QUESTION 13 Paw-Paw's Gets Pwned! Paw-Paw's King Cakes started as a bakery storefront in Breaux Bridge. "Paw-Paw's" great-grandson, Bruno Fontenot has been running it for over fifteen years. After la

QUESTION 13

Paw-Paw's Gets Pwned!

Paw-Paw's King Cakes started as a bakery storefront in Breaux Bridge. "Paw-Paw's" great-grandson, Bruno Fontenot has been running it for over fifteen years.  After landing some tour-bus gigs, tourists asked if they could mail-order King Cakes.  Bruno put it together and now they ship across the US and sometimes to Canada and even to France. (Outside of Carnival season, of course, they ship no King Cakes within Louisiana.)  They set up a web storefront as well.

Bruno's has been taking payment cards for many years, using a local merchant services company that supplies PIN readers and such. Of course, the web site is newer. It is run by a company in Houston that was recommended to Bruno by other local businesses, and it integrates with Paw-Paw's merchant services company.

The third week of this carnival season was a disaster for Paw-Paw. Customers didn't receive orders they paid for, Paw-Paw's shipped cakes that they got no revenue for, and their merchant company reports several payment cards used at Paw-Paw's showed up for sale on a "Carding" site on the Dark Web. Naturally, Bruno is near panic.

First Bruno asks his nephew to figure things out. However, the Tulane senior "computer stuff" major quickly flees, whimpering, to the LPC. That leaves you.

Order entry and fulfillment involves numerous parties:

Customer

Store Clerk

Web site operator/maintainer

Web shopping cart vendor

Merchant (payment) services company

Credit Card issuer (e.g. MasterCard)

Issuing Bank (i.e. for a payment card — for example Gulf Coast Bank)

Store manager

Baker

Shipping clerk

Shipping company

Describe your first attack scenario per the instructions given before. 

ANSWER THESE QUESTIONS

the relationship of the attacker to the fulfillment process

how the attacker could have penetrated the fulfillment process

Vulnerabilities that could have been exploited

Describe your second attack scenario per the instructions given befo