6 ms·

I would not default to assuming it was his competitors, that sounds like scapegoating to deflect responsibility. What most likely happened is his site was scann

• eddythompson80 1y ago
  Who else would spend the time and effort to figure out you leaked your stipe key to your front end? Sure people have bots to do that, but it’s kinda unbelievable someone would run such a bot on their vibe coded website.
  • achierius 1y ago
    Why is it unbelievable? There is an entire industry of people trying to find vulnerable niche applications like this. There are bots which crawl the web, not to make an index, but just to find vulnerabilities. Nobody necessarily even had to 'point' anything at this at all, it just shows up on their dashboard one day and they get to dig in.
    • eddythompson80 1y ago
      I was being facetious. Yes, there are millions of bots that are constantly searching every website for leaked keys, passwords, database credentials, crypto wallets, firebase endpoints, s3 buckets, email addresses, phone numbers, etc. the list is bottomless
    • galleywest200 1y ago
      I would not be surprised if Shodan.io ends up with queries for easily identifiable markers of vibe-coded software.
    • motorest 1y ago
      > There are bots which crawl the web, not to make an index, but just to find vulnerabilities. You can download a few of them out of GitHub and run them immediately, too.
    • paffdragon 1y ago
      Yep. We once had left a socks proxy unprotected on a public IP, no cert, just a random IP and a fixed port. At one day the service stopped working. When looking into it, the network was overloaded with random IPs from all over the world surfing on the free proxy.
  • darepublic 1y ago
    Shame on this dude.
  • deleted 1y ago
    [deleted]
  • arrowsmith 1y ago
    Oh you sweet summer child.
  • hooverd 1y ago
    Nah, that's table stakes for a public facing website.
  • JackFr 1y ago
    I have a strictly hobby web app that I work on. 6-7 years ago I inadvertently pushed AWS email service credentials to GitHub. Half an hour after the push I got an email and text from GitHub that I had exposed credentials. I quickly logged in to my AWS to turn off the service, to see that AWS had suspended that service because the bounce rate on the 80000 emails sent in that 15 minute period was too high. It was crazy just how fast it was exploited.
    • zerkten 1y ago
      >> It was crazy just how fast it was exploited. People underestimate the speed, but also the number of pivots that advanced attackers will make. Sure, these kinds of problems are easy to exploit, but with major organizations that employ reasonable defenses, the attackers will pivot through 50+ exploits/machines/layers to get to the target(s). This can take place over weeks or months.
      • pydry 1y ago
        It still doesn't make sense that advanced attackers would go to those lengths in order to... refund the customers.
        • hiatus 1y ago
          Plenty of hackers do it "for the lolz".
        • hansvm 1y ago
          There are lots of smart kids who don't particularly need reasons for causing mayhem. Suppose it was somebody profit-motivated though. They might be: 1. Distracting from a more important vulnerability 2. Later contacting customers, advising them of the "accidental" refund and redirecting them to a more appropriate payment mechanism (one without the KYC Stripe does, were they to try to steal funds directly) 3. Testing stolen credit cards before using them elsewhere Etc. Scamming people is a big industry, and not all of the plots are immediately obvious.
        • iluvlawyering 1y ago
  • jamesfinlayson 1y ago
    I've seen it happen - a key was leaked in a stacktrace somewhere and it took a scraper a couple of days to find it. Stripe helpfully prefixes their keys with sk_prod_ so you can completely automate something to iterate over every IPv4 address and see if something in the output matches.
  • phatskat 1y ago
    > Who else would spend the time and effort to figure out you leaked your stipe key to your front end? In high school in the early 2000’s, I ran a small Apache server from my home that was basically Geocities but even less discoverable - I used it to learn PHP, SQL, and frontend. One day my log started filling rapidly as someone effectively ddos’d my home server. If they’d bothered to actually poke, they likely would’ve been able to exploit it relatively quickly even without all of today’s tools. I imagine the process of discovery and exploitation is magnitudes more impressive and performant today.
  • WJW 1y ago
    You don't scan just a single website, you code up the bot once and then scan every site you can find. Your friends' service was just the proverbial paper car in a thunderstorm: the thunderstorm doesn't care about the paper car but destroys it just the same.
    • ralferoo 1y ago
      My website has a "public" directory for things I wanted to be publicly accessible, but there's an index.html there so you can't trivially discover what files are there. I was mirroring this to another machine, and I'd foolishly already configured haproxy to serve from either machine. In the 10 minutes (guesstimate) between starting to populate the directory and closing off access, I had one bot scrape every single file in there. What was worse was that it'd cached the index, and continued scraping these files from the other backend too, so I had to shut off access to that directory on the live server as well as the backup. Whilst technically, all of these files were "public" because I wanted to share them, some of them weren't publicly linked to (things like my CV etc) which I'd rather hadn't been scraped by some random bot (that of course, didn't identify itself or respect robots.txt).
  • benterix 1y ago
    > Who else would spend the time and effort to figure out you leaked your stipe key to your front end? Sure people have bots to do that, but it’s kinda unbelievable someone would run such a bot on their vibe coded website. I could offer some anecdata as a counterargument but I'm a bit ashamed about how it happened so I'll just say, you friend was lucky it only ended at that.
  • exe34 1y ago
    The thing about bots is that it costs almost nothing to run them against millions of sites every day. It's got nothing with "but what are the odds?!", at large enough scale, unlikely things happen all the time.
• CharlieDigital 1y ago
  It's def a hacker from a the incumbent because: 1) They took action after getting the Stripe key by refunding all customers 2) They drafted an email to all customers after a hack that got the mailing list and API route to send emails 3) Not once has the hacker asked for compensation of any kind nor a ransom
  • anamexis 1y ago
    I don't see how any of that implies that an incumbent did it.
    • YokoZar 1y ago
      If you were a criminal trolling the Internet for vulnerable servers and found stripe keys... would your first instinct be to refund customers rather than do some other sort of crime? Like what's the motivation you envision here?
      • anamexis 1y ago
        There are black hat hackers that take great joy in just causing as much chaos as possible, particularly with such vibe-coded apps. Even with stripe keys, it's not like they could direct money elsewhere.
      • dijksterhuis 1y ago
        Some people just want to watch the world burn :shrugs:
      • chillfox 1y ago
        Fun and internet points!
      • WD-42 1y ago
        "Because I can" or "Because it's funny" are more than enough reason for most people. The fact that the hacker refunded all the customers, then emailed them to warn them that they were using a terrible app actually sounds like a pretty tame troll to me. If the hacker was truly hired by the competition to act maliciously, they could have done far, far worse. Your friend should take this as a lesson instead of trying to deflect blame to their competitors.
• graemep 1y ago
  > anyone who runs an internet facing site and can view traffic knows what I'm talking about Most of what I see is looking for very specific vulnerabilities - a very high proportion are looking for hidden files and directories being served (e.g. .git, .env) or specific software (e.g. Wordpress), or similar. In over 20 years of dealing with many mostly smallish businesses the compromises have been: 1. A client who insisted on using Wordpress for one of their sites (against my advice) because they had people who knew it so it was the cheap option. It was easy to see what would happen because those people were not available long term. 2. A very carefully set up server with a hardened kernel etc. I did not set it up so cannot give all details and neither do I know how it was compromised. It was carefully set up because it was a target for political reasons so I would guess it was a targetted attack. On the other hand I know there have been many vulnerabilities. There have been many vulnerabilities in the applications - the outstanding examples being creating queries by concatenating user input with SQL (no escaping at all) in multiple places across a small site (years ago), and (recently) finding code that called (python) exec on user input. Many other flaws that have been present for years. Not updating OSes, server software and frameworks for many years is usual. In spite of all that, just those two compromises. You will probably get away with a high degree of bad code and bad practices in deployment and maintenance with a small site.
• bartread 1y ago
  It's 100% this. Anyone who's run a website or web app for any length of time in recent years and makes a habit of inspecting their logs will quickly realise that they're being scanned by bots looking for vulnerabilities multiple, or even many, times per day. The search for vulnerabilities is entirely automated and will pick up any domain that has a website or web app attached to it. One those vulnerabilities are found, the hackers will pounce, and, whilst ransomware is one potential outcome, they might instead do all of the kinds of things GP has described. They don't care what the site is for or what industry you're in.
  • pydry 1y ago
    >One those vulnerabilities are found, the hackers will pounce ...and work to exploit your code to their own benefit. They don't do this just so that they can refund your customers.
    • NoGravitas 1y ago
      I mean, I can see refunding their customers just for the lols.
      • adr1an 1y ago
        From the customers' perspective sounds ethical. The product was broken or extremely cheap quality, and not what it seemed to be originally when you decided to purchase... Is this black or white? ;p
    • parliament32 1y ago
      Often it's just done for reputation. "We got ahold of their stripe key and refunded everything lol" is hilarious and absolutely on-brand.