Wednesday , January 22 2025
fraud

Bangladeshi Social media flooded with unauthorized withdrawals from bank accounts

Bangladeshi Social media posts have raised concerns about unauthorized withdrawals from bank accounts, affecting at least 7 to 8 people who hold dual currency or credit cards. Initial findings suggested two banks are reported to impacted.

Bangladesh Cyber Security Intelligence (BCSI) reported unauthorized transactions made via Facebook Ad Manager, often in small amounts, with one account having 315 transactions. Victims did not receive One-Time Password (OTP) notifications for these transactions.

Delay patching leaves about 50,000 Fortinet firewalls to zero-day attack

Fortinet customers must apply the latest updates, as almost 50,000 management interfaces remain vulnerable to the latest zero-day exploit. The...
Read More
Delay patching leaves about 50,000 Fortinet firewalls to zero-day attack

Daily Security Update Dated: 21.01.2025

Every day a lot of cyberattack happen around the world including ransomware, Malware attack, data breaches, website defacement and so...
Read More
Daily Security Update Dated: 21.01.2025

126 Linux kernel Vulns Allow Attackers Exploit 78 Linux Sub-Systems

Ubuntu 22.04 LTS users are advised to update their systems right away due to a crucial security patch from Canonical...
Read More
126 Linux kernel Vulns Allow Attackers Exploit 78 Linux Sub-Systems

CERT-UA alerts about “security audit” requests through AnyDesk

Attackers are pretending to be Ukraine's Computer Emergency Response Team (CERT-UA) using AnyDesk to access target computers. “Unidentified individuals are...
Read More
CERT-UA alerts about “security audit” requests through AnyDesk

Oracle Critical Pre-Release update addressed 320 flaw

Oracle Critical Patch Update Pre-Release Announcement shares details about the upcoming update scheduled for January 21, 2025. Note that this...
Read More
Oracle Critical Pre-Release update addressed 320 flaw

OWASP Reveils Top 10 Smart Contract Vulnerabilities for 2025

OWASP has released its updated list of the top 10 vulnerabilities in smart contracts for 2025. This guide highlights the...
Read More
OWASP Reveils Top 10 Smart Contract Vulnerabilities for 2025

Multiple Azure DevOps Vulns Allow To Inject CRLF Queries & Rebind DNS

Security researchers have found several vulnerabilities in Azure DevOps that could enable attackers to inject CRLF queries and carry out...
Read More
Multiple Azure DevOps Vulns Allow To Inject CRLF Queries & Rebind DNS

Intel holds 22 employees from one Bangladeshi University

Intel Corporation is a leading semiconductor chip manufacturer, employing at least 22 graduates from the Department of Applied Chemistry and...
Read More
Intel holds 22 employees from one Bangladeshi University

VPN Surge 1500% in USA after TikTok Shut Down

vpnMentor’s Research Team is monitoring the potential TikTok ban in the U.S., driven by national security and data privacy issues....
Read More
VPN Surge 1500% in USA after TikTok Shut Down

MITRE Launches D3FEND 1.0; The Milestone for Cybersecurity Ontology

MITRE launched D3FENDTM 1.0, a cybersecurity framework that provides a vocabulary and understanding of the cyber domain. D3FEND 1.0, funded...
Read More
MITRE Launches D3FEND 1.0; The Milestone for Cybersecurity Ontology

The unusual nature of these incidents has caught the attention of the BCSI, is now investigating how these breaches happened without standard security measures like OTP verification.

So what might have happened?

When adding a card for Facebook ad payments, minimal information like the card number, DOB, and CVC/CVV is required. The platform might sometimes ask for a postal code but never for the cardholder’s name. The ease of adding a card without extensive verification leads to vulnerabilities.

For example, if the card’s BIN (Bank Identification Number) is compromised, crackers can generate and use other card numbers sequentially linked to the original BIN. Additionally, transactions through verified international gateways might not prompt an OTP from the bank, assuming it’s a legitimate request, hence bypassing usual security checks. This process, facilitated by tools and unique IP usage by platforms like Facebook, can lead to unauthorized use of your card without detection.

Source: BCSI

What is a BIN Attack?

In a BIN attack, A cybercriminal uses brute force methods to find valid credit card details like the card number, expiration date, and CVV. They utilize a botnet to quickly test many combinations. Once they find a valid set, they may try variations, assuming other cards have the same Bank Identification Number (BIN).

Way to prevent Bin attacks to enhance securit:

BIN attacks occur when fraudsters use the Bank Identification Number to create valid card numbers, but can be reduced through several measures by banks and cardholders. Here BCSI suggest:

Measures to be taken for Banks:

Enhanced Verification: Incorporate advanced security protocols, including biometric authentication and mandatory CVV verification for every transaction.

Limit Number of Attempts: Set a limit on how many times a card number can fail verification before being blocked or flagged.

Advanced Fraud Detection Systems: Utilize AI and machine learning to identify unusual patterns of BIN attacks.

Secure BIN Sharing: Limit shared BIN data with merchants and manage it securely to prevent unauthorized access.

Monitor Transaction Patterns: Regularly monitor transaction patterns for anomalies that may signal a BIN attack, like an unusually high number of declined transactions.

Educate Merchants: Provide training and resources to merchants on identifying and responding to potential BIN attacks.

Measures to be taken for Card Users:

Monitor Account Activity: Check your transaction history often for any suspicious activity and report it right away.

Use Card Security Features: Turn on security options for your card, like temporary numbers for online shopping.

Enable Alerts: Configure transaction notifications through SMS or email to receive updates on any charges made with the card.

Be Cautious Online: Only enter card details on secure, familiar websites. Check for “HTTPS” in the URL as a sign of security.

Report Lost/Stolen Cards Immediately: Promptly notify the bank about any lost or stolen cards to safeguard against unauthorized transactions.

Source: BCSI

(Media Disclaimer: This report is based on research conducted internally and externally using different ways. The information provided is for reference only, and users are responsible for relying on it. Infosecbulletin is not liable for the accuracy or consequences of using this information by any means)

Check Also

Cyberattack

Cyberattack Hit Japan Airlines Systems, delaying flights

Japan Airlines reported a cyberattack on Thursday that delayed over 20 domestic flights. The airline …

Leave a Reply

Your email address will not be published. Required fields are marked *