Question:
what is happening is the following. I'm currently trying to solve a big problem, two of the company's virtual stores that I serve have a card cloning problem. I don't have much experience in this, but I will explain how the card system is working today.
1) Customer informs card data in shopping cart.
2) An ajax sends this information to an .asp file and processes the payment and returns the return.
The shops:
- They use SSL.
- They don't save anything in the database for the card.
- The server said it has no virus.
What actions can I take to try to resolve this? Speaking of programming.
Answer:
Come on, based on your feedback information, we're outside with no access to the logs, no access to the server, no access to your codes, we can only assume where the problem is happening.
- Usam SSL.
If all communications use SSL the problem dies here… When I say todas as comunicações I mean that your site must do all communication between browser (client) and your server via https: , another point is if your ajax sends the data to the .asp using SSL communication, if the answer is OK, it would be very complicated for someone to intercept (sniff, spoofar) the communication between browser (client) and the server (nginx, apache, IIS, etc.), it would also be very complicated to forge SSL to try to get the data in a naked way…
If sending data between your ajax and .asp is not encrypted, any sniffer or arp spoof running on the network where your server is will be able to read this information, the same happens on the network where you are receiving the data, in your case the network where the .asp , in both cases you are hostage, have no control over any of the networks, sit and cry, or make sure everything is encrypted
- Não salvam nada no banco de dados referente ao cartão .
If you guarantee that nothing is saved anywhere, forget about database hacking problems and sql injections
- O Servidor disse que não tem virus.
This is very vague, the problem may be occurring here, yes, it could be a server or vulnerability in your code, it's no use if everything is encrypted via ssl, if your server is compromised, any ftp port open, ssh port open, something that can be exploited by exploits and allow full access to the server, this would ensure that the attacker secretly changes codes and sends forms to his server/pc/database… the same can happen with your php/asp codes, if have any holes in them, the attacker can insert hidden codes on your server without you knowing about it.
Suppose Hacker gets a way to access your server, he can do that by exploiting http/ssh/ftp/exploits/code holes (php, asp), etc. Suppose I'm in the form and I'm typing in the my credit card, ok the data is encrypted via ssl so i hit submit no one in theory would be able to read the transaction, but the data in the form contained on the server side is not encrypted, someone could insert somewhere in the code something that save or send this data…
- Quais ações posso tomar para tentar resolver isso? Falando em
programação
Without knowing for sure where the problem is, there's no way to guess 🙁