MasterCard under DDOS, can't process SecureCode online payments

http://blog.securetrading.com/2010/12/mastercard-maestro-3-d-secure/

by gasull • 16 years ago

204 188 16 years ago

blog.securetrading.com

chrisbolt2• 16 years ago

Only SecureCode is affected (the MC equivalent of Verified by Visa), not all MasterCard online payments.

gasull• 16 years ago

Thanks. I updated the title.

marknutter7• 16 years ago

I think this is setting a very dangerous precedent. Yes, it was lame what Mastercard did to Wikileaks, but it wasn't technically illegal. What Anon is doing to Mastercard, however, is completely illegal and damaging, not only to MC but to its customers too (who are innocent bystanders in this case).

carbocation• 16 years ago

I'm going to try to articulate a position that I think that I understand but is not mine, so please bear with me.

Let's put aside what is "legal" and focus on what is "socially desirable" business behavior from the perspective of Anon. MasterCard, as a private entity, has wide leeway in how it chooses to deal with other private entities such as Wikileaks. Is this socially desirable? While I have no special insight into what Anon is thinking, I would surmise that they are not pleased that private entities are restricting free-flow of information and acting as a state's agents even when not compelled to do so by the force of law.

We've heard from many business (Amazon, PayPal, etc) that blocking WikiLeaks (and consequently inhibiting free distribution of classified US documents and secret corporate information) is, at its core, a profitable business decision. I would guess that Anon is trying to send a message that such an "anti-freedom" decision (scare quotes intentional) can instead become very expensive.

marknutter7• 16 years ago

But what is "socially desirable" is a completely subjective thing though. There could be a small group of Anons that think banning gays from entering the military is "socially desirable" and use that as a basis for taking down websites of companies who work with the military.

It's Mastercard's choice whom they do business with, and by launching this attack Anon is only further solidifying the misguided popular belief that Wikileaks is akin to a terrorist organization. It may seem like a victory in the short term, but in terms of Wikileak's PR I think it's a huge setback.

corin_2• 16 years ago

It's not a dissimilar concept to strike action, in that it may well have a negative effect on customers, but is believed to be neccesary none-the-less.

I fully support unions and strikers, however I'm not sure how I feel about this kind of action. The similarity ends with differences such as strikers have names, faces, spokespeople, they decide together if they are for or against striking, it isn't one or more people with nothing to do with the company who makes the decision.

ebaysucks2• 16 years ago

"Socially desirable" is the right way to think about it. Law has always been "mob rule", with competitive courts competing to define what this entails.

"Legal" just means the government agrees with it. The state claimed a monopoly on "law" along the way.

The tension we see today is that the "legal" does not represent the "socially desirable" / "law" anymore.

Granted, a binary offline/online result using DDOS attacks is a very rude reputation system, but the reputation feedback processes can be improved upon by competition (semantic web startups anyone?).

dagw• 16 years ago

The cynical part of my brain is currently quite convinced that there several members of some US security agency currently on 4chan instigating these pointless attacks in an attempt further turn public opinion against wikileaks and their supporters. People quickly switch from indifferent to hostile once they are personally affected.

borism7• 16 years ago

Ridiculous. USG agencies already have their hands full of dealing with this stuff, not adding more to it.

alextgordon• 16 years ago

If a bunch of script kiddies (albeit in considerable number) can take down MasterCard, then it's pretty much MasterCard's fault alone. It's not like they didn't have the money or opportunity.

eli11• 16 years ago

Seriously? Blame the victim?

marcinw• 16 years ago

A bunch of "script kiddies" can make any website unavailable for some period of time.

edit: The only difference is in how fast you manage to recover.

ceejayoz2• 16 years ago

Making Rosa Parks get out of her seat was lame but not technically illegal. Her refusal was completely illegal and plenty of folks argued it was damaging.

I don't see why civil disobedience should cease to be civil disobedience just because it's on a computer.

eli11• 16 years ago

Yes, and it kicked off the Montgomery Bus Boycott. Not slashing tires or road blockades.

tptacek2• 16 years ago

And here's the HN comment comparing an anonymous DDoS attack to Rosa Parks physically and nonviolently resisting an unjust law. The reverse-Godwin, right on schedule.

go37pi• 16 years ago

I think its a good problem solving tactic to try to look for analogous situations and gain insight into our current dilemma in doing so.

I think a better analogy might be a sit in. If you occupy all the seats in a restaurant, I think it kind of qualifies as a meatspace DOS. I guess the difference is that in civil rights sit ins of the 60s, the people sitting in actually wanted service.

I guess the digital analogue would be a bunch of people requesting permission to donate to Wikileaks, rather than permission to load the page. It seems the subtle difference is that civil rights groups actually wanted the service that they deny to others, while anon wants a service different from the one they are denying to others.

I guess its up to individuals whether they think the difference is significant.

lhnz• 16 years ago

I guess it goes to show that Mastercard should think about what is best for their customers as opposed to what is best for the government. The reality is that, nowadays, if you make an unpopular decision with a large part of internet users you may get DDOS'ed.

rorrr• 16 years ago

Visa + Mastercard is a duopoly. They have been abusing their domination for years. I don't feel sorry for MC.

marknutter7• 16 years ago

You do realize that there are actual human beings working for Mastercard who are just like you and I who are getting hurt by this, right? There are real people behind these websites.

roel_v4• 16 years ago

Meh. In a few years when we all depend on the internet even more, the law will catch up with this sort of internet petty vandalism. A couple of people will get sued and thrown into jail, joe schmoe user will be cut off from the internet the moment a ddos is detected from his ip, and people coordinating 4chan ddos'es will be tracked and arrested.

The only reason these things work today is because of a lack of urgency. I mean, when this starts happening every week, people will call for regulation, it may take a few years to get it sorted out politically, then another few before the policy catches up, and things like this won't be possible any more.

In the mean time, the damage done is relatively small. Yes it sucks for some online merchants, but let's not blow this out of proportion.

I remember 10 years ago there was a 'digital sit in' (the term 'ddos' didn't exist yet) on my at that time employer's website. There were camera crews coming in, interviewing our CEO's, it was big news. In reality, the effect was minor; averaged over the few days around it, the loss of sales was not even statistically significant.

ZoFreX• 16 years ago

I for one can't wait for the day when a government agency can detect that I'm initiating a DDOS from my home connection the second I start and immediately disconnect me, without a warrant, court order or trial.

tshtf• 16 years ago

I wonder if the perpetrators of this attack realize an attack against e-commerce may attract the attention of federal authorities more than one against a quasi-religious group.

fluidcruft• 16 years ago

Yeah, it's almost as if the government and large businesses only care about each other.

tobtoh• 16 years ago

Cyber warfare has always been a staple of sci-fi fiction, but generally between nation states. I can't help but wonder if the reality is that this 'warfare' won't be so much between nation states, but between governments and the public and we're witnessing the start of this with a secretive and paranoid government(s) on one side and a distrusting and increasingly activist 'public' on the other. Corporations are stuck in the middle looking at their bottom line, but pressured from both sides.

DanielBMarkham• 16 years ago

I read an interesting editorial a few months back -- can't remember where -- that basically made the counter-intuitive point that we are not headed towards totalitarianism. Far from it. We are headed towards mob rule.

The writer used the various strikes and protests in Europe as an example. His point was that as the nation-states became less relevant, people would begin to more closely associate in virtual groups than geographic ones.

I _also_ read the recent leaks about China, which leads me to believe that the Chinese think they can keep a lid on the internet.

This could be the beginning of a long, drawn-out period of chaos and overreaction by all sides. Sure would suck to have to choose between that and totalitarianism (even if, in the end, totalitarianism wouldn't work) Perhaps this is some author's overactive imagination though. I sure hope so.

smackay• 16 years ago

Public demonstrations in Europe these days are generally well-behaved. Probably the main motivation for taking to the streets is to ensure that the government at least acknowledges an issue rather than simply ignoring as was case in the past.

The anarchist groups active today are a little less troubling than groups like the Red Army Faction, Red Brigades and the Irish Republican Army that were a feature of the 1970's and 1980's.

The real danger of mob rule might come from unscrupulous politicians making capital from social tensions. The recent series of expulsions of Romany from France and Italy were certainly a very troubling reminder of Europe's recent history.

Perceval• 16 years ago

>we are not headed towards totalitarianism. Far from it. We are headed towards mob rule.

In Plato's Republic, he set up a cyclical theory of the progression from one form of government to the next. From aristocracy to timocracy to oligarchy to democracy to tyranny and back again to aristocracy.

The transition between democracy and tyranny was ochlocracy, a.k.a. mob rule, out of which emerges a demagogue.

itistoday• 16 years ago

> Corporations are stuck in the middle looking at their bottom line, but pressured from both sides.

Maybe some of them fall into this category, but many of the others are the ones pulling most of the strings.

They are responsible for millions of dollars in campaign contributions, whereby they essentially buy seats in the House and Senate and dictate much of the legislation. They influence voters through mass advertising and propaganda, they influence the representatives through lobbyists and the threat of withdrawing their financial support.

The "government" then becomes a battlefield between the ignorant, the manipulated, the enlightened, and the powerful manipulators sitting at the top.

CWuestefeld4• 16 years ago

many of the others are the ones pulling most of the strings

This seems to be a chicken-and-egg question to me. I'm not sure how you can determine whose strings are being pulled, and who are the pullers.

Is it really the corps that are coercing the politicians into misbehavior? Or is it the politicians that create an environment in which corporations can gain an advantage by doing so?

eli11• 16 years ago

I'm really not a fan of Internet mob justice. I don't see how this attack helps Wikileaks in any way. It's only going to make it harder to find anyone willing to do business with them.

nano81• 16 years ago

Exactly. Not only that, but it will make them seem even less sympathetic in the eyes of the general public.

cryptoz4• 16 years ago

It doesn't help WikiLeaks and it's not supposed to. What you're seeing is a group of people who looked at MasterCard's decisions, and reacted to prove them wrong.

MC thought that preventing money from going to some people who move information around was a smart business decision. Anonymous replied with, <<No, trying to prevent the free flow of information is a bad business decision.>>

They do this, presumably, with the idea that next time MC will think twice before doing their part in silencing the flow of information.

This is all irrelevant to WikiLeaks. They have nothing to do with this at all, except that their particular case provides Anon with a clear example to set for MC.

eli11• 16 years ago

You really think cyber terrorism is going to make Mastercard more likely to want to work with similar groups in the future?

jwr• 16 years ago

I am not a fan of mob justice either — but neither am I a fan of "tour de force" justice as practiced by Amazon, Mastercard and Paypal, under pressure from US Government. I think this is a relatively good way for everyone involved to learn that every action has consequences.

Notice that if there is no response at all from, let's call it "the internet crowd", then there will be no free speech on the internet. Any attempt to say anything which corporations aren't comfortable with (this includes anything that the governments aren't comfortable with) will be quickly silenced.

So, while I am not a fan of 4chan's DDOS attacks, I see them as a reaction — similar to crowds in the streets.

andrewingram• 16 years ago

I'm fairly naive about the specifics of a DDOS, but it's such an obvious vector of attack that I'm surprised it's a major vulnerability.

Could anyone explain what it would take to minimise vulnerability to such attacks? I would have expected the standard load on SecureCode to be pretty high anyway, so I'm surprised that an attack brought it down. I welcome anyone to fix my reasoning :)

cryptoz4• 16 years ago

There's really no way around a DDOS, except to pay for enough servers to swallow all the fake requests and real requests. That's probably far too expensive to do - at least for now. Maybe the cloud can bring a solution to this, with the idea of spinning up new VMs as needed.

Basically, if your site is open to the public then it's open to bots. And there are far more bots than people. So if someone directs their bots to your site, you'll go down.

End of story.

jacquesm6• 16 years ago

There are plenty of ways to defend against this kind of attack, with varying degrees of efficiency and automation.

marknutter7• 16 years ago

I wonder if it would be viable to offer DDOS protection in the form of a huge bank of servers that the victim could rent for a specific period of time to help alleviate the affects. Companies could pay for it like it's insurance.

nikcub• 16 years ago

The program that is being used is a multi-threaded .NET app that opens a lot of connections and then allows them to timeout.

Easiest form of DoS to carry out and easiest to defend.

Prevention:

a) Upstream forwarding proxy that will block all requests from an IP that hammers the server

b) Low timeouts (5-10 seconds)

c) Intelligent upstream router than can drop the routes

d) They are hitting mastercard.com, which should be distributed on a CDN

e) Separate the public website from the application, don't even but them in the same IP address block

At Techcrunch we survived a 4chan DoS attempt. Surprised Mastercard didn't (I think the scale of this attack is larger, but still)

wildmXranat• 16 years ago

>At Techcrunch we survived a 4chan DoS attempt

I wouldn't mention it; just my friendly advice. Anon is a fickle beast.

ubercore• 16 years ago

> I think the scale of this attack is larger, but still

That's a pretty large but, when a DoS is, by nature, all about scale.

icegreentea• 16 years ago

In fact, pretty sure it's this program:

http://en.wikipedia.org/wiki/LOIC

They even gave it a cute name.

I find the 'relinquish control' part really interesting. Someone could totally f anon over if a hivemind version with access to the OS was released. Yeah, you could only ever use it once, but once is enough. 4chan would reverb about it for months.

Also because I just kept imagining the program playing a clip of the Harbinger going "assuming direct control" whenever you relinquish.

calloc2• 16 years ago

The issue at hand, and what you have to minimize depending on what attack is being used, is malicious packets reaching your servers. Now, it is a fairly difficult task to figure out what packets are malicious and which packets are real as they definitely look alike.

Going with the latest web server attack (the long open connections with POST) there is not a whole lot of protection that could be afforded other than throwing more resources and more servers at the mix such that each of them can handle the open connections that are SLOWLY sending data to them. There could be time-outs, but those are easy to figure out with some experimentation and it doesn't require much to keep endless connections going forever and sending the bare minimum required to keep the connection alive.

Other attacks like ICMP ping floods just flood the network to the point that the routers are unable to physically carry the traffic from point A to point B. They start dropping packets. If at this point you attempt a TCP/IP connection it most likely will not get through in the large flood. ICMP traffic can be dropped at the door, letting legitimate traffic through again, and generally can easily be taken care of at the edge routers.

Then there are the various TCP/IP flood attacks which are mostly designed so that on the target a connection stays in an open queue whereby the host runs out of backlog so that it can't accept new connections, also known as half-open connections. SYN cookies help with this.

Or still the best method is to have a VERY large botnet of computers that attack the target so that the amount of traffic is simply overwhelming no matter the method used. If your server is on a 100 Mbit connection, you can NEVER accept 1 Gbit worth of data. Now multiply that and start looking at where in the infrastructure there is a bottleneck. If inside your network you can accept 10 Gb's a second, but your gateway router is only rated at 1 Gb's a second you can just choke the router and it doesn't matter what is behind it.

With massive DDoS attacks it becomes very costly, as you have to divert the traffic elsewhere first where it can efficiently be filtered for legitimate and non-legitimate and then have it be sent on to the actual backend servers that then respond.

Dylan168073• 16 years ago

You don't need to scale up to solve a problem of slow active connections. You just need to use a frontend web server that doesn't allocate a thread/process per connection.

m_eiman• 16 years ago

A better way to show Mastercard that you don't like what they're doing would be to cancel your Mastercard and/or stop accepting MC payments.

MikeCapone• 16 years ago

This only works if enough people do it AND tell MC (and possibly the media) why they're doing it, though.

protomyth4• 16 years ago

Yes, and that is how it is supposed to work. Boycotts and demonstrations not working, does not justify attacks.

DTanner• 16 years ago

The problem with this line of reasoning is that it is not a democratic response. The size of your wallet determines the size of your vote, which gives the millionaires and the multinationals all the votes.

user242• 16 years ago

I'll be interested to see if Mastercard's stock takes a dive as a result of this. Not that I don't expect it to recover quickly of course. But it does make me wonder who first suggested 'operation payback', and what exactly their motives were...

user242• 16 years ago

there's been no impact on their price that I can see so far.

adriand• 16 years ago

It's sort of interesting - maybe even ironic, although I don't know if that adjective is quite applicable - that when a news story comes out that says that a major website is down due to DDOS, the first thing I do - and probably what many others do - is try to go to that website to see if it's still down. That, of course, must make the situation so much worse.

jmg• 16 years ago

compared to the traffic the servers are seeing from the bots, the single requests of curious people is pretty negligible.

marknutter7• 16 years ago

The really sad part about this is the people who are probably getting most hurt by this are the web developers who maintain mastercard.com; probably a few fellow HNers. I'd hate to be in their shoes right now.

faragon• 16 years ago

Better attack: reduce the credit card usage, and try to pay more with cash. As both MasterCard and Visa (the ones against Wikileaks) take the gross of its revenue from retail and pay by credit, that could really hurt them... but without doing anything illegal. It's just business: you fuck Wikileaks, I reduce your profit, dear [put your favourite megacorp name here].

Boycott list:

    * Amazon (Amazon stops hosting WikiLeaks website [Reuters, 20101202])
    * Tableau Software (Another Falls: Tableau Software Drops Wikileaks Data Visualizations [20101202])
    * Everydns.net (WikiLeaks fights to stay online after US company withdraws domain name [guardian.co.uk, 20101203])
    * Paypal (WikiLeaks loses PayPal revenue service [cnn.com, 20101205])
    * PostFinance (Swiss bank freezes WikiLeaks founder's legal defense fund [rawstory.com, 20101206])
    * MasterCard (MasterCard pulls plug on WikiLeaks payments [cnet.com, 20101206]
    * Visa (WikiLeaks loses PayPal revenue service [ibnlive.in.com, 20101207])
    * Twitter??? (it was or it wasn't censorship?)

jorgem2• 16 years ago

Boycotts are good way to go. But for giant companies like Amazon and Paypal, it is unclear that they would be able to correlate determine why their sales are going down.

Unless the Boycott is huge.

euccastro3• 16 years ago

Both Amazon and Paypal ask you why you closed your account with them.

Now, if you just reduce your usage of their services, then you're right, it'll be hard to attribute.

decadentcactus• 16 years ago

Regarding Everydns.net, the impression I got was they withdrew their service not because of any specific disagreement with Wikileaks, but because it was negatively impacting their other customers (if 10,000 people kept requesting Wikileaks, the 20-30 other people trying to request other sites had to wait a lot longer). I'd agree with them on this one.

Andrew_Quentin• 16 years ago

If Private companies, all in concert, deny a party the ability to publish for whatever reason, is that different from government censorship?

I think not. It is of course if it is only one private company, because the individual has a choice, but if all private companies deny it, then the individual has no choice, thus it is no different than the government itself having denied it.

This that we are seeing, I believe, is the connection between corporations and government in action, the business-government complex if you like. Private companies should not have the right to discriminate based on other's beliefs or opinions.

ars• 16 years ago

So basically if you help wikileaks you'll be DDOSd by the (presumably) government. If you cut them off you'll be DDOSd by other parties.

The only solution is to have nothing to do with them. Not exactly an optimum solution - I'd much rather be cut off and constantly find new hosts than have people afraid to have anything at all to do with me.

These attacks are not helping wikileaks.

danilocampos2• 16 years ago

Disclaimer: I just finished Accelerando a few days ago (late to the party). I'm hopped up on futurist vision.

First, let's stipulate that 4chan's Anonymous raids are mostly juvenile and often ineffective at doing anything meaningful to their targets.

At the same time: The ability of a community to completely self-organize, without central direction, and instantly execute a publicly-visible plan like this is without precedent in human history.

It stands to reason that as time goes on, larger groups of people will become involved in communities that exhibit 4chan-like cohesion. A larger pool means a higher likelihood of these groups including people with the knowledge and ability to do ever-increasing damage.

The long-term implications are interesting. Into the future, are we talking about the instant formation and dissolution of "terrorist" or "dissident" groups, bound together by transient common interest and gone again within days or hours? If you're a government or corporation, this is terrifying. You can keep tabs on other governments, and even traditional terrorist cells, which each move at the speed of the usual group dynamics, proportional to their size.

But what the hell do you do about groups you can't predict that are gone before you even figure out what's wrong? Groups that aren't bound together by national identity or other easily quantified affiliations – just ideas, ideals and transient events?

There's something meaningful here that points to how we all get along in the future, in the same vein as the "post-secrecy world" presaged by Wikileaks-style activism enabled by network technologies.

Or maybe I just need a nap.

tvon• 16 years ago

> The ability of a community to completely self-organize, without central direction, and instantly execute a publicly-visible plan like this (...)

I don't see any reason to believe it went down that way.

It's probable it was a group who already had much of the ability in-place to execute an attack like this, and who decided to target mastercard.com because it was found to be vulnerable, or because paypal and amazon were out of thier reach.

danilocampos2• 16 years ago

That group would be Anonymous, in all of its gossamer affiliation. The idea of another group using 4chan/Anonymous as a front for its own goals seems needlessly complicated. "Anonymous" does all of this for Scientologists and cat abusers, why not Mastercard?

alanh2• 16 years ago

Not a real group so much as whoever wants in, is in, on a per-effort basis; a movement is spearheaded by an individual or two and each so-called member spontaneously decides whether to participate or not. “Anonymous” is hardly a group or organization, any more than the IRC channel for your favorite framework. A weak analogy is whenever Redditors decide to contribute to a certain cause or user. No one decided for the group, and there was no real vote, but nevertheless without the community most individuals would not have contributed.

Economist / Babbage: http://www.economist.com/blogs/babbage/2010/12/more_wikileak... (I think he gets the definition of OP wrong, but everything else seems to jive with my non-firsthand understanding.)

aarghh• 16 years ago

Reminds me of a Frank Herbert story called "Committee of the Whole". It concerns an engineer who makes public the plans and method to build a super-weapon from everyday household materials - and this makes government oppression a thing of the past and forces human beings to get along.

woodall2• 16 years ago

The idea of a giant hivemind conducting business as it sees fit frightens me. There are countless stories of 4chan, Reddit, et al. raiding the wrong individuals and causing great harm. Of course there are other times where everything goes better than expected, however, as Voltaire once said, 'It is better to risk sparing a guilty person than to condemn an innocent one.'

The internet has no filter. Information flows at a steady constant pace; in fact most communication now a days can take place immediately. This has its pros and cons. Pros, well its awesome. Cons, without a filter many people will jump on a bandwagon without knowing the full details of a situation.

Sometimes people do not think as logically as they think they are. Acting on hearsay and emotions alone will lead people to act reckless, and once that stone starts rolling it's hard to stop; zerg.

This should not be taken as a generalization of online networks as there are outliers in most situations. This is just a reminder that not everyone on the internet has other people best interest in mind. Some people are just mean.

The best relationships are somewhere in the middle.

loewenskind6• 16 years ago

>The idea of a giant hivemind conducting business as it sees fit frightens me.

What about a government doing as it sees fit? That should be more frightening to you because it's existing for a long time and it's cost countless lives. And it's still doing so.

motters• 16 years ago

As an organisation Wikileaks should distance themselves as far from this sort of activity as possible. If they condone it, or even merely appear to condone it, then their fate is most certainly sealed.

MasterCard under DDOS, can't process SecureCode online payments

Related Stories