Hotel hackers redirect guests to fake Booking.com to steal cards | Hacker News Reader

Hotel hackers redirect guests to fake Booking.com to steal cards

bleepingcomputer.com

52 pointsgslin13 comments

The original research,

https://www.akamai.com/blog/security-research/sophisticated-...

The original research downplays that it's specifically Booking.com customers who are targeted here.

Ok, I edited my comment to simply point to the original source.

The specific example in the article shows and states that a Booking.com site is emulated. That would be helpful info for a reader.

Digital signatures should have made credit cards obsolete a long time ago. It's a very dated system.

How would that help in this case, where customers are entering their own CCs into the phishing page?

Dont send the cc info. Use private key to authenticate yourself. Digitally sign the transaction id and the date so people cant record the info and reuse it.

I guess the issue is that people may lose or forget their keys or people can gain access to the signing device. It is harder to understand than using password for verification so people like my parents do not trust it.

This is exactly how it works when you tap to pay. It would be really cool if computers let you to tap to pay.

If we were using digital signatures, you wouldn't need to give the number you use for authentication to every party you transact with.

... so the fraudulent link has the same exact message, but prompting you to "redo" the digital signature - eg stick your credit card into the reader again.

Digital signatures are a red herring. The only way to "solve" this on the consumer side is to change the semantics and make electronic payments like cash. If a customer paid a hotel in cash, and a person in the lobby said "hey there was a problem with your cash, give it to us 'again'", the customer would rightly balk.

But why would a customer ever want that? Especially for something like hotel bookings where one isn't able to sit down at a fully-fledged computer and spend time picking over the request details and account transactions with a fine tooth comb? Reversibility means any fraud can be detected after you're done traveling.

> ... so the fraudulent link has the same exact message, but prompting you to "redo" the digital signature - eg stick your credit card into the reader again.

This caps the fraud amount at the money transacted. Also, maybe you could educate users to look for a confirmation message, and never duplicate a transaction if they already received a confirmation message. (And force a fraudster to generate a quick confirmation message if they want to get any money.)

I don't think digital signatures are mutually exclusive with reversible transactions.

I am currently staying at a Steigenberger hotel in Luxor, Egypt. Their account on booking.com is hacked so badly that right at the moment booking is made they send you a message to not reply to any messages coming from them asking to pay on the website outside booking.com. Several months later they messaged me asking to pay on the dodgy website completely copying the UI of booking.com.

Any idea or motivation where all these hacks the last week are coming from?

Reply on news.ycombinator.com