How can you clone cards on my website?

Question

what is occurring is the following. I am currently trying to solve a big problem, two of the company’s online stores that I serve are having a problem with card cloning. I don’t have much experience in this, but I will explain how the card system is working today.

1) Customer informs the card details in the shopping cart.
2) An ajax sends this information to a file. It and processes the payment and returns the return.

The shops:

• Use SSL.
• Save nothing in the card database.
• Server says no virus.

What actions can I take to try to solve this? Speaking of programming.

Answer 1

Come on, based on the information from your comments, we’re outside with no access to the logs, no access to the server, no access to your codes, we can only assume where the problem is happening.

 - Usam SSL.

If all communications use SSL the problem dies here... when I say todas as comunicações I mean that your site should do all communication between browser(client) and your server via https:, another point is whether your ajax sends the data to the .asp using communication SSL, if the answer is OK, it would be very difficult for someone to intercept (sniffar, spoofar) the communication between browser(client) and server(Nginx, apache, IIS, etc), it would also be very difficult to forge the SSL to try to take the data naked way...

If sending the data between your ajax and the .asp is not encrypted, any sniffer or arp spoof running on the network where your server is able to read this information, the same happens on the network where you are receiving the data, in your case the network where is the .asp, in both cases you are hostage, have no control over any of the networks, sit and cry, or ensure that everything is encrypted

- Não salvam nada no banco de dados referente ao cartão.

If you guarantee that nothing is saved anywhere, forget about database intrusion problems and sql injections

 - O Servidor disse que não tem virus.

This is very vague, the problem may be occurring here yes, it can be server or vulnerability in your code, it is of no use everything to be encrypted via ssl, if your server is compromised, some ftp port open, open ssh port, something that can be exploited by exploits and allow full access to the server, this would ensure that the attacker changes codes in a hidden way and sends forms to his server/pc/database... the same can happen with his php/Asp codes, if you have any holes in them, the attacker can insert hidden codes into your server without you taking any notice.

Imagine that the Hacker get a way to access your server, it can achieve this by exploiting http/ssh/ftp/exploits/loopholes in code(php, Asp), etc, imagine I’m in the form and I’m typing my credit card number, ok the data is encrypted via ssl once I hit the Submit no one in theory could read the transaction, but the data in the form contained on the server side is not encrypted, someone could enter something in the code that saved or sent this data...

  - Quais ações posso tomar para tentar resolver isso? Falando em   
    programação

Not knowing for sure where the problem is :-(

Answer 2

You are using anti-fraud token (Antiforgerytoken)?

It may be that in the payment of the shopping cart, instead of clicking once, the customer is double-clicking the Pay button.

If this is happening and you do not use the token, the payment will be processed more than once.

If you validate tokens of this type, once the user has made the POST of the <FORM> payment token and used a token, the token will no longer be valid and new attempts to use that token, which would happen if he pressed the token countless times, will fail.

To use Antiforgerytoken, simply decorate the controller method with:

[ValidateAntiForgeryToken]
[HttpPost]
public ActionResult Pagar(PagamentoModel model)
{
    ....
    return View();
}