4 ms·

So, if I want to disrupt a competitor all I have to do is hire a bunch of darknet identify thieves and you'll shut down their merchant account?

gilrain 5y ago
Yes, if you’re willing to break the law and risk the consequences, you can get up to all sorts of stuff. Same as anything? Like, “So, if I want to disrupt a competitor, all I have to do is hire thugs to smash all their stuff?” Yeah, that’d do it. Good luck.
- qaq 5y ago
  Risk is relative thing the activity has to cross threshold for the appropriate gov entity to investigate and since they are swamped that threshold keeps going up.
- MichaelApproved 5y ago
  I think the point is that this attack vector can be pretty anonymous and absolutely deadly to the target company. This attack is also not protected by insurance, like someone setting fire to your office would be. It’s fair to explore just how vulnerable a company can be to this type of attack from a malicious competitor.
  - BoorishBears 5y ago
    It's a weak point. You can also pull API keys from most apps and get them banned from advertising networks. You can hire people to review bomb. Hire people to make fake news about a competitor go viral. Someone willing to do illegal things can always hire other people to do illegal things for them "anonymously"
- ViViDboarder 5y ago
  You’d need to come close to 1% in total charges. That’s roughly what Visa and MasterCard set as limits. This would work with anyone who accepts credit cards, not just Stripe customers.
  - ddtaylor 5y ago
    Assuming their a competitor 1% seems like a small tax to pay to gain the entire market share.
    - notahacker 5y ago
      You probably don't gain the entire market share even if the attack succeeds in leaving them permanently without a payment gateway, except in situations where the answer to "who is attacking us?" is fairly obvious...
MichaelApproved 5y ago
Great point. This does seem like an important vulnerability. I think one method of protection would be using Stripes Radar service to screen transactions for malicious patterns. While it probably won’t catch all fraudulent charges, it’ll catch a bunch. You can use that increase in rejected transactions as a canary to take a closer look at the other transactions coming through. Does anyone else have ideas on how you can protect yourself from this kind of attack? Edit: thinking about this more, it would be a pretty expensive attack to attempt. Stolen credit cards aren't cheap, like email addresses are. You'd need a lot of them to attempt the attack and you likely wouldn't succeed. I think you'd need 1% of the target merchant's transactions to be chargebacks in order to get them kicked off. I'd assume at least 50% of your attempts would get caught before the chargeback even happens, so you'd need at least 2% of their transactions. Seems like you'd need a large number of cards. Anyone know the value of a stolen card?
- BikiniPrince 5y ago
  Actually they are relatively cheap to purchase. It’s been a while since I saw numbers, but googling around seems like 25-50. I also remember something about bulk sales. If you never intend to capitalize on the gains other then an attack vector it would minimize the risk. So eliminating someone’s business is 2% revenue * 25$ usd optimally. Surely we can build a better service to get these costs down.
burnte 5y ago
Actually, yes. That will absolutely hurt them.
e9 5y ago
I actually heard of a person who did something along these lines to the competition and Stripe shut the competitor down.

gilrain 5y ago

Yes, if you’re willing to break the law and risk the consequences, you can get up to all sorts of stuff. Same as anything? Like, “So, if I want to disrupt a competitor, all I have to do is hire thugs to smash all their stuff?” Yeah, that’d do it. Good luck.

qaq 5y ago
Risk is relative thing the activity has to cross threshold for the appropriate gov entity to investigate and since they are swamped that threshold keeps going up.
MichaelApproved 5y ago
I think the point is that this attack vector can be pretty anonymous and absolutely deadly to the target company. This attack is also not protected by insurance, like someone setting fire to your office would be. It’s fair to explore just how vulnerable a company can be to this type of attack from a malicious competitor.
- BoorishBears 5y ago
  It's a weak point. You can also pull API keys from most apps and get them banned from advertising networks. You can hire people to review bomb. Hire people to make fake news about a competitor go viral. Someone willing to do illegal things can always hire other people to do illegal things for them "anonymously"
ViViDboarder 5y ago
You’d need to come close to 1% in total charges. That’s roughly what Visa and MasterCard set as limits. This would work with anyone who accepts credit cards, not just Stripe customers.
- ddtaylor 5y ago
  Assuming their a competitor 1% seems like a small tax to pay to gain the entire market share.
  - notahacker 5y ago
    You probably don't gain the entire market share even if the attack succeeds in leaving them permanently without a payment gateway, except in situations where the answer to "who is attacking us?" is fairly obvious...

MichaelApproved 5y ago

Great point. This does seem like an important vulnerability. I think one method of protection would be using Stripes Radar service to screen transactions for malicious patterns. While it probably won’t catch all fraudulent charges, it’ll catch a bunch. You can use that increase in rejected transactions as a canary to take a closer look at the other transactions coming through. Does anyone else have ideas on how you can protect yourself from this kind of attack? Edit: thinking about this more, it would be a pretty expensive attack to attempt. Stolen credit cards aren't cheap, like email addresses are. You'd need a lot of them to attempt the attack and you likely wouldn't succeed. I think you'd need 1% of the target merchant's transactions to be chargebacks in order to get them kicked off. I'd assume at least 50% of your attempts would get caught before the chargeback even happens, so you'd need at least 2% of their transactions. Seems like you'd need a large number of cards. Anyone know the value of a stolen card?

BikiniPrince 5y ago
Actually they are relatively cheap to purchase. It’s been a while since I saw numbers, but googling around seems like 25-50. I also remember something about bulk sales. If you never intend to capitalize on the gains other then an attack vector it would minimize the risk. So eliminating someone’s business is 2% revenue * 25$ usd optimally. Surely we can build a better service to get these costs down.

burnte 5y ago

Actually, yes. That will absolutely hurt them.

e9 5y ago

I actually heard of a person who did something along these lines to the competition and Stripe shut the competitor down.