Medium Response to Stripe Account subject | by Teri Radichel | Bugs That Chew | Jan, 2023 | Guard Tech

I nonetheless do not receives a commission and there isn’t any method to repair it proper now

So I wrote about how I do not get common payouts right here:

Medium’s response is that they cannot pay me as a result of they haven’t any management over Stripe’s safety. Hey? I work in cybersecurity and that reply does not make sense.

However the greatest downside is that I nonetheless haven’t got a solution to the query:

What’s the electronic mail or account you’re utilizing to ship funds to Stripe?

As a result of it doesn’t matter what electronic mail I strive on Stripe, it says the account does not exist.

I requested Medium for that data once more to search out out which account to ask Stripe about. In any other case Stripe most likely has no thought how one can discover out which Stripe account is linked to my Medium account.

Additionally, if somebody malevolently I modified my Stripe account hyperlink on Medium, I will not have any details about the malicious account to contact Stripe. I am not saying that is what occurred, simply that Medium’s reply is not useful.

You can strive linking a brand new Stripe account, however there appears to be no method to do this and assist did not present that possibility. That possibility might be dangerous to grant through electronic mail, as it might be conducive to phishing assaults.

Hoping Medium will present a safe method to do that on their web site as quickly as potential. And the potential for logging in with Yubikeys as a second issue.

How either side of an integration can result in a safety subject

Here is why blaming Stripe safety for the issue does not make sense.

A safety subject on both aspect of an integration can lead to an information breach or safety incident.

In case you are integrating with one other supplier and misconfigure your finish, or if in case you have a safety vulnerability in your finish that permits attackers (or malicious insiders) to use credentials, change or steal information, your organization could be the supply of the safety downside

In that situation, one thing on the center aspect may need modified my Stripe integration to an alternate account. I do not know as a result of I can not seem to discover anyplace I can take a look at that hyperlink to see if any malicious accounts are linked to Medium.

Additionally contemplate the next, associated to the information breach that led to the safety I wrote about in my final put up. What if an attacker had a method to tamper with the methods in such a method that I obtained an electronic mail and noticed I acquired $2, when in truth my cost was a lot increased and somebody internally or attacking the system was redirecting a portion of my funds elsewhere?

I doubt that is occurring, as a result of an attacker must present me a half faux checkout web page and ship the corresponding faux electronic mail and get the corresponding account for it to indicate up on my Stripe account. Oh however wait. I’m not receiving my funds now… how may somebody present me faux pages? Effectively, for starters, it caches poison assaults. James Kettle has written and spoken about quite a few methods to assault caches, and I’ve seen some conduct that seems to be cached on Medium.

I used to be simply trying again on the earlier payouts and so they have been increased though I am getting much more outcomes not too long ago. All of it appears unusual to me however I am not going to fret as a result of not one of the quantities are price my time. However for an attacker including a bunch of small quantities of various Medium writers, it definitely might be.

Till I do know that my unique account that I signed up with for Stripe to make use of with Medium remains to be intact, I do not know if the difficulty is with Medium or not. So until they’ll present Stripe account data so I can confirm that, I am unsure the place the issue lies.

The identical may have occurred at Stripe. Somebody may need modified my Stripe account hyperlink to Medium to a distinct Stripe account with ample entry. Or if Stripe had some sort of breach the place they obtained into my account, possibly they began sending funds to an alternate checking account. Possibly Stripe came upon it was a malicious checking account and closed my account.

Sadly, I haven’t got sufficient data to find out what actually occurred. I am simply laying out some menace fashions and explaining why blaming Stripe assist does not make sense.

Not less than from my perspective, I haven’t got sufficient data to return to that conclusion. And likewise, I nonetheless haven’t any method to repair or log into my Stripe account that’s linked to Medium as a result of I do not know what account it’s.

Almost definitely…

I assume I simply do not bear in mind the details about the Stripe account I linked with Medium. However I’ve no method of figuring out as a result of I am unable to see any details about my Stripe account on Medium.

It’s totally unusual although that I have not touched any of that and even logged in and simply stopped getting paid.

Hoping they’ll present the stripe account data.

Within the meantime, I’ll dig via my information for any data on which Stripe account I used to enroll in Medium. I am certain I’ve it written down someplace…

teri radichel

In the event you preferred this story ~ clap your palms, comply with me, tip, purchase me a espresso or rent me:

Medium: Teri Radichel
Electronic mail Listing: Teri Radichel
Twitter: @teriradichel
Twitter (firm): @2ndSightLab
Mastodon: @[email protected]
Put up: @teriradichel
Fb: 2nd Sight Lab
Slideshare: Displays by Teri Radichel 
Speakerdeck: Displays by Teri Radichel
Books: Teri Radichel on Amazon
Recognition: SANS Distinction Makers Award, AWS Hero, IANS College
Certifications: SANS
Training: BA Enterprise, Grasp of Sofware Engineering, Grasp of Infosec
How I obtained into safety: Lady in tech
Purchase me a espresso: Teri Radichel
Firm (Penetration Exams, Assessments, Coaching): 2nd Sight Lab
Request providers through LinkedIn: Teri Radichel or IANS Analysis

© second sight lab 2022

_____________________________________________

Creator:

Cybersecurity for executives within the cloud period at Amazon

Do you want cloud safety coaching? 2nd Sight Lab Cloud Safety Coaching

Is your cloud safe? Rent 2nd Sight Lab for a penetration take a look at or safety evaluation.

Do you might have a query about cybersecurity or cloud safety? Ask Teri Radichel by scheduling a name with IANS Analysis.

Cybersecurity and Cloud Safety Sources by Teri Radichel: Cybersecurity and cloud safety lessons, articles, white papers, displays, and podcasts