← Back to context

Comment by zerkten

6 days ago

>> It was crazy just how fast it was exploited.

People underestimate the speed, but also the number of pivots that advanced attackers will make. Sure, these kinds of problems are easy to exploit, but with major organizations that employ reasonable defenses, the attackers will pivot through 50+ exploits/machines/layers to get to the target(s). This can take place over weeks or months.

It still doesn't make sense that advanced attackers would go to those lengths in order to... refund the customers.

  • There are lots of smart kids who don't particularly need reasons for causing mayhem. Suppose it was somebody profit-motivated though. They might be:

    1. Distracting from a more important vulnerability

    2. Later contacting customers, advising them of the "accidental" refund and redirecting them to a more appropriate payment mechanism (one without the KYC Stripe does, were they to try to steal funds directly)

    3. Testing stolen credit cards before using them elsewhere

    Etc. Scamming people is a big industry, and not all of the plots are immediately obvious.