How to outsmart antifraud - two-way ping for carding

[Hacker]

Introduction:

Imagine some Michael from the USA who wants to pay for an iPhone. He enters the shop, sees payment through the PP, registers the account and pays. Michael does not keep track of his self-registration, does not swing with purchases of tea and other offal, he comes in and pays. Michael does not need to gain the trust of the PP, read entire threads on such forums before buying something for himself. So how can we seem to be Michael and not Boris in the eyes of an antifraud.

1. Ports

Imagine that you are an anti-fraud. Sit looking at orders and then a person who has 80,443,3389,22 open ports wants to buy from you. Just looking at these ports it is already clear what this person is planning. socks, proxy.

Solution: we use the RDP on which we configure the firewall or on the tunnel we raise the firewall.

2. Two-way ping and belonging to a hosting provider.

Two-way ping detects tunnels, VPNs and socks based on the ping and time difference received in the loop.

Solution: before the tunnel, vpn or socks, add TOR.

Belonging to a hosting provider – well, I think it's clear here, we don't use tunnels, socks, vpn hosting providers, consider if the ip belongs to the hoster, then it's in black.

3. Webrtc and DNS

There is a lot of information on preventing these leaks, I will not duplicate them 1000 times now. Just keep in mind that they need to be checked and fixed.

From yourself: do not use the DNS from Google, as your actions are logged.

4. OS language and timezone = cardholder

Of course, we include it, because we have nothing to fear and we can pay for goods from our account. In general – do not arouse suspicion

I recommend checking for leaks via browserleaks.com

5. Tab history and refer

Used by antifraud to detect recently visited sites.

Everything is simple here, no whoers and other sites that cause pale yellow.

We walk around google and Facebook, imitating Michael's behavior.

Refer-determines which site we came from, so we go from Google like all people.

6. Тab name

In short, using this parameter, antifraud sees all open tabs in your browser in real time.

7. Audio fingerprint

https://audiofingerprint.openwpm.com/ - test

I checked on the main OS and on a virtual machine with anti-detection – the fingerprints are the same. I haven't tested it on RDP yet, so check it on RDP and unsubscribe

An audio fingerprint can really hurt you in 2 cases:

1) Deanonymization. Let's say that you go to the site of a software company and they take an audio fingerprint from you. Then, after a successful case, you turn off the virtual machine and go to YouTube or Google ,even worse if in social networks and all these sites you also have an audio fingerprint. Deanonymization will roughly look like this: "20: 00 fingerprint 2a3b4c5e entered the PP under the ip 192.168.0.1, 20: 30 fingerprint 2a3b4c5e entered YouTube under the ip 192.168.1.100 (The ip from which you came to YouTube)”

2) PP or other sites can use this fingerprint to see that you have already visited them.

Solution: watch the latest Vector webinar on substituting this parameter.

8. Uptime and OS fingerprint

Uptime is the time that your vpn, socks, or tunnel is online.

Agree it's strange that Michael's computer has been running without a reboot for half a year

Solution: go to the tunnel console and write reboot

OS fingerprint – in simple language, each OS has different packages. That is, when you use a tunnel on top of Windows, it turns out that the packages you have are from Linux and the user is a Windows agent

Solution: use RDP or raise the openvpn server on the tunnel and add the mssfix 0 line to the server and client configuration. There is a simpler solution to this problem, but it is still at the testing stage.

 

[Lord777]

Antifraud in carding. Fast, cheap ... excellent
This article is a description of an experiment to create a system for detecting fraudulent payments on bank cards.
In this part of the article, I will tell you why the issue of fraudulent payments (fraud) is so acute for all participants in the electronic payment market - from online stores to banks - and what are the main difficulties, because of which the cost of developing such systems is sometimes too high for many ecommerce market participants.

Get Started!
The rapid growth in the number of transactions with plastic cards made via the Internet poses more and more challenges to the developers of online payment acceptance systems associated with the growth of the scale of such systems and the complication of approaches to ensuring their reliability and security.

The number of fraudulent transactions and the variety of types of fraud are also growing rapidly. Russia, along with England, France, Germany, Spain, is in the top 5 European countries in terms of the annual volume of fraudulent transactions with bank cards. The total losses from card fraud in 2021 in Europe exceeded 1 billion euros. Russia accounts for 110 million euros, of which 2.4 million euros are fraudulent payments on the Internet.

The complete chain of participants in an online payment when buying a product / service via the Internet generally looks.

Who is who? Merchant - a seller of a product / service, is a web application in which a client can pay for a product / service.

Client - a buyer who pays for a product / service on the merchant's website using his bank card (or in any other available way).

Electronic payment system (PS) is a service that accepts payment by electronic money, bank cards (and not only) via the Internet.

Acquiring bank - a bank that provides services for processing payments by bank cards;

International Payment System (IPS) is a system of settlements between banks of different countries that use uniform standards of means of payment. Examples of IPS: Visa, Master Card, American Express.

Issuing bank - the bank that issued the bank card with which the client is trying to pay for the product / service.

Problem
The problem of fraudulent transactions frauf affects all participants in the chain: from customers to the bank that issued the card to the client (the issuing bank). For all participants with the exception of cardholders, fraudulent transactions involve both significant financial costs and reputational risks. For the e-commerce industry as a whole, fraud also has tangible negative consequences - both lost profits and mistrust on the part of Internet users, which, in turn, hinders the wider spread of electronic payments.

Thus, the presence of a fraudulent payment recognition system ( antifraud system ) for any serious participant in an online payment (again, except for the buyer) is a market necessity. At the same time, a good anti-fraud system often means "long, expensive ..." and complications.

Difficulties of the solution

Financial difficulties: development cost vs fraud penalties
And if for a bank the costs of antifraud systems are, on a business scale, a perfectly acceptable amount; for the payment system - an integral part of the business process; then merchants often do not have the financial ability and / or understanding of how to create and maintain such systems.

But the merchant cannot ignore the fraud: the money for fraudulent payments will simply not go to the merchant in the best case (even if the service has already been provided), in the worst case, the merchant will also be fined. The amount of the fine, in general, starts at $ 10 and grows in proportion to the volume of fraudulent transactions. In addition, with a large amount of fraud, MPS (Visa, MasterCard) may impose (I'm not afraid of this word) sanctions on the merchant.
An effective way to reduce costs on the side of the merchant can be the introduction of additional complexities of checks for the client and delegating part / all of the responsibilities of checking for fraud to another participant. The most common method is 3-D Secure (delegation of the responsibility for verification to the issuing bank).

3-D Secure is a protocol that adds an extra layer of security for online credit and debit cards. In essence, it is a two-factor authentication of the cardholder.
But it should be borne in mind that the addition of such steps, which require additional actions from the user, often lead to a dramatic decrease in the number of successfully completed transactions (@Gremnix announced the figure for a decrease in the number of successful payments by 20-25% when 3-D Secure is enabled).

Legal difficulties
In the process of developing an anti-fraud system, you will inevitably have to deal with such a responsible area as the protection of customer and payment data, as well as with the formal part of this issue - certification for one of the PCI DSS levels ...
About PCI PSSPCI DSS (Payment Card Industry Data Security Standard) is a payment card industry data security standard, which is a list of requirements for ensuring the security of storage and transmission of payment data.
When developing an anti-fraud system, it is also necessary to take into account some legal restrictions on the storage / exchange of payment and personal data of the client.

Technical Difficulties
The anti-fraud system is a business-critical system, because its downtime will either lead to a halt in the business process, or, in case of incorrect operation of the system, to an increase in the risks of financial losses for the company.
Hence the increased requirements for operational reliability, data storage security, fault tolerance, and scalability of the system.

In the team developing the anti-fraud system, the following roles and areas of responsibility of these roles can be distinguished:

• an expert in the subject area : payment systems, banking systems, payment via the Internet, legal nuances of the operation of such systems;
• architect : designing a highly available, reliable (better distributed and scalable) application;
• developer : high-level programming language, asynchronous and multi-threaded programming, good mathematical background;
• data scientist : Researcher, loves data and math
• project manager (where can I do without them): coordination of development.

Merchant advantages
In the entire online payment chain, the merchant is in one of the most difficult situations: the merchant, unlike the buyer, is responsible for fraud with its own funds, and at the same time, unlike the bank, it often does not have sufficient resources to effectively counter fraud.

But the merchant also has an advantage - unique information about the buyer of the product / service, which is often not available to other participants in the online payment (for example, the issuing bank or the IPS). So ECN-sites most likely have the real name of the payer; online offering stores delivery services are likely to know the real country, city of residence of the payer, etc.

The name, surname of the account holder, the lifetime of the account, the number of previously made successful payments through the merchant's website, information about the host from which the http request came, information about the browser - this is just a short list of the information that is often available to the merchant and which is capable of significantly improve the efficiency of searching for fraudulent transactions.

To be continued ...
We have covered the main aspects of the problem of fraudulent payments. It is obvious that insufficient attention to fraudulent payments leads to significant financial costs. At the same time, the development of a full-fledged anti-fraud system requires financial costs both for infrastructure and for paying for the work of a team of specialists with rather rare competencies.

In the following parts of the article, an experiment will be carried out, the goal of which will be to create a distributed, highly scalable, fault-tolerant system for detecting fraudulent payments.

The antifraud system will be available as a web service and it will be possible to connect to the service of third-party merchants. The financial goal will be to make the development of the service an order of magnitude (s) cheaper through the use of a number of approaches leading to a significant reduction in the initial financial costs of hardware and software, a reduction in the number of specialists and spent man-hours.