OAT-001 Carding - Revision history

Mtesauro: Fixed a minor type

2018-08-21T15:52:39Z

Fixed a minor type

Clerkendweller: /* Indicative Diagram */

2018-02-16T15:02:50Z

‎Indicative Diagram

Clerkendweller: /* Definition */ Added image

2018-02-16T15:02:24Z

‎Definition: Added image

Clerkendweller: /* Cross-References */

2018-02-16T11:46:07Z

‎Cross-References

Clerkendweller: /* Definition */

2018-02-16T10:06:29Z

‎Definition

Clerkendweller: /* Summary Defining Characteristics */

2018-02-16T09:52:14Z

‎Summary Defining Characteristics

Clerkendweller: Links to project, handbook and chart

2018-02-16T09:50:50Z

Links to project, handbook and chart

Clerkendweller at 19:45, 15 February 2018

2018-02-15T19:45:44Z

Clerkendweller: /* Description */

2018-02-15T19:36:45Z

‎Description

Clerkendweller: New page

2018-02-15T19:35:55Z

New page

New page

__NOTOC__

This is an automated threat. To view all automated threats, please see the [[:Category:Automated Threat|Automated Threat Category]] page

== Definition ==

''Multiple payment authorisation attempts used to verify the validity of bulk stolen payment card data''

=== Description ===

Lists of full credit and/or debit card data are tested against a merchant’s payment processes to identify valid card details. The quality of stolen data is often unknown, and Carding is used to identify good data of higher value. Payment cardholder data may have been stolen from another application, stolen from a di erent payment channel, or acquired from a criminal marketplace.

When partial cardholder data is available, and the expiry date and/or security code are not known, the process is instead known as [[OAT-010 Card Cracking|OAT-010 Card Cracking]]. The use of stolen cards to obtain cash or goods is [[OAT-012 Cashing Out|OAT-012 Cashing Out]].

=== Other Names and Examples ===

Card stuffing; Credit card stuffing; Card verification

=== See Also ===

* [[OAT-010 Card Cracking|OAT-010 Card Cracking]]
* [[OAT-012 Cashing Out|OAT-012 Cashing Out]]

== Cross-References ==

=== CAPEC Category / Attack Pattern IDs ===

* 210 Abuse of Functionality

=== CWE Base / Class / Variant IDS ===

* 799 Improper Control of Interaction Frequency
* 837 Improper Enforcement of a Single, Unique Action

=== WASC Threat IDS ===

* 21 Insufficient Anti-Automation
* 42 Abuse of Functionality

=== OWASP Attack Category / Attack IDs ===

* [[:Category:Abuse of Functionality|Abuse of Functionality]]

[[Category: Automated Threat]]

@@ Line 19: / Line 19: @@
 ===Indicative Diagram===
-[[File:OAT-001_Carding.png|400px|link=]]
+[[File:OAT-001_Carding.png|500px|link=]]
 === Description ===

@@ Line 19: / Line 19: @@
 ===Indicative Diagram===
+[[File:OAT-001_Carding.png|400px|link=]]
 === Description ===

@@ Line 15: / Line 15: @@
 === Summary Defining Characteristics===
-Multiple payment authorisation attempts used to verify the validity of bulk stolen payment card data
+Multiple payment authorisation attempts used to verify the validity of bulk stolen payment card data.
 ===Indicative Diagram===

@@ Line 1: / Line 1: @@
 __NOTOC__
-This is an automated threat. To view all automated threats, please see the [[:Category:Automated Threat|Automated Threat Category]] page.
+This is an automated threat. To view all automated threats, please see the [[:Category:Automated Threat|Automated Threat Category]] page. The OWASP Automated Threat Handbook - Wed Applications ([https://www.owasp.org/index.php/File:Automated-threat-handbook.pdf pdf], print), an output of the [[OWASP Automated Threats to Web Applications|OWASP Automated Threats to Web Applications Project]], provides a fuller guide to  each threat, detection methods and countermeasures. The [https://www.owasp.org/index.php/File:Oat-ontology-decision-chart.pdf threat identification chart] helps to correctly identify the automated threat.
 == Definition ==

@@ Line 42: / Line 42: @@
 * 210 Abuse of Functionality
-=== CWE Base / Class / Variant IDS ===
+=== CWE Base / Class / Variant IDs ===
 * 799 Improper Control of Interaction Frequency
 * 837 Improper Enforcement of a Single, Unique Action
-=== WASC Threat IDS ===
+=== WASC Threat IDs ===
 * 21 Insufficient Anti-Automation

@@ Line 25: / Line 25: @@
 Lists of full credit and/or debit card data are tested against a merchant’s payment processes to identify valid card details. The quality of stolen data is often unknown, and Carding is used to identify good data of higher value. Payment cardholder data may have been stolen from another application, stolen from a different payment channel, or acquired from a criminal marketplace.
-When partial cardholder data is available, and the expiry date and/or security code are not known, the process is instead known as [[OAT-010 Card Cracking|OAT-010 Card Cracking]]. The use of stolen cards to obtain cash or goods is [[OAT-012 Cashing Out|OAT-012 Cashing Out]].
+When partial cardholder data is available, and the expiry date and/or security code are not known, the process is instead known as [[OAT-010 Card Cracking]]. The use of stolen cards to obtain cash or goods is [[OAT-012 Cashing Out]].
 === Other Names and Examples ===
@@ Line 33: / Line 33: @@
 === See Also ===
-* [[OAT-010 Card Cracking|OAT-010 Card Cracking]]
+* [[OAT-010 Card Cracking]]
-* [[OAT-012 Cashing Out|OAT-012 Cashing Out]]
+* [[OAT-012 Cashing Out]]
 == Cross-References ==