurants, retail outlets, and companies, which Caput declined to name on the record, have either failed to implement security measures against his fraud trick or added a defense that he was able to circumvent. The person’s card says it has $50 on it, and then it’s gone.' Balancing ActCaput has been warning retailers and restaurants about his scheme since he first discovered it nearly two years ago. “You take a small sample of gift cards from restaurants, department stores, movie theaters, even airlines, look at the pattern, determine the other cards that have been sold to customers and steal the value on them.”. And as analysis of the recently shows, actual criminals have made prolific use of those schemes too.“You’re basically stealing other people’s cash through these cards,” says Caput, who now works as a researcher for the firm Evolve Security.
While some of those methods have been semipublic for years, and some retailers have fixed their security flaws, a disturbing fraction of targets remain wide open to gift card hacking schemes, Caput says. They include all-too-simple tricks that hackers can use to determine gift card numbers and drain money from them, even before the legitimate holder of the card ever has a chance to use them.
The Gift GriftAfter years of examining the retail gift card industry following that initial discovery, Caput plans to present his findings at the Toorcon hacker conference this weekend.
0 kommentar(er)
