Hello, welcome to the Tuesday, December 6, 2016 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich, and if I'm recording from Jacksonville, Florida.

For those of you into reverse engineering, Malver, Did he put together some videos for you that describe the recent Hank Hattor Malver that he wrote about. In his video,

he gives you a walkthrough through the analysis of this particular Malveh. It was sort of interesting

because it did actually actively bypass some whitelisting techniques. Now, anybody dealing

with credit card numbers probably realized that

prude-forcing credit card numbers is certainly a possibility. However, apparently

it's a lot easier than it was thought to be based on missing rate limiting in some

payment systems. The attack was demonstrated using some of the

largest e-commerce websites based on the Alexa Top 400 list. And apparently some of them do

actually allow an unlimited number of attempts to enter the credit card number. Some of them also do not

require a CV2 number, so those sites can then be used to prudeforth the credit card number,

and then another set of sites that ask for the CV2 number is then used to guess the CV2

number after the credit card number was found using the first set of sites.

Effected sites were notified by these researchers. Now they didn't list explicitly which sites

they found to allow an unlimited number of attempts, but of course it would be pretty easy for someone to figure this out

themselves. And of course, the actual payment processor like Visa doesn't have enough information

to realize that these requests that are coming in from different websites are actually

originating from the same source. And of course, a lot of people

wrote about a possibility of large denial of service attacks around Thanksgiving for Black Friday

or Cyber Monday, as it's sometimes called the Monday after Thanksgiving, which is sort of a peak

online shopping date. Well, it turns out that some large denial of service

attacks did indeed happen. Cloudflare has a nice write-up of what they have seen in the last

...