On December 20th 2017, the Today Show broke this story. The link to that segment can be seen here: https://youtu.be/Po389-o7NIo
Below is the complete story from Jim Stickley.
Recently I found a Nordstrom gift card in my house and wondered if it was used or still had a balance on it. Rather than call the phone number on the card that allows you to check the balance, I opted to go online and check it through the Nordstrom.com website. After a few seconds of searching I found the Nordstrom gift card page, which included a place for me to enter in the gift card number and the security PIN.
Oddly enough in all the years that I have shopped at Nordstrom, it turns out that I have never used one of the company’s gift cards online to make a purchase. So, when the website asked for the security PIN, for the first time in my life I had to scratch off the protective covering that hides the PIN from the rest of the world. As I scratched the grey covering off, I was a little surprised to find that the security PIN was only three digits in length. This was the moment when I started to think that maybe the security of these gift cards was not all that it should be. I mean, in theory a 3-digit PIN means that it would only take 999 attempts to guess it. It might seem like a lot, but even just picking a random number between 1 and 999 might actually get the number right.
But obviously I was jumping the gun a little bit. Clearly, Nordstrom realized that a PIN this short was a little bit of a risk and therefore had implemented other security measures to ensure that its customers were protected from would-be hackers. Didn’t they?
Let’s get back to checking that balance on my gift card. When I looked at the website there was a form field in which I was to enter the card number. There was also the form field where I was to enter the security PIN and the button that I was required to click on to submit my request. That was it.
Right now, I assume a few of the people reading this story are thinking to themselves, “Wait a second. You missed something, right? You forgot to mention the Captcha.”
Ah yes, the Captcha. The little annoying security check that is often included on websites when you are submitting form data. Often times this is seen as the “I am not a robot” check. In some cases you can validate you are human with something as easy as clicking in a box, while in other cases you might have to type in letters that you recognize from a picture. However, when it came to the Nordstrom website, there was no Captcha to be found.
No Captcha, what’s the big deal? Clearly they just want to make the user experience a little easier and avoid making them jump over the extra hurdle of proving they are human beings. I will admit that some of the Captchas out there can be a little frustrating and on more than one occasion, I have not been able to tell what the letters were in the picture that was shown. That said, the Captcha serves a very important purpose.
You see, by including a Captcha you are removing the ability for an automated program to submit a website form. In some cases, this is used to eliminate the possibility of a computer program adding hundreds of fake users to an online service or from posting thousands of messages automatically to a public forum. However, in the case of the Nordstrom gift cards, the point of the Captcha would be to eliminate the ability of an automated program to submit a gift card number and a PIN.
Thinking of this from a criminal standpoint, imagine a website where an automated program could submit a gift card number and the PIN automatically and just wait for the response. In a situation where the PIN is only three digits, that means that technically the automated program would only need to try 999 times. And within that amount of tries, it could guess the PIN and have access to use the gift card.
Hopefully now this is all starting to come together. It turns out that Nordstrom left out an extremely important security feature from its website that opens the door for an automated brute force attack.
When I first noticed this I went to the next assumption; there was a good chance that Nordstrom must monitor card activity on the website and when more than a certain amount of failed attempts were submitted, they would block the card from being accessed. Sure enough, Nordstrom did just that. When I entered the wrong PIN number for my gift card four times in a row, on the 5th attempt the website responded back that there was a problem. OK, so game over, problem solved, clearly they have addressed the automated issue by simply locking the card.
I thought that too. For a few minutes anyway. After I locked up the card, I walked away and moved on to other things. But about 30 minutes later I came back and tried it again. Lo and behold my gift card was resurrected from the dead and once again I could submit PIN numbers in an effort to check the balance on the card.
Like before, I entered the PIN incorrectly four times in a row and once again on the 5th attempt, the card was locked. After several tests, I was able to narrow down that the card locks for 10 minutes on the nose and at 10:01 the card is once again ready to go. For some of you mathematical wizards I imagine you have already started doing the numbers. This means that in any given hour, an automated program could attempt to find the PIN for a specific gift card a total of 24 times, which is four times every 10 minutes. Now assuming that you started with the first possible PIN number of 001 and the card PIN turned out to be 999, which would be worst case scenario, that means it would take around 43 hours to complete the process; or a little under two days.
Is two days a long time when it comes to gaining access to a gift a card? Well it depends on how you look at it. Most people who purchase a gift card plan to give it to someone else. Now, the odds of the person purchasing the gift card, giving it to the recipient, and that recipient using it all within two days is probably pretty slim. I have had gift cards sitting around for months before I finally remembered to use them. It’s also important to remember that I was simply testing my own card. But what happens if I were to be sending over 10 cards, 20, or even 100 cards at a time?
Instead of just gaining the PIN for one card in two days, I would be gaining the PIN for hundreds or even thousands of those cards. Of course that would require me to know the gift card number, which is 16 digits in length. Obviously, this means that unless I purchased the card, there is no way I could know what the card number was, and therefore being able to guess the PIN is kind of irrelevant.
Oh ye of little faith. Mistake one was the limited 3-digit PIN. Mistake number two was the lack of a Captcha, which means we still have one more mistake to talk about. You see, it turns out that Nordstrom gift cards can be purchased at stores all over the U.S. and in many cases these cards are hung on racks that anyone can walk up to and view. The packaging on the Nordstrom gift card is pretty basic. A simple cardboard envelope with the gift card inside. If you turn the gift card over, on the back is a barcode of the gift card. The barcode on the gift cards I tested were rather long at 30 digits in length, but if you look closely you will notice that the last 16 digits in the barcode is actually the gift card number itself. What this means is that I can simply walk in to any store selling Nordstrom gift cards, take a stack off the rack and snap a picture of the back of each card which gives me each card number.
Now this is not the mistake, as this would only give me the numbers for cards that have yet to be purchased. While I am sure that is still useful to a criminal who is willing to wait until the cards are sold, and then crack the PIN, there is another hack still available. While I was looking at the cards on the rack I noticed something interesting. Each card had a very similar number and in fact as I started flipping through a stack I realized that the card numbers would increase by exactly eight. For example, if the first gift card number was 1111 1111 1111 1111, the next card was 1111 1111 1111 1119 and the card after that would be 1111 1111 1111 1127, and so on. Yep, this in my opinion was the third mistake that was made. A criminal can simply walk into the store, look at the card number of the card on the rack, and then work backward by increments of eight to assume the cards that have already been sold. While extremely simple, this hack addresses the last problem that the criminal would have in gaining access to multiple gift cards. They now have the ability to guess gift card numbers with a reasonable level of certainty that they will indeed exist.
When you combine all three mistakes, what you end up with is the ability for a criminal to begin harvesting gift cards and their PINs in a quick and automated fashion.
Of course, nothing is ever quite as easy as it seems and during my testing I did notice that Nordstrom had some code features that could slow down the process. First, for those would-be hackers out there, simply sending a string containing the card number and PIN to the Nordstrom website through the use of a tool like CURL would not work. Nordstrom included some additional fields, cookies, and javascript in its web pages that must be handled properly in the gift card balance request. And while they do not seem security related, they do require some extra work when submitting the request. That said, after a quick review of what the page was looking for, writing an automated shell script on a Linux system was relatively simple and I was able to request the balance on a gift card using a PIN number that randomly generated.
In addition, I had run an automated test against my own gift card to see what would happen. My goal of course was not to exploit Nordstrom, but to confirm how secure the gift card I purchased was from a third party gaining access to my PIN. I ran the script for a while and found that it functioned as expected. However, Nordstrom has added an additional layer of security based on the IP address accessing the website. At very random intervals, any time from several minutes to over six hours, the IP address that was running the test would be blocked from accessing the website. While this may seem like a quality security control, the reality was that it took eight IP addresses to gain access to the PIN in just under 25 hours. Obviously cyber criminals often have access to thousands of IP addresses through compromised devices so, this security was found to have limited impact.
All that said, here is where I end up. Nordstrom made three mistakes with their gift card program. 1) a limited three digit PIN for a security code, 2) the lack of a Captcha to prevent automated access to guessed PIN numbers, and 3) a gift card number algorithm that increments in an easy-to-guess fashion. Through these mistakes Nordstrom left its gift cards exposed to would-be criminals requiring limited technical knowledge. And while some security has been deployed in blocking an IP address conducting suspicious behavior, unfortunately I do not believe it would be enough to deter or prevent sophisticated cyber criminals.
On December 14th I notified Nordstrom about this gift card vulnerability, giving them complete details about the issue and suggestions on resolution. To their credit, the staff at Nordstrom seemed very interested in the information and resolving the issue. On December 19th I found their website was updated and a Captcha is now included on the Gift Card balance check.
There is obviously no way for me to know if any criminals targeted the gift card vulnerability at Nordstrom or how long their cards had been vulnerable to attack. So I guess my best advice to anyone who has purchased or received a Nordstrom gift card in the past is to check and make sure it still has funds available. If not, you might want to give Nordstrom a call. Perhaps they will be willing to help. While I know their policy states that they are not responsible for lost or stolen card numbers, it never hurts to ask.
Written by Jim Stickley
About the author:
Jim Stickley is a cybersecurity expert with more than 20 years in the cybersecurity field. He has discovered vulnerabilities in security products, banking applications, and mobile applications.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
