Exploiting payment gateway integration (35 Minutes) Introduction (5 Min) Recent Security Breaches (2 Min) a. Root cause Various Approaches for Exploitation (10 Min) a. Price Manipulation b. Payment Gateway Response Manipulation c. Direct 'success API' attack; via referral injection d. Disabling Client Side (web browser level) Validations e. Attacking Refund API's f. Header Manipulation (test server Redirect) g. Currency Manipulation Limitations of Payment Gateway Industry/ Design Gaps (5 Min) a. Absence of CSRF tokens and S2S Validations b. Coupons and offers?? How to Secure? (3 Min) a. Don’t RUN from PCI-DSS compliance!! b. Secure S2S validations and Real-time Reconciliation Demo (5 Min) Questions (5 Min)

2. Introduction

3. Recent Security Breaches
• Root cause
• Input Validation
• Poor Design
• No reconciliation
• Poor visibility
• Exposed Test servers
• Missing CSRF tokens
• Missing Request and Response Checksum integrity

4. Various Approaches for Exploitation
• Price Manipulation

5. Various Approaches for Exploitation
• Payment Gateway Response Manipulation

6. Various Approaches for Exploitation
• Direct 'success API' attack; via referral injection

7. Various Approaches for Exploitation
• Attacking Refund API
• Header Manipulation (test server Redirect)
• DNS Cache Manipulation
TEST

8. Various Approaches for Exploitation
• Currency Manipulation

9. Limitations of Payment Gateway
Industry/ Design Gaps
• Absence of CSRF tokens and S2S Validations
• Coupons and offers??

10. How to Secure?
• Don’t RUN from PCI-DSS compliance!!
• Secure S2S validations
• Real-time Reconciliation

11. Questions !!!

12. Thank You