More Worldpay problems

[pollygordon]

Well, after talking to Worldpay yesterday, they admitted to having routing problems.

Today, Worldpay has been unavailable since 8am (have spoken to them again and they admit problems)

Even they're website is unavailable.

So, frustrating as we're losing orders at the busiest time of year.

[TiggyPig]

Bet you don't get any compensation......

[wfl]

Since about 11:00 their phone has been giving a message and at 13:00 WorldPay finally sent an email confirming the problem.

We shall of course be looking closely at what level of service they offer when we can see their terms and conditions again.

I am amazed that they don't have some sort of fall back. This outage is affecting their entire site; marketing, admin and payment!

[wfl]

Here is WorldPay's serveice level offering;

http://support.worldpay.com/kb/user_guides/cpg/cpg2600.html

[pinbrook]

that is standard, most hosting companies have a very similar clause.

I think WP is functioning again now?

[pollygordon]

It was working for about an hour, now it's off again.

[pinbrook]

HAH!! I've just downloaded 10 orders and no PSP confirmations!

[pollygordon]

10 orders! - I'll be lucky if I have 10 customers left after this. Hmmmph!!

[pinbrook]

I've enabled Paypal this afternon....was thinking about it for a while, already got the verified account, and Paypal has now lauched UK Paypal so the seller protection is improved

[wfl]

That is not a bad idea Jo even if only as a fallback.

I will have a look at that when I get a minute.

[Infolink]

Hi Jo,

Is the UK paypal UK based or still in the US?

do you have a weblink?


Phil

[wfl]

I have just spoken to WorldPay who tell me that it is the result of a malicious attack.

Their payment service pages are being flooded which in turn is taking away all their resource and bandwidth.

As a result customers are not even getting their aplogy page.

They are working to track down and shutdown the sources but it is proving a long job.

[pinbrook]

www.paypal.uk.com

PAYPAL LAUNCHES IN THE UK

In First International Site, PayPal Offers Seller Protection Program

MOUNTAIN VIEW, Calif. -- October 10, 2003 -- PayPal, a leading global online payment service, has launched PayPal UK, its first international website and service (https://www.paypal.co.uk) designed exclusively for users in the United Kingdom. PayPal UK will allow British online buyers and sellers to securely, conveniently and easily send and receive payments to more than 31 million PayPal members around the world.

An important benefit available with the launch of the new UK site is PayPal's Seller Protection. This program offers fraud protection from chargebacks for qualified transactions and is one of the only online protection programs offered to sellers in the industry. Sellers can qualify for this program by following a few simple rules which include having a verified business account, making a timely shipment of tangible goods, and retaining proof of shipping. More information about the program can be found at https://www.paypal.co.uk/sellerprotection.

"PayPal is already being used by a large number of people in the UK to buy and sell locally, regionally and across borders around the world," said Matt Bannick, General Manager of PayPal. "With the new customized features and Seller Protection program on the site, we are bringing additional convenience and security to our UK customers."

With the launch of the UK site, PayPal is also reducing or eliminating withdrawal fees for its UK members. Withdrawals of under £50 to a UK bank will cost 50% less or £0.25 and fees will be eliminated completely for withdrawal amounts of £50 and above. PayPal UK is the company's first international website and part of its broader plan to expand the service in Europe. On September 16, PayPal announced the establishment of its new European headquarters in Dublin, Ireland. The Dublin headquarters provides customer service, fraud prevention and operational support for PayPal members in the UK and other European countries

About PayPal
Founded in 1998, PayPal, an eBay company, enables any individual or business with an email address to securely, easily and quickly send and receive payments online. PayPal's service builds on the existing financial infrastructure of bank accounts and credit cards and utilizes the world's most advanced proprietary fraud prevention systems to create a safe, global, real-time payment solution. PayPal has more than 31 million account members and is available to users in 38 countries around the world. More information about the company can be found at https://www.paypal.com/.

[pinbrook]

I plan to run both WP and Paypal on surf-wax

[Infolink]

Thanks for the feedback!

I'm actually sitting here trying to finish off a custom Worldpay routine in PHP for a big site - I was starting to think my script had died!

Incidently - if anyone ever needs to attach Worldpay to a site that does not have a shopping cart system I've now done it in PHP in a way that can be added as a simple code block.
You don't even need SSL or anything like that as it's all done on their cert!

Phil

[rmladden]

A denial of service attack requires planning to handle, along with a lot of hardware. It is not the kind of thing that is easily dealt with in a crisis.

No one will bother attacking mylittlestore.com, but a big PSP is a target, especially if they have an unhappy customer or handle payments for a controversial group.

[jxm28788]

I've enabled Paypal this afternon....was thinking about it for a while, already got the verified account, and Paypal has now lauched UK Paypal so the seller protection is improvedSo is that just a case of signing up at the paypal site, selecting paypal as an extra payment option in business settings, entering the merchant ID and then that's it? The customer just gets another payment choice and it takes them of to the paypal site to pay? and the paypal site returns them to the receipts screen?

Or is it more complicated than that?

[pollygordon]

Well, I spoke to WP again and they confirm that a Denial of Service attack appears to be the problem.

They are going to be working through the night, but it doesn't look good.

[pinbrook]

you will need to get your paypal account verified to be taken seriously.

If you have online banking this only takes 2 days

[rmladden]

It has made the news. See http://www.theregister.co.uk/content/55/33777.html

[wfl]

There may be a positive side to this.

If it makes the mainstream news them perhaps more punters know who/what WorldPay is.

[Infolink]

I've been playing with Worldpay integration just recently, one of the pages they use gave me a fail message which gave me a laugh - since it was based around FormMail 1.6 - which is just about one of the most exploitable things out there.

Why the hell is a multinational company using a poorly written ultra exploitable free script that was written by a 15yr old!

Scary!

Phil

[pinbrook]

email harvesters can get their way into formmail.....

[Infolink]

Even more so on an early version like that - I think the last was 1.9s
Even Matt (the author) says it is rubbish these days!

working late again Jo?

Phil

[pinbrook]

Yes, working late......must stop soon, I'm in pain, I fell off my skateboard today and landed very heavily....nothing broken but alot of muscle ache and hurt pride.

I think I'll be working tomorrow on my bed, on my front with the laptop!!

[wfl]

For the last 15 minutes PayPal has been coming up with a busy message.

Do you suppose that the attack has moved on?

[Infolink]

LOL

I'll stick with things with a wider / longer wheelbase and an engine!

Try not to break anything - it hurts (speaking from experience) and is not good for business, I reckon when I bust up my leg it cost 40K + in lost profits and pretty destroyed what I had spent 10 years building up with me being off any inaccessible for about a year.

I've pulled it back now, but it's taken 18 months or so to get things back on an even keel.

Mainly doing actinic and a big PHP site right now!

Phil

[theglowcompany]

Not sure whats happening with online payments - we did receive a couple last night. But World Access- the manual online payment process is certainly down & so too is all else Worldpay

Yesterday we monitored anyone trying to order & called them as soon as we could - this minimised the losses but we are still unable to process these payments

After processing a payment of approx £2,300.00 on Friday & Worldpay charging us £100.00 to process this I must say i dont think we get our moneys worth!

Heads will roll at Worldpay - & so they should!

[I-CC]

An update from WorldPay is supposably coming out in the next half hour to an hour, but they still have not been able to remove the problem of the flood on there network and as such the meltdown effect on their servers remains, and yes you would have thought that they would have had separate networks to load balance this type of stuff and thus add a degree of protection, but not the case it seems.

[TiggyPig]

WorldPay just told me the same thing, supposed to be an update on the situation at 12:00.

Seems theyve been targetted similar to the email attcks we saw a few months ago hit Microsoft, they reckon this one came from Japan and caused loads and loads of false transactions to hit them and the servers have just overloaded.

They said they were 15% better today compared to yesterday and were working to resolve the problem.

Well, I've just opened up my PayPal account..... dunno about you..

[I-CC]

OFFER.

If you are a WorldPay site operator, and usually have the WorldAccess (Online PDQ) solution available to you, or a manual PDQ machine in your store, then as a temporary measure to keep you going we can provide you with the Actinic Shared SSL service until WorldPay get themselves sorted out and back online.

No catches or fees, just being helpfull.

Atleast by doing this, you will get the card details for the orders from your customers and then be able to process them fully once the Online systems come back online, so a measure of continuance for your sites operations and sales.

If you want to use this, then drop us an email at: actssl-wp@techno-web.co.uk, providing your website url, including cgi-bin location (i.e. http://www.yourdomain.com/cgi-bin/), and we will get you the details to get your running soonest.

Straight offer and no cathes. Once WorldPay is back up and running, then we will close these back down again as each confirms they are back on WorldPays again.

Hope this helps some of you.

[pinbrook]

Thanks for this generous offer Ian.

I was just wondering if just turning on Actinic inbiult encryption will do thesame thing. ie allow sites to take orders, collect the info so shopkeepers can process orders through WP when they return from the abyss.

(except the golden padlock....

[I-CC]

Latest message in from WorldPay says they are still working on it, although we have managed to get into the network a couple of times ourselves, but this comes and goes, so they are still getting flooded.

Offer is there for those that need it to keep their sales going, likewise as suggested the Java Applet is always there, but in both cases you will need the ability to process manually once you get the card details, so sorry to those that have asked to use the system but dont have the ability to process the cards manually, nothing we can do to help on that front, sorry.

[pinbrook]

I was working on the basis that if you collect the cc data via inbuilt or Actinic Shared SSL then when worldpay comes up you can use the info you have collected to place an order online yourself pretenting you are the customer

Ian

The majority of peeps who use WP do it becasue they haven't got a merchant acct. WP is quite expensive but it is a way to get up and running with the minimumfuss.

Those peeps who do have merchant accts tend to choose a different online provider (Protx is a real cheapy). thus minimising costs

[pinbrook]

ahhh cool just got an order via paypal!!

[wfl]

I have been able to access our WorldPay admin pages several times in the last 20 minutes at speed.

Looks promising.

We've had a few orders via PayPal but I don't think it is a good option for the long term, just as a fall back.

You might be interested in;

http://paypalsucks.com/

[pinbrook]

i plan to use both!

thus offering a extra choice. Default/fall back with be WorldPay, but for those customers who have a paypal acct the alternative is there

[Infolink]

Not having looked into it - can actinic work as standard as a primary / fallback system automatically?

I know how to achive it in PHP, basically by pinging the page and looking for the http response within a time frame and then just making it along the lines of if response ok do this else do that where that is paypal or whatever.

It probably woud be quite easy to hard code it into the perl scripts within actinic, really all it does is submit a hidden form to the provider.

Phil

[DFirth]

Is this also the reason for for the extremely slow response time at the first stage of the check-out process that my site is currently experiencing?

David

[pinbrook]

I would only expect problems when the customer clicks the go to Worldpay button

[pinbrook]

Not having looked into it - can actinic work as standard as a primary / fallback system automatically?

i think what I was trying to say is that the top most option within the drop down box of choices (how to pay) would be Worldpay.

I shall continue to use both options now that PP has extended the protection to the UK

[Infolink]

Latest on this on Ananova


Ananova:

Hackers attack on-line firm with millions of emails

Computer hackers have attacked a company which processes on-line credit and debit card transactions for thousands of UK businesses.

WorldPay said it has been bombarded with millions of bogus emails since Tuesday morning which has left it struggling to deal with genuine payments.

The Cambridge-based company, part of The Royal Bank of Scotland Group, has around 27,000 clients of all sizes around the world, with the bulk in the UK and Europe.

Payment requests from Internet websites are normally sent in on email. The company said a massive number of messages from elsewhere had come in to same address over the past 24 hours.

Transactions requests have either crashed or been slow as a result.

However, it appears those behind the emails - which originate in Ukraine - have set out to disrupt business rather than attempt to commit fraud.

WorldPay said it was putting alternative systems in place this afternoon which should solve the problem.

"It is important to stress that the integrity of the WorldPay payment and administrative systems is intact and there has been no third party access or interference with customer or merchant data," the company said in a statement.


Story filed: 15:47 Wednesday 5th November 2003



Phil