When Flashpoint talked with one of the affected retailers, the company's researchers determined that the seller was indeed using an automated tool to bruteforce activated gift cards, just as Caput has shown.

Flashpoint analyst Liv Rowley says one vendor on the dark web marketplace AlphaBay alone had made more than $400,000 in sales between November of 2016 and July of this year when AlphaBay was shut down by the FBI, largely by selling stolen gift cards for more than a dozen brands, including stores like OfficeMax and Whole Foods. In May security firm Flashpoint released a report in which the company found hundreds of discussions of 'cracked' gift cards on criminal web forums, spiking in the summer of 2016 and again in early 2017, compared with virtually none before 2016. The vulnerabilities that Caput found aren't merely theoretical. When it is, he can spend whatever money has been added to it. Then he simply checks on those numbers periodically via the restaurant or retailer's website until the card's been activated. If gift cards are left accessible, he can simply grab the entire stack of cards, photograph the back of them, and later place them back in the tray. The person’s card says it has $50 on it, and then it’s gone.' -Security Researcher Will CaputĬaput points out that even restaurants and retailers that have added robust CAPTCHAs to their gift card value-checking pages can remain vulnerable. By the time he finished his burrito, he had a plan to defraud the system. While the final four digits of the cards seemed to vary randomly, the rest remained constant except one digit that appeared to increase by one with every card he examined, neatly ticking up like a poker straight. So he grabbed them all-the cashier didn’t mind, since customers can load them with a credit card from home via the web-and sat down at a table, examining the stack as he ate his vegetarian burrito.Īs he flipped through the gift cards, he noticed a pattern. While there, still in the mindset of testing the restaurant’s security, he noticed a tray of unactivated gift cards sitting on the counter. He decided to drive to the local branch of the restaurant in Chico, California. So when 40-year-old Caput took a lunch break, he had beans and guacamole on his mind. In November of 2015, Will Caput worked for a security firm assigned to a penetration test of a major Mexican restaurant chain, scouring its websites for hackable vulnerabilities.

Defcon g2a