3

Back story

In South Africa there is a website where I can buy prepaid electricity online for my apartment. When buying I did not get the token to use on my metered box. I had a chat with them today and they gave a reason why I did not get my token. I'll paste the exact reason below.

Response from company representative

The reason for the delay is due to the following:

Your transaction will be delayed if we receive a transaction for the same amount with the same cellphone number within 5 days of a previous transaction. Please change your transaction amounts slightly to avoid delays. i.e. R200, R210 and then R220.

This is a precautionary measure to prevent fraud and corruption, and protects both you and us. Should you require more electricity within 5 days of a previous transaction please do a transaction with a different amount as the previous transaction.

I responded by saying there is a bug in their system as far as I am concerned, this is no security in my opinion.

It is a 12 hour delay now and they have apparently been using this for some time now.

Question

Is the response above really true? I did computer security in Varsity for a semester but I'm not deep into it. This response gives me an uneasy feeling. Is this one of the ways of detecting fraud for a company that sells prepaid electricity?

  • 3
    Sounds like they had a flaw whereby you could replay identical transactions, and rather than fixing it properly, have bolted on a restriction to prevent it. Not promising, security wise... – Matthew Jun 10 '16 at 11:03
  • No this would have zero effect on security and corruption. Nevertheless, choose your battle wisely. There is no use in trying to convince a helpless help desk representative who doesn't really understand security or their own system that the reasons they gave you is bull. – Lie Ryan Jun 10 '16 at 11:05
  • While it does not look like a security feature in the first place probably most or even all of us here have no knowledge of the fraud scenarios the company is confronted with. Without insight into these scenarios it is impossible to say if this is really a bug or if it actually detects fraud pattern which happen in practice. Therefore I propose to close the question because it will generate primarily opinion based instead of fact based answers. – Steffen Ullrich Jun 10 '16 at 11:12
  • @Matthew: Cui bono? – symcbean Jun 10 '16 at 11:18
  • 1
    @symcbean To their loss, potentially. Imagine they have a credit card processor which returns a token with a value and 5 day expiry, but their system doesn't track which tokens have been converted into credit (it happens...). Someone who can replay the tokens can generate credit out of nowhere - not necessarily from the online store, though. If you implement a check for what the last credit was, and that it has to be either older than 5 days, or a different value, you have a poor fix, but one that doesn't need you to store the used tokens in a new table. I've seen worse! – Matthew Jun 10 '16 at 11:25
1

Can multiple transactions of the same amount in a short time be considered fraud/corruption?

Yes, its something I monitor (or rather an agent I built monitors).

a transaction for the same amount with the same cellphone number within 5 days of a previous transaction

erk?

Personally I'm looking for multiple events occurring within a timescale of up to 10 seconds - but then I'm comfortable that the systems being monitored are not subject to replay attacks. However, you mentioned cellphone numbers implying that there is a high risk of SMS's being duplicated on the aggregator and the carrier before they arrive at the end point.

i.e. unless you stretch the definition of "integrity" as it is usually applied in the Security domain, their policy appears to address functional issues in the transaction process.

Is the payment charged via your cellphone provider or are you merely sending a mandate to the electricity company who bill you directly? The former provides a means for all sorts of chicanery, in the latter case, there is no obvious Security spin to this story.

I responded by saying there is a bug in their system

As per above - it may not be the fault of the electricity company. However since you had to chase them to get this explanation, they are clearly more interested in protecting themselves against fraud than protecting you.

Update

It has since occurred to me that it's possible the "token" might be data rather than physical (again a lot of guesswork about whats actually going on here) and hence might be the subject of the attack, or more specifically the algorithm by which the token is generated.

The service still sucks.

And if its possible to derive the algorithm from multiple orders for the same amount, then the security sucks too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.