Willium Caput, a researcher for the firm Evolve Security, examined a stack of gift cards he obtained from a major Mexican restaurant chain and noticed a pattern: aside from the final four digits of the cards that appeared to be random, the rest remained constant except one digit that appeared to increase by one with every card he examined. Andy Greenberg explains how Caput plans to defraud the system in his report via WIRED (Warning: source may be paywalled; alternative source): “You take a small sample of gift cards from restaurants, department stores, movie theaters, even airlines, look at the pattern, determine the other cards that have been sold to customers and steal the value on them,” says Caput. To pull off the trick, Caput says he has to obtain at least one of the target company’s gift cards. Unactivated cards often sit out for the taking at restaurants and retailers, or he can just buy one. (Not all cards change by a value of one, as that first Mexican restaurant did. But Caput says obtaining two or three cards can help to determine the patterns of those that don’t.) Then he simply visits the web page that the store or restaurant uses for checking a card’s value. From there, he runs the bruteforcing software Burp Intruder to cycle through all 10,000 possible values for the four random digits at the end of the card’s number, a process that takes about 10 minutes. By repeating the process and incrementing the other, predictable numbers, the site will confirm exactly which cards have how much value. “If you can find just one of their gift cards or vouchers, you can bruteforce the website,” he says. Once a thief has determined those activated, value-holding card numbers, he or she can use them on the retailer’s ecommerce page, or even in person; Caput’s written them to a blank plastic card with a $120 magnetic-strip writing device available on Amazon, and found that most retailers accept his cards without questions. (Caput only asks the store or restaurant to check the card’s balance, rather than spend any money from the cards belonging to actual victims.) “It’s a pretty anonymous attack,” Caput says. “I can go in, order food, and walk out. The person’s card says it has $50 on it, and then it’s gone.” Caput said he plans to present his findings at the Toorcon hacker conference this weekend.

Read more of this story at Slashdot.

Source: Slashdot – Hacking Retail Gift Cards Remains Scarily Easy