Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“We found PayPal vulnerabilities and PayPal punished us for it”

cybernews.com

Post reply on HN
Print view View original

31–40 of 337 posts

Re: “We found PayPal vulnerabilities and PayPal punished us for it”

#31

Post by mtgx »

rideontime wrote: post #13

From PayPal's response to a 2FA bypass: > If the attacker has the victim's password, they would already be able to gain access to the account via web UI too. As such, the account is already compromised. As such, there does not appear to be any security implications as a direct result of this behavior. Seriously? This means PayPal's 2FA is just security theater. I'd rather they didn't offer it at all in this case, at…

I think if you Google Paypal 2FA security issue, you'll find multiple such bugs found over the years. They've never fixed it.

Re: “We found PayPal vulnerabilities and PayPal punished us for it”

#32

Post by nebulous1 »

rideontime wrote: post #13

From PayPal's response to a 2FA bypass: > If the attacker has the victim's password, they would already be able to gain access to the account via web UI too. As such, the account is already compromised. As such, there does not appear to be any security implications as a direct result of this behavior. Seriously? This means PayPal's 2FA is just security theater. I'd rather they didn't offer it at all in this case, at…

From reading a different article, the terminology seems to be a bone of contention here. This ’2FA' is an email message PayPal send when they detect a new login location. They do not call it 2FA and they do offer actual 2FA that cybernews have not bypassed.

Re: “We found PayPal vulnerabilities and PayPal punished us for it”

#33

Post by thaumasiotes »

sn4pp wrote: post #24
ohithereyou wrote: post #17

Earlier quoted context omitted.

The market for a freelance security researcher out there is hard, no doubt, but disclosing bugs publically is an addition to your resume, akin to any other professional development you do. It demonstrates you can do the work and it shows the skills you have. Suing someone for disclosing an actual bug is a long term losing proposition for any company in a competitive industry.

> but disclosing bugs publically is an addition to your resume Request disclosure on hackerone then. Idk, breaking the law to get a job doesn't seem ok to me.

The screenshot in #2 does show the H1 Staff screwing up -- @cybernews requests disclosure and gets a response saying "you may request disclosure if you would like this reviewed, using the drop down menu" (which @cybernews has already done).

@cybernews' behavior in that thread isn't ideal, but they're more in the right than in the wrong on that one, judging by the screenshot.

Re: “We found PayPal vulnerabilities and PayPal punished us for it”

#34

Post by rasengan »

ohithereyou wrote: post #26
rasengan wrote: post #14

PCI DSS requirements specify that companies have 30 days to refute or remediate externally reported issues [1]. If they don’t respond or fix some of these issues, then PayPal will no longer be compliant and all credit card companies will be forced to stop working with them unless they wish to set precedence that PCI-DSS compliance is no longer required to be followed. According to this image [2], they did not respond…

Are there other cases where PCI-DSS compliance requirements are selectively enforced?

From this article [1], I get the feeling that PCI-DSS has always been selectively enforced.

[1] https://www.anitian.com/the-failure-of-the-pci-dss/

Re: “We found PayPal vulnerabilities and PayPal punished us for it”

#35

Post by rideontime »

nebulous1 wrote: post #32
rideontime wrote: post #13

From PayPal's response to a 2FA bypass: > If the attacker has the victim's password, they would already be able to gain access to the account via web UI too. As such, the account is already compromised. As such, there does not appear to be any security implications as a direct result of this behavior. Seriously? This means PayPal's 2FA is just security theater. I'd rather they didn't offer it at all in this case, at…

From reading a different article, the terminology seems to be a bone of contention here. This ’2FA' is an email message PayPal send when they detect a new login location. They do not call it 2FA and they do offer actual 2FA that cybernews have not bypassed.

Could you link that article? Because the screenshot in this article pretty clearly shows PayPal sending an SMS to the user's phone.

Re: “We found PayPal vulnerabilities and PayPal punished us for it”

#36

Post by cryptica »

admax88q wrote: post #19
rasengan wrote: post #14

PCI DSS requirements specify that companies have 30 days to refute or remediate externally reported issues [1]. If they don’t respond or fix some of these issues, then PayPal will no longer be compliant and all credit card companies will be forced to stop working with them unless they wish to set precedence that PCI-DSS compliance is no longer required to be followed. According to this image [2], they did not respond…

> then PCI-DSS is a farce. Take a wild guess on what you think will happen.

All these regulations are bs. Designed to keep small players out.

Re: “We found PayPal vulnerabilities and PayPal punished us for it”

#37

Post by tsukurimashou »

rasengan wrote: post #14

PCI DSS requirements specify that companies have 30 days to refute or remediate externally reported issues [1]. If they don’t respond or fix some of these issues, then PayPal will no longer be compliant and all credit card companies will be forced to stop working with them unless they wish to set precedence that PCI-DSS compliance is no longer required to be followed. According to this image [2], they did not respond…

no shit PCI-DSS is a farce

it's just there to make people that don't know anything about technology feel better

Re: “We found PayPal vulnerabilities and PayPal punished us for it”

#38

Post by nebulous1 »

rideontime wrote: post #35
nebulous1 wrote: post #32

Earlier quoted context omitted.

From reading a different article, the terminology seems to be a bone of contention here. This ’2FA' is an email message PayPal send when they detect a new login location. They do not call it 2FA and they do offer actual 2FA that cybernews have not bypassed.

Could you link that article? Because the screenshot in this article pretty clearly shows PayPal sending an SMS to the user's phone.

https://www.forbes.com/sites/zakdoffman/2020/02/22/paypal-cr...

I should note that I haven't really investigated this so I don't claim to know any truth.

Re: “We found PayPal vulnerabilities and PayPal punished us for it”

#40

Post by joking »

ohithereyou wrote: post #23
thaumasiotes wrote: post #6

Earlier quoted context omitted.

They had out-of-scope issues closed as being out-of-scope, which automatically lowers their reputation on the platform. The researchers are outraged: > When we submitted this to HackerOne, they responded that this is an “out-of-scope” issue since it requires stolen PayPal accounts. As such, they closed the issue as Not Applicable, costing us 5 reputation points in the process. But Paypal's policy really couldn't be c…

All the more reason to not submit bugs like this to HackerOne. If you can bypass 2FA by having only one factor then I wouldn't consider that 'stolen credentials' and more a singular stolen credential. Their system is designed to defend against this and it does so ineffectively. That is, by definiton, a security issue. I wish I could define what is and isn't a bug in my code at work. My defect rate would be incredible…

The mitical “it’s not a bug, it’s a feature!”
Post reply on HN