Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PayPal 2FA Bypass

henryhoggard.co.uk

Post reply on HN
Print view View original

121–130 of 148 posts

Re: PayPal 2FA Bypass

#121

Post by hoorayimhelping »

ploxiln wrote: post #111
dkopi wrote: post #56

Mistakes were made, and there are definitely lessons to be learned, but if we want to improve the state of security, we really need to change the way we react to these types of bugs. If a service has an outage and a company posts a postmortem, we all think: "wow! that was an interesting bug, lets learn from this". We shouldn't be treating security issues differently. People who make security mistakes aren't idiots. T…

I disagree. Your "lets be super nice to everybody" strategy has come to an absurd conclusion. Is there no-one who can be held accountable for competency which they claim, when it comes to computer stuff? PayPal doesn't write on its websites "We're some enthusiasts with no software or security experience. Let's see how well this works, together!" No, like everyone in this industry, PayPal claims its security experts h…

>I disagree. Your "lets be super nice to everybody" strategy has come to an absurd conclusion.

You and I must have read a different response, cause I saw nothing in there about "being super nice to everyone." What I saw was a reasonable request not to commit the Fundamental Attribution Error. Which is paraphrased as: when I screw up, there were extenuating circumstances. When you screw up it's cause you're a moron.

https://en.wikipedia.org/wiki/Fundamental_attribution_error

Re: PayPal 2FA Bypass

#122

Post by ryanlm »

I'm assuming that the relevant code, is simply an if statement checking for the existence of the url parameters, not even checking if the security questions are correct.

    if(isset($_GET['securityQuesiton0')) {
        // success, 
    }
This is negligence on the developers part and I think they should be disciplined.

Re: PayPal 2FA Bypass

#123

Post by bramblerose »

microcolonel wrote: post #43
discordance wrote: post #9

Ouch! Also, PayPal really needs to stop using SMS for 2fa. I expect more from a payment processor that is linked to my bank account.

What exactly is wrong with offering SMS 2FA? I don't have a smartphone, but I have a great little prepaid phone. Why should I get no features just because they are not necessarily as good as it gets ? Also, as far as I'm aware, all of the major "attacks" on SMS 2FA are just the fact that a smartphone can be compromised in many ways. I have much less attack surface: an attacker would need to reprogram my undocumented…

There is a TOTP/Google Auth 2FA application for J2ME, which will run on many feature phones: http://totpme.sourceforge.net/

In addition, 2FA systems are not limited to devices the consumer already has -- Paypal could easily send you a device that generates a one-time password, or that uses a challenge-response protocol to do so.

Re: PayPal 2FA Bypass

#124

Post by zifnab06 »

dexterdog wrote: post #98
TeMPOraL wrote: post #58

Earlier quoted context omitted.

> If you can't - just generate a random password as the answer. "I_ty/:QWuCllV?'6ILs`O12kl;d0-`1" is an excellent name for your first dog / high school. Just don't forget to use a password manager to store these. Be wary of social engineering attacks though. - I'd also need you to provide me an answer to your security question. What was your first dog's name? - Oh, you know, it's a long string of random characters I…

I always fill all social engineering-vulnerable questions with nonsense, especially when it is a banking site. I like when they let you set the question yourself so you can put something like "Why would a secure financial institution allow such a horrible security hole in it's system?" To which the answer is Tyrolese4Tokyo_Beulah!Papuan.

I fill them with nonsense words unrelated to the question. Mother's maiden name? Fire truck. First car? Air conditioner.

If I have to call a company they always ask me why. The explanation is anyone who has me as a Facebook friend can figure out who my first girlfriend was, my maternal grandmother's first name, my mother's maiden name, where I was born, my first car, etc. And if every company has the same data, a data breach at one makes the entire system fall apart.

Re: PayPal 2FA Bypass

#125

Post by zifnab06 »

agildehaus wrote: post #8

One of my PayPal 2FA phone numbers is listed twice and both cannot be removed (errors when I try). Their support can't help with the situation because their side wasn't able to see the duplicate. This is not surprising to me.

I've been unable to remove a credit card from my account for almost 5 years. It's since expired, and is somehow stuck as the default payment method.

Re: PayPal 2FA Bypass

#126

Post by closeparen »

bostik wrote: post #41
the7nd wrote: post #4

The simplicity of this exploit demonstrates something profound. The most dangerous things in life are not hidden deep in the weeds. Rather, they stare us in the face in the most obvious spots. It isn't the unknown that presents the biggest threat. It is the known that we never gave a second look.

The cardinal rule of security is: you never, ever, trust anything the client sends . This bypass is a perfect example. Although author doesn't mention which interception proxy he used, I'm 99% sure it was Burp. Replaying modified content is trivial.

>you never, ever, trust anything the client sends.

The author likely wrote code that correctly validates "for all security questions a correct answer is given" and just forgot about the part where "for-all propositions are trivially true of the empty set."

It's easy to read a for loop for what it's intended as - a loop - and not think about "what if we never enter it at all?"

Re: PayPal 2FA Bypass

#127

Post by kelnage »

ryanlm wrote: post #122

I'm assuming that the relevant code, is simply an if statement checking for the existence of the url parameters, not even checking if the security questions are correct. if(isset($_GET['securityQuesiton0')) { // success, } This is negligence on the developers part and I think they should be disciplined.

Or they designed it to show a variable number of security questions (so management could come along and say "we need 4 questions now" without causing havoc). Then they'd iterate through the responses, verifying them against the appropriate question. Simply forgetting to enforce that the number of questions asked has to equal the number of responses sent would cause the described vulnerability.

Re: PayPal 2FA Bypass

#128

Post by gengkev »

ryanlm wrote: post #122

I'm assuming that the relevant code, is simply an if statement checking for the existence of the url parameters, not even checking if the security questions are correct. if(isset($_GET['securityQuesiton0')) { // success, } This is negligence on the developers part and I think they should be disciplined.

That doesn't actually make sense, since the exploit is to leave securityQuestion0 unset...

Re: PayPal 2FA Bypass

#129

Post by Karunamon »

hoorayimhelping wrote: post #121
ploxiln wrote: post #111

Earlier quoted context omitted.

I disagree. Your "lets be super nice to everybody" strategy has come to an absurd conclusion. Is there no-one who can be held accountable for competency which they claim, when it comes to computer stuff? PayPal doesn't write on its websites "We're some enthusiasts with no software or security experience. Let's see how well this works, together!" No, like everyone in this industry, PayPal claims its security experts h…

> I disagree. Your "lets be super nice to everybody" strategy has come to an absurd conclusion. You and I must have read a different response, cause I saw nothing in there about "being super nice to everyone." What I saw was a reasonable request not to commit the Fundamental Attribution Error. Which is paraphrased as: when I screw up, there were extenuating circumstances. When you screw up it's cause you're a moron.…

A company comprised of otherwise reasonable people can behaving shockingly dumb. The only way to make companies learn is to impact their bottom line, and that means not-nice words need to be said.
Post reply on HN