6

I'm getting hit with carding attacks on my website. I've enabled AVS options like so in Paypal.

enter image description here

This doesn't seem to be doing enough to stop the attacks.

Paypal threatens to shut off my account, what can I do to stop carding attacks? They recommend a Captcha on the checkout form but I haven't found a good quick solution to that if someone can recommend. Has anyone had this happen to their site?

Improve this question
2
  • 1
    I have seen few of them facing the same issues and they went with captcha for the checkout page.
    – Raj Mohan R
    Commented Apr 2, 2019 at 5:33
  • Any chance you have a good link for this? I was unable to find a module that added checkout captcha and the DIY solutions I found were broken or incomplete. I'm working on my own right now but this disaster has provided many distractions at once.
    – jamil
    Commented Apr 2, 2019 at 18:55

2 Answers 2

Reset to default
3

Magento 2.3.0 has CSRF protection for Magento\Paypal\Controller\Transparent\RequestSecureToken out of the box. But CSRF token validation is not enough to completely solve this issue. So, to avoid such vector of attack, Magento team has decided to introduce Captcha validation for Payflow Pro payment form, as it can't be completely solved on Magento side.

You can use Magento Captcha integration or ReCaptcha extension. Now you can require magento/module-paypal-captcha or magento/module-paypal-recaptcha via composer (these packages are already published on repo.magento.com) and configure appropriate Captcha mechanism. Google ReCaptcha much secure but require additional credentials (https://docs.magento.com/m2/ce/user_guide/stores/security-google-recaptcha.html).

You can patch your 2.2.x Magento instance by CSRF token validation fix (https://github.com/magento/magento2/blob/2.2-develop/app/code/Magento/Paypal/Controller/Transparent/RequestSecureToken.php#L99) but, again, it just mitigates risks.

Official guide and contacts https://support.magento.com/hc/en-us/articles/360025515991 (it doesn't contain Captcha installation details).

UPD: The official post was published https://support.magento.com/hc/en-us/articles/360025515991.

Improve this answer
3
  • Thank you this is the kind of info I've been digging for with no luck! I was beginning to think I was the only one affected by this somehow. I would think checking the form key was a good enough fix (I also can't believe thats not in there already), is it safe to think that captcha plus CSRF token validation should be safe to go live again? Is upgrading to 2.3 preferred?
    – jamil
    Commented Apr 2, 2019 at 21:31
  • 1
    I believe that ReCaptcha is the best solution in this case, as it provides secure flow and doesn't have such a negative impact on customer experience.
    – joni jones
    Commented Apr 2, 2019 at 22:24
  • I see your edit. Fantastic... thank you!
    – jamil
    Commented Apr 3, 2019 at 5:57
2

I don't have an official answer yet but I wanted to put my notes here and an answer seemed more appropriate.

Anyhow, many including paypal have recommended a captcha on the checkout page but I have yet to find a way to do this that works. I am currently testing one option and will probalby post about it if it works since theres nothing reliable I have found yet.

Another important detail is that I had disabled paypal payflow pro and yet I was still getting hit with credit cards. I think these were automatically rejected due to it being turned off, but the controller remained active and to me this is a security hole. In fact, the ability to manipulate this controller without going through checkout seems like a security hole to me. The malicious party somehow faked a quote.

I have blocked access to this url using cloudflare (which is created by Magento\Paypal\Controller\Transparent\RequestSecureToken and accessible through /paypal/transparent/requestSecureToken/ by the way).

I'm hoping to do 3 things: 1) throttle or block inappropriate access to the aforementioned url 2) add a captcha 3) look for existing patch to this.

The only recent and related info I found on this is: https://github.com/magento/magento2/issues/21781

If you're using paypal payflow chances are you are susceptible to this attack.

I am really behind on Magento though (2.2.4) so hopefully this was fixed already and I can blame myself for not updating.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.