How to Shop for Free Online -- Security Analysis of Cashier-as-a-Service Based Web Stores

Abstract

Abstract-Web applications increasingly integrate third-party services. The integration introduces new security challenges due to the complexity for an application to coordinate its internal states with those of the component services and the web client across the Internet. In this paper, we study the security implications of this problem to merchant websites that accept payments through third-party cashiers (e.g., PayPal, Amazon Payments and Google Checkout), which we refer to as Cashier-as-a-Service or CaaS. We found that leading merchant applications (e.g., NopCommerce and Interspire), popular online stores (e.g., Buy.com and JR.com) and a prestigious CaaS provider (Amazon Payments) all contain serious logic flaws that can be exploited to cause inconsistencies between the states of the CaaS and the merchant. As a result, a malicious shopper can purchase an item at an arbitrarily low price, shop for free after paying for one item, or even avoid payment. We reported our findings to the affected parties. They either updated their vulnerable software or continued to work on the fixes with high priorities. We further studied the complexity in finding this type of logic flaws in typical CaaS-based checkout systems, and gained a preliminary understanding of the effort that needs to be made to improve the security assurance of such systems during their development and testing processes.

An Efficient Authentication Method For Smart Card Verification In Online

“…the primary merits include: (1) clients exclusively should enroll at the enlistment focus once and will utilize admissible administrations in qualified servers; (2) the subject doesn't need a check table; (3) clients will unreservedly settle on their passwords; (4) the calculation and correspondence esteem is to a great degree low; (5) servers and clients can confirm each other; (6) it creates a session enter in understanding by the client and in this way the server; (7) it's a nonce-based topic that doesn't have an overwhelming time-synchronization [15] disadvantage.…”

Lom: Discovering logic flaws within MongoDB-based web applications

“…Wang et al [27] discovered logic vulnerabilities within the checkout procedures, which can be exploited by the attackers to shop for free. Its further research [28] also identified logic vulnerabilities within web-based single-sign-on services.…”

Detecting Logic Vulnerabilities in E-commerce Applications

“…With the goal of confirming the real dangers that logic vulnerabilities in e-commerce applications pose, we designed responsible proof-of-concept experiments following the example set by Wang et al [30]. Each experiment was performed on a live website that used a vulnerable payment module.…”

“…Each technique targets a particular domain of logic vulnerabilities and checks web applications against specifications in the given domain. Wang et al [30,33] are the first to perform security analysis on Cashier-as-aService based e-commerce applications. They found several serious logic vulnerabilities in a few popular e-commerce applications via manual code reviews [30] and proposed a proxybased approach to dynamically secure third-party web service integrations which include the integration of cashiers [33].…”