PayPal 2FA Bypass

Post by djf1 » Sun, Oct 23, 2016, 6:27 AM UTC

greyskull wrote: post #2

What could the backend logic possibly be this worked?

  return all([is_valid_answer(q, a) for q, a in params])

Post by blazespin » Sun, Oct 23, 2016, 6:31 AM UTC

ryanfreeborn wrote: post #13

Is 17 days an acceptable TAT here? I know investigation and fixes can be a challenge, but with the severity of this exploit+PayPal being a serious financial service, I kind of would hope for a faster fix. Maybe I'm off base...I really don't know; curious what others think. How much time would've had to pass (without PayPal doing anything) before the author is ethically obligated to post to HN/media/etc about the hack…

Post by citruspi » Sun, Oct 23, 2016, 6:32 AM UTC

greyskull wrote: post #2

What could the backend logic possibly be this worked?

     def validate_security_questions():
        if not question_0 or not question_1:
            raise AuthException('Invalid security questions')

    try:
        validate_security_questions(question_0, question_1)
    except AuthException as ex:
        # Todo: Present error to user
        pass

Post by 1812calif » Sun, Oct 23, 2016, 6:36 AM UTC

the7nd wrote: post #4

The simplicity of this exploit demonstrates something profound. The most dangerous things in life are not hidden deep in the weeds. Rather, they stare us in the face in the most obvious spots. It isn't the unknown that presents the biggest threat. It is the known that we never gave a second look.

Post by Itsdijital » Sun, Oct 23, 2016, 6:41 AM UTC

xorgar831 wrote: post #3

I've seen equally as ridiculous web bugs, computing prices browser side in javascript, credit card numbers encoded in REST API endpoints, financial websites not supporting 2FA at all or mixing http requests into the sites. We're solidly in the dark ages of web security still.