• Does your plugin have any support to block carding/Card Testing attacks? This is when the user or scripts rapidly send credit card numbers to the processor, incrementing the card number by one each time, until a valid card has been detected. All other data, name, email and address remain the same.

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author syednazrulhassan

    (@nazrulhassanmca)

    Currently Its not available but do you know any other gateway plugin that implement it ?

    Another thing is my plugin has a code (regular expression) to detect if its a valid card or not but i am not 100% sure if code is as much accurate to justify all card types or it just identifies card pattern

    Do you have any more idea how to identify a valid credit card no or so you think we can use any third party API or something like beccause what you described is logically great idea

    But question how do i identify by means of a code if its valid card no or do you think i can just validate card pattern numbers

    If its as to validate card pattern no it would be more easier to implement not sending transaction to gateway untill a valid card pattern has been detected

    thanks
    nazrul

    Thread Starter macmedia

    (@macmedia)

    @nazrulhassanmca thanks for getting back to me. I have your plugin installed, but it does not stop the attacks. The attacks are using the woocommerce ajax scripts to rapidly post credit card numbers to your process_payment() method. I have modified your plugin to log request to the database and rate limit how many attempts can be made. This seems to be working for me. This might be something you want to include in future updates.

    Plugin Author syednazrulhassan

    (@nazrulhassanmca)

    I had a question can we only identify a valid credit card pattern via regular expression and then doesnt allow to hit gateway ?

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Carding/Card Testing Fraud’ is closed to new replies.