solutions

在 Hacker News Daily 上看到「Visa Advertising Solutions (VAS) Opt Out (visa.com)」這篇講 Visa 的 Visa Advertising Solutions (VAS) Opt Out，本來以為是在討論企業賣資料的問題 (下面的討論的確是有在討論這個)，但最上面的討論居然是在討論 timing attack，像是這篇：

morpheuskafka 2 days ago [–]

Checked and the Mastercard one someone posted below doesn't seem to be vulnerable to this. My real card number and a dummy mastercard number with valid prefix and check digit both returned a 200 OK in around 1.01s. A random 16digit number without valid check digit returned 400 Bad Request in about 800ms. Decided to check that one since they have a completely useless machine-readable catchpa.

For Visa it was 835ms for valid, 762ms for dummy, prefix and check digit appears to be checked client side.

我印象中這類方式已經發展很久了 (透過網路反應時間的 timing attack)，討論裡面有提到「Exploiting remote timing attacks」這篇，也是十多年前的資料了... 不過官方網站玩起來總是有中特別爽的感覺 XDDD

不過 Visa 的這個網站前面用了 Cloudflare，用機器人掃感覺很容易被擋，這又是另外一回事了...

Tag: solutions

Gandi 被併購

Visa 網站上面的 Opt-Out 功能被拿來玩 Timing Attack...