this post was submitted on 19 Jun 2023
22 points (95.8% liked)

Cybersecurity

5695 readers
171 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Community Rules

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]

Notable mention to [email protected]

founded 1 year ago
MODERATORS
 

From the moment I began my freelance web design business back in 2014, I was collecting payments via Stripe and happily paying their processing fees for the ability to grow my business from just a desire for more freedom to running a company that employs women and supports them to create their own freedom and financial independence.

It never occurred to me that using Stripe to process payments would become one of the biggest risks to my small business.

My Stripe account was hacked due to Stripe’s lax security, over $70,000 of fraudulent charges were processed by the hacker through a fake connected account, paid out instantly to that person via Stripe’s Instant Payments to the hacker’s pre-paid debit card, and Stripe started pulling the money out of my business bank account to pay back the victims of the theft.

And Stripe says it’s my fault that my account was hacked and that I’m liable to pay back the victims of the fraud.

Listen to the full podcast episode or read on to find out exactly what happened and how to protect your business.


On a quiet Monday morning after the Easter holiday, I was sipping coffee on my couch in Columbus, Ohio like I normally do, snuggling with my dog and going through my normal morning entrepreneurial routine of checking emails and DMs on my business account when I see an email from Stripe with the subject line:

“Subject: [Action required] Closure of your Stripe account”

...

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 6 points 1 year ago (1 children)

I'm curious if any security engineers have covered this incident.

Stripe does support generating Restricted API Keys. With "Restricted API Keys" you're able to mint a key that can live on your e-commerce website that has permission to accept payments but does not have permission to modify your merchant account's payout methods (eg adding a new "Instant Payments" debit card to the merchant account as this attacker did).

Unfortunately, I've asked WooCommerce to support Restricted API Keys 1 year ago, but they marked it as "low priority"

...I would appreciate if more people would jump-in on ^ that ticket and scold WooCommerce so that they add support for Restricted API Keys ;)

[–] [email protected] 1 points 1 year ago (1 children)

Looks like Woocommerce is responding 👍. It sounds like they're saying that they do in fact support them, but that the documentation might not make it clear; does that sound accurate to you?

[–] [email protected] 2 points 1 year ago (1 children)

I consider "support" for this as having it documented. It's not a boolean "on" / "off". To "support Restricted API Keys" would mean that they document the minimum set of permissions required (which is a long list of properties, each set to "none" or "read" or "write").

Indeed, I'm very happy to see they've changed it from 'low-priority' to 'high-priority'. Hopefully they'll update the documentation with the permissions needed for Restricted API Keys soon.

[–] [email protected] 2 points 1 year ago (1 children)

Right, I was trying to be a little skeptical when I read her account (make sure she wasn't blaming them for some misunderstanding on her end), but I'm about 90% sure that I've done a few different times exactly what she did (export keys, put them in Woocommerce, done and assume it's fine.)

Basically, yes, I'm in full agreement with you that understanding in detail what to do (and, ideally, a strong message that people should be careful about doing it in the safe way) would definitely be good.

[–] [email protected] 2 points 1 year ago

Yeah, once they document how to use it, I hope they also publish an PSA telling all users to disable their existing keys and migrate to using Restricted API Keys