PayPal 2FA Bypass
henryhoggard.co.uk
PayPal 2FA Bypass
1–10 of 148 posts
Re: PayPal 2FA Bypass
#2What could the backend logic possibly be this worked?
Re: PayPal 2FA Bypass
#3I've seen equally as ridiculous web bugs, computing prices browser side in javascript, credit card numbers encoded in REST API endpoints, financial websites not supporting 2FA at all or mixing http requests into the sites. We're solidly in the dark ages of web security still.
Re: PayPal 2FA Bypass
#4The simplicity of this exploit demonstrates something profound. The most dangerous things in life are not hidden deep in the weeds. Rather, they stare us in the face in the most obvious spots. It isn't the unknown that presents the biggest threat. It is the known that we never gave a second look.
Re: PayPal 2FA Bypass
#5What could the backend logic possibly be this worked?
Something like this: (PHP felt like the right approach here :p)
if ($selectedOption == SECURITY_QUESTION)
{
if (isset($_POST["SecurityQuestion0"]) && isset(["SecurityQuestion1"]))
{
if ($_POST["SecurityQuestion0"] != $answer0 || $_POST["SecurityQuestion1"] != $answer1)
{
// invalid answers
return;
}
}
authenticateUser();
}Re: PayPal 2FA Bypass
#6What could the backend logic possibly be this worked?
If there's a SMS challenge, process.
If there's a question challenge, process.
If no exceptions were thrown, you're authenticated.
Re: PayPal 2FA Bypass
#7I'm using Verisign's VIP Access app (silly name) to generate PayPal's 2FA tokens.
Good thing is it works without access to my phone.
Bad thing, the app has a unique ID that PayPal only allows me to use for one of my three accounts.
Wish they implement TOTP.
Re: PayPal 2FA Bypass
#8One of my PayPal 2FA phone numbers is listed twice and both cannot be removed (errors when I try). Their support can't help with the situation because their side wasn't able to see the duplicate.
This is not surprising to me.
Re: PayPal 2FA Bypass
#9Ouch!
Also, PayPal really needs to stop using SMS for 2fa.
I expect more from a payment processor that is linked to my bank account.
Re: PayPal 2FA Bypass
#10[deleted]