Developer Office Hours: January Edition

2 responses to “Developer Office Hours: January Edition”

1. 

   lkraav

   January 12, 2023

   I’d like to discuss the ongoing card testing and fraudulent charges attacks against Woo stores.

   https://wptavern.com/woocommerce-store-owners-combat-fraudulent-stripe-charges

   Topics like

   this problem seems to get 0 attention from core team, or am I missing info about where it’s worked on?
   core is still woefully underequipped for defenses out of the box, and no open work towards it – at minimum you need reCAPTCHA, rate limiting, etc
   core has serious design flaws from security perspectives: multiple garbage objects can get created per one attack requests, and this can easily multiple to tens of thousands garbage users, orders, subscriptions, etc overnight – massive cleanup needed, where some of it is even non-restorable (can’t really rewind sequential order numbers etc) https://github.com/woocommerce/woocommerce/issues/24603
   I see reports where even with hifi defenses up, attackers are still able to run card testing attacks – I’d like to get insight from payment gateway developers if it is still possible to send payment processor requests via direct JS API-s while skipping server-side validations, like reCAPTCHA, because that’s what it sounds like.

   Reply
   1. 

      tobinfekkes

      January 13, 2023

      Yes, the StoreAPI with the new checkout block really opened the door and lowered the barrier to fraud checkouts. Especially during the holidays, it got pretty bad.

      Rate-limiting was released as part of the Woo Gutenberg Blocks plugin.

      https://github.com/woocommerce/woocommerce-blocks/blob/trunk/src/StoreApi/docs/rate-limiting.md

      Prior to this, we had developed a few in-house tools to prevent the card-testing fraud on our sites, which worked really well. A mix of blocks to prevent certain IP addresses, or physical addresses, or email address, storing the card token now but charging it later in a background task, require user input to select an auto-completed address, etc. The fraudsters aren’t terrible clever; most of the checkout data followed patterns that we could build blocks against.

      I would check out that rate-limiting option. It takes a bit of tweaking to get the block ratio just right for your store. But that feature, plus our other blocking strategies, has reduced the card testing down to nothing.

      Remember, you don’t have to block EVERY fraud request. You just have to make it slow enough, inconsistent enough, or unreliable enough, to make it not worth their time with your site. After awhile, the rate of return for them isn’t worth the rate of success with your site.

      Reply