All online payments could be in danger of being hacked

Ecommerce
Image credit: Pixabay (Image credit: StockSnap / Pixabay)

Researchers have detected discussions on the dark web between cybercriminals concerning methids ways to bypass the most common security measures for online card-based transactions.

Experts from Gemini Advisory found that threat actors have adopted a strategy of using a combination of social engineering and phishing attacks to circumvent the 3D Secure (3DS) security measure.

While there are two versions of 3DS on offer, with the latter one being more technically resilient, the report notes that “phishing and social engineering schemes often transcend technical upgrades.”

Social engineering attacks

The 3DS protocol is a popular fraud prevention mechanism that adds an additional layer of verification to ensure the authenticity of online card-based transactions. 3DS 2 is the latest version of the protocol that’s designed to accommodate smartphones.

According to reports however, the original 3DS version is still widely used, which makes it easier for attackers to circumvent the security measures. 

What makes 3DS 2 more resistant to fraud, according to Gemini, is that it makes use of over a hundred key data points, including relevant contextual data from the merchant to validate the nature of the transactions.

Worryingly however, the researchers note that “while 3DS 2 is more difficult for cybercriminals to bypass, it is not impervious to well-honed social engineering skills.” 

So instead of directly brute-forcing their way through its security safeguards, cybercriminals instead work around them by crafting the right kind of social engineering campaign.

“Gemini Advisory assesses with moderate confidence that cybercriminals will likely continue to rely on social engineering and phishing to bypass 3DS security measures,” conclude the researchers, in a way hinting that in the end it’s up to the users to make sure they don’t fall prey to a well-designed social engineering scheme.

Via: BleepingComputer

Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.