Anatomizing online payment systems: hack to shop
2 likes•1,936 views
The document discusses vulnerabilities in online payment systems that could allow hackers to conduct fraudulent purchases. It describes how hackers could exploit weaknesses like weak encryption, improper input validation, or modified transaction strings to "hack to shop" and buy items without paying. The document advises payment systems to follow security best practices like implementing strong encryption, conducting penetration tests, and remediating any issues found to prevent hackers from stealing goods through these means.
Anatomizing online payment systems: hack to shop
- 1. Anatomizing Online Payment Systems Hack To Shop Abhinav Mishra Senior Security Consultant To The New Digital
- 2. • The system - data flow and integrity • What you do not see at first sight… • The Bulls eye: Hack to shop • Legal deterrents • Hacking in #diehard style • How not to suck at security … What all this is about ??
- 3. Now the question is …..
- 4. • Senior Security Consultant @To The New Digital • Penetration tester, Bug Hunter • Music Lover, Movie buff • Linkedin: https://in.linkedin.com/in/enggabhinav Abhinav Mishra To The New Digital • Technology focused digital services company • Web & Mobile application security service provider • www.tothenew.com • [email protected], @TOTHENEW
- 5. The Money Game…. Seller Buyer Ecommerce Spot Yourself !!!
- 6. How does the money flow?
- 7. If transaction is the bull, where is the bull’s eye. Merchant Website Payment Gateway Eye 1 Payment Gateway Eye 2 OR Bank
- 8. Common Issues • Login over HTTP • Weak encryption • Improper Input validation Blah Blah Blah….. Not so cool right ???? So let’s cut the crap & hit the Bull’s eye….
- 9. What you do not see at first sight ?? Integrity??
- 10. Here comes the savior !!! MAC algorithms Custom Hashes AND..
- 11. The culprit – Now look again Interesting String
- 12. Let’s Play with it !!!
- 13. Let’s Play with it – Part 2 !!! And now you know where we are going ;-)
- 14. And Here you are – Hack to Shop Bought at 1.13 INR ….
- 15. And Here you are – Hack to Shop Part 2
- 16. Legal Deterrents • Payment Settlement • Audits • Dual verification • Multiple Forged payments from bank account
- 17. This Image is just to get your attention back… let’s move ahead…
- 18. Hacking in #diehard style • Find all similar implementations • Browser Addon or Python script as proxy • Modification of same parameter • Use of multiple bank accounts • Instant confirmations: movie tickets, railway tickets, online books, subscriptions, grocery shopping, recharge, bill payment and the list goes on….
- 19. Hacking in #diehard style – Part 2 Step 1: Browser Addon as a proxy, like Tamper Data
- 20. Hacking in #diehard style – Part 2 Step 2: Capture string Mod String Forward String
- 21. Hacking in #diehard style – Part 2 Step 3: Buy every damn thing
- 22. Hacking in #diehard style – Part 2 Step 4: Leave country ….
- 23. I Know it feels bad to know all this…. But…
- 24. How not to suck at security The solution is simple mate: • Strong means strong • If you don’t see it, it doesn’t means no one can • Stop behaving like a kid – admit your security sucks, go for Pentest • Follow all security best practices • HTTPS • Respect Hackers
- 25. Have Question??? Meet me in Person…. Or [email protected] Or https://in.linkedin.com/in/enggabhinav