FWIW, we're aware of thousands of these dongles on the road today.
FWIW, we're aware of thousands of these dongles on the road today.
Sorry, I have contrary empirical evidence. On multiple different cars we have manipulated appropriate ECUs with the effect that you can push on the brake pedal with no impact on forward velocity (see autosec.org and also the paper this post refers to). I'll personally attest that it is so and that no matter how hard you step on the pedal that nothing is happening wrt braking. I believe that Charlie and Chris also accomplished the same thing with the vehicles they addressed in the first and most recent presentations.
Actually the economics here are not favorable to the scammer. For the class of goods being discussed here, most of the affiliate programs are fairly long lived (necessary precisely because they rely on independent contractors paid on commission to advertise their wares) and, as they advertise broadly, their storefronts are well known. Its simply not difficult to keep up with the top programs in any niche. It does indeed seem to take 2-4 weeks between the generation of a complaint and the merchant account shutdown, but the loss on the account is significant. First, accounts in some niches (notably pharma) have become extremely hard to come by. If you don't have a history of high turnover, you won't get boarded in this sectors and you'll need to go for third-party processing (at discount rates that can go up to 25%). Second, due to high risk, merchants can expect 10% holdback on 180 days revenue as collateral against future liabilities. Anecdotally, scammers report that this money goes out the window when they lose their account. Finally, empirically we see account replacement take a month or more and there's lost opportunity cost on missed sales. When you compare this against the cost of the test purchase... this is a huge asymmetry that does not favor the scammer.
Finally, in the course of our studies we've placed over 800 purchases on distinct credit cards (from pharma, software, replica goods and fakeav) and we have only a small handful of fraudulent charges (almost all associated with a data breach of a large online pharmacy) so our experience does not support the theory that all of these cards are being defrauded post facto.
In fact, even the company spokesperson admitted it's an extra-judicial process: "âoeIt doesnâ(TM)t require a judge, a law-enforcement officer or even much in the way of sophisticated security capabilities. If you can purchase a product, then thereâ(TM)s a record of it and that record points back to the merchant account getting the money,' Savage said."
So... you might want to read more closely. As the aforementioned Savage, I can assure you that I am not a company spokesperson, but rather an academic
You are correct that none of this is being done through law enforcement. The relevant mechanism is that the card association contracts with acquiring banks stipulate that their boarded merchants may not sell goods that are illegal in their country or that into which they are being sold. The complaints from brand holders represent assertions that such a contract violation is taking place. The card networks investigate with the acquiring bank and, if indeed a violation of their contract terms has taken place, then they can levy the penalties in their contracts. There is nothing extra-legal here in the sense that this is straight up contract enforcement. In principal the card associations could refuse to investigate or enforce a contract violation without the brand holders suing them, but that position seems extreme no? This kind of action happens in countless contexts, from manufacturing to real estate, without any judicial involvement unless one side contests the facts (and even then this would typically be a civil issue and not a criminal one) .
Seems like this was demonstrated four years ago, no?
Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses.
D. Halperin, T.S. Heydt-Benjamin, B. Ransford, S.S. Clark, B. Defend, W. Morgan, K. Fu, T. Kohno, and W.H. Maisel.
IEEE Symposium on Security and Privacy, May 18-21, 2008.
Page 7 of the linked paper.
there is zero possibility to send out a "lock up the breaks" command from the car stereo into the CANBUS unless you rewrite the stereo's firmware first. and that is not gonna happen,
I'd admit it is surprising, but you're wrong on this one. This is in fact one of the things we are able to do.
Does that make it a Danish bank or a Norwegian bank?
In this day and age its hard to tell. You could call it a Latvian bank too (that's what we did in the paper).
What is the connection to Denmark? I cannot find any mention of Denmark or any Danish bank in the study?
I suspect the connection is via DnBNord... the bank in our study was the Latvian branch, but I believe the headquarters are in Copenhagen (although as I recall the whole lot may be owned by DnB NOR in Norway.
Reprising a previous comment:
While the universe of banks willing to accept high-risk merchants is smaller than the total number of Visa association affiliates it is certainly far larger than three. If you got these three banks out of the game, there would be others to replace them. However, the more important asymmetry here is not in the size of the set, but in the switching time. If a merchant (or their payment processor more likely) starts to route transactions through a new acquiring bank, their identity will be revealed very quickly in any purchase authorization record. By contrast,the time to actually establish that new banking relationship (and get appropriate certificates from Visa, etc) takes days. This is one of those rare cases where the defender is able to respond far more quickly than the attacker.
Is suspect that the times article is referring to DnBNord Latvia which I think also has a Danish branch. I think they are all technically owned by DnB NOR in Norway.
Like they wouldn't go to another provider... much like they do now if they get shut down.
Of course they would. However, th key issue is the cost structure on each side. For us to discover the identify of the new bank being used takes a few minutes (seconds if we had direct access to VisaNet) and negligible cost (I just need to authorize a purchase from the site). There is no technical reason I'm aware of that you couldn't implement an issuer blacklist at similar time scales if you wanted to (I can think of lots of reasons it might not be a good idea to automate this, but the main point is that the time scale is short). Compare that to how much time and cost you think it takes to find a new bank willing to accept high-risk merchants. Its certainly doable, there area number of such banks, but its orders of magnitude more time.
Yes it is the business model of these banks. However, they are processing through a credit network (Visa / Mastercard) and consumers credit cards are backed by an issuing bank (think Chase, Citibank, etc). Either the credit network or the issuing bank can prevent the transaction without the cooperation of the shady acquiring bank.
This is precisely right. We too would expect that convincing foreign banks to dump their customers would, at best, be a slow process and would be unlikely to succeed as an general approach. Moreover, its not even clear if such activities are illegal in the jurisdiction of all these institutions (at some level these are all IP crimes after all). However, the money for these purchases is primarily from the US and thus direct interventions by domestic issuers is likely to be as effective as shutting down the acquiring institutions.
Now a separate question is whether this makes political and economic sense as a matter of public policy. That is certainly open to debate and there are probably reasonable arguments on both sides.
In general, the payment tier is only an appropriate point of intervention for those activities that are monetized via direct consumer payment. So it is appropriate for things like spam-advertised goods, fake-AV, gambling, porn, etc.... things for which it is hoped that the recipient will provide a credit card number to finance the underlying advertising activity. It is not useful for scams that employ an out-of-band payment scheme (e.g., pump-and-dump) or that are fundamentally focused on theft (e.g., phishing, 519, malware vectors, etc)
If all else fails, lower your standards.