Hot answers tagged

9

Ask your credit card provider for a one-time card number. Or get a new account with a low limit. Put the credit card number (and maybe a short random string) in a plain text file. 7zip this file with AES encryption. Email the hotel with this file as an attachment. Phone them and tell them the password to decrypt the file. (You might have to do a bit of "...


6

If you really used proper end-to-end HTTPS then nobody in between your client and the server could sniff it, no matter if VPN or not. Of course this means that there is a proper certificate validation and you did not skip warnings about invalid certificates. Thus I would consider it more probably that the data were sniffed either before they got encrypted ...


6

If your debit card has an NFC chip on it (the "tap to pay"), it's possible. This presentation discusses two methods. One is skimming an NFC card and using the recovered data for making Card Not Present transactions online. The other is called a "pre-play" attack, where "future transactions" are skimmed from the card in your pocket, and used to make ...


5

Can an attacker get information off the card? Yes, at least some can, and the UK consumer group Which? mentioned in the question did it: Our researchers tested 10 cards (six debit and four credit, from volunteers) to assess security risks. Contactless cards are coded to 'mask' personal data, but using an easily obtainable reader and free software ...


4

Yes, this address can be shared by multiple users. For example: Mobile phone providers often route their 3G/4G traffic for their subscribers via the same public IP. Some ISPs have shared public IP addresses - historically notably AOL. Corporations often have single or multiple gateways, meaning their employee traffic will be shared via the same external ...


4

It's called HTTP header enrichment. The MSISDN (mobile phone number) is injected in the header once the user hits a whitelisted URL by the operator. Not visible through http://headers.cloxy.net. The surprise payment was made through something called clickjacking (google it for more info). Basically your friend needs to complain to operator's customer ...


4

If you can trick them into clicking something in an email, you can send them a link to any page that you have access to the webserver logs for and find the request in the log (along with their IP). There are also a number of third party services to do this for you that are pretty easy to use (eg http://whatstheirip.com). Now, that said, some of the ...


4

One common attack method consistent with your symptoms is DNS Hijacking, which is any means that an attacker uses to convince your computer that your bank's web site, "www.mybank.com" is actually at an IP which is a server under their control instead of the IP under your bank's control. When you type this into any browser, it heads for the malicious server ...


4

With a weak kitchen magnet this can take many passes and a fair amount of time. In fact if all you have is a fridge magnet you may be better off scraping the strip off. However a more powerful magnet can erase the card fairly quickly. See http://www.creditcards.com/credit-card-news/video-magnets-make-credit-card-mag-stripe-not-work-1457.php for details. ...


3

This depends on which juridicsion or country you live in. For example, here in sweden, its safe to give out bank account number and routing information, because to extract money, you will need a valid ID-card tied to someone that is authorized to access the account, and of course, bank personell will of course check the ID card throughly including calling ...


3

I disagree with @quietsigns answer. There are other people that could potentially see your email. For one - email can be sniffed while in transit. Probably not super likely but still possible. Second - if the destination email is ever compromised (or is currently compromised) then it's likely that this email will just be sitting there. If you are really ...


3

Q1: Yes. The link for MagStripe reader and encoder 1 does exactly that. Can read credit or debit and write it to a new blank card and can also erase data on an existing card. the MSR605 comes with software to do all of this. These machines can clone ANY card with a mag stripe. Gift cards, hotel cards, rewards cards, credit cards, id cards, etc. Q2: Yes. you ...


2

Short answer Yes, they can. Long answer If you require PIN to do any transaction, they will have your cards' information, but they can't really do anything about it. Of course this is already bad, and it doesn't improve situation in any level. If it was a credit card that requires you to put zip code only (for example, US credit cards), then they can ...


2

Edit: If your website is about crowdsourcing, you probably should have mentioned that in the question right away because that's a very specific topic and different from online vendor scenarios. Yet the solution remains the same. The simplest way would be to hold any verified activities for each user in a database and thus verify if a user really has ...


2

The telephone system has been designed so that a caller can replace their phone number with a fake, and some unscrupulous companies use this to change their number to appear to be local to the person they are calling. They aren't using specific numbers of people you know, just something picked at random. The thinking is that a person is more likely to pick ...


2

So they hacked my router? I didn't even know that was possible, but now that I think about it, it is remotely accessible on the LAN and the username/password is the manufacturer default. Will a hard reset of the router and then changing the username/password be sufficient now? Download the newest firmware for your router to a computer. Scan for ...


2

Seems to be a Man In The Middle attack with DNS spoofing. I suggest to perform a ping from an online service like this and check the IP address of the site. Then type it into your browser URL bar and check if you get redirect to the false website.


2

It's quite common for hotels to pre authorise payment using your card details. This is to prove you are who you say you are and check you have sufficient funds for your stay. Although emailing may not be the safest way of sending your credit card details. Perhaps a phone call would be better but still not "secure" What I would suggest is that you opt to ...


1

Your iPhone (assuming its relatively current) can perform SMS relaying, sending/receiving messages using the iMessage app, on other devices that are logged in to your account. You should check your associated devices via the Apple web site to ensure there are no unknown devices listed and remove them if there are. Assuming you are not using a jailbroken ...


1

The quote is short, but I think the author is trying to say that the router wasn't about ATM skimming, and not even about the ATM itself. It was a MITM for customers who used WiFi (personal devices). In this case, it was just a rogue AP that presented a fake certificate to users, and the users (or their poorly written apps) had to accept the fake ...


1

This is a suggestion to try to narrow down where the issue may lie. In Chrome, I suggest opening an incognito window, then opening the developer tools. Switch to the the network tab. Type in the correct URL in Chrome and hit enter. If the request in the network tab has the wrong URL, then something on your computer is changing the URL (maybe a bad add-on ...


1

I would suggest making users use the "something I have" two factor authentication. One example is to send text message to verify the user upon registration or posting. Or limit customers ability to post if the account is new and have a "Wait time". You could go further and require geo-location on a mobile app that checks if the person is within the area ...


1

Plenty of things could have happened. To start with, emails which are not digitally signed cannot be trusted: they can be tampered with in transit (not very likely when the exchange is between two large providers) the sender can simply fake the email (such an email may not be accepted by the recipient's system and one could check the path it took to reach ...


1

If your connection was encrypted, as long as you haven't compromised your SSL cert chain at all, and the cert for the airline you chose wasn't compromised, and you were actually connected using HTTPS, I'd say most likely you weren't MITM'd over HTTPS. What a VPN provider COULD DO, however, is set up a MITM attack by stripping HTTPS at their end and then ...


1

If you get user IP with proper method that grab the user network global IP, it will be always unique. But users can send multiple proxy request at a time. To prevent that use captcha along with your IP validation. Than it should work perfect!



Only top voted, non community-wiki answers of a minimum length are eligible