Interesting timing, a pro hackone article on slashdot posted hours after this post about hackerone issues.
“We found PayPal vulnerabilities and PayPal punished us for it”
261–270 of 337 posts
Re: “We found PayPal vulnerabilities and PayPal punished us for it”
#262People have a weird mental model of how big-company bug bounty programs work. Paypal --- a big company for sure, with a large and talented application security team --- is not interested in stiffing researchers out of bounties. They have literally no incentive to do so. In fact: the people tasked with running the bounty probably have the opposite incentive: the program looks better when it is paying out bounties for…
What proof do you have that #6 is not persistent XSS? If it is, that's a potentially brutal vuln (as persistent XSS often is), even if you need the users password to exploit it.
And persistent XSS is definitely not out of scope according to PayPal's guidelines. https://hackerone.com/paypal
Why are you saying #6 --- are duplicates of other people's issues. ? It must have been marked as dupe of N/A. They would haved gained rep if it was a dupe of someone elses report. They lost rep, so it was most likely marked as dupe of an N/A.
As I mention below, the big problem is the OP didn't include POCs. It's easy to claim "oh this is can be exploited so easily" but without a POC, it's not always clear and perhaps he missed some detail that made his assumptions incorrect.
Anyways, I do have to say hackerone looks pretty cool. This is the first I've seen it and they seem like they are working very hard (we all should be working hard) to make this work for everyone. They are likely just victim's of their success.
Re: “We found PayPal vulnerabilities and PayPal punished us for it”
#263Earlier quoted context omitted.
https://www.forbes.com/sites/zakdoffman/2020/02/22/paypal-cr... I should note that I haven't really investigated this so I don't claim to know any truth.
I was about to dismiss the article thanks to lines like this: > In essence, it would work with phished credentials just as well as with stolen ones But, sure enough, it's not the opt-in 2FA, triggered on every login, that was bypassed, but the 2FA checks triggered when PayPal detects suspicious activity. As far as I can tell, if you've enabled 2FA yourself, this bypass won't work. Thanks for the link! Going to go mak…
I went to enable the opt-in 2FA in response to this report. It's pretty rough, IMO. It gives you no way to use scratch codes as a backup. You're stuck with either adding a second TOTP device or allowing SMS as a backup.
Adding a second TOTP device is OK security-wise but adding a second device to my safe and making sure it's still working periodically kind of sucks.
SMS is not OK.
Printed scratch codes would beat the snot out of either.
Re: “We found PayPal vulnerabilities and PayPal punished us for it”
#264Earlier quoted context omitted.
> So you need to be MITM'd and have a malicious cert installed? No. The attacker is the man in the middle to himself , because why are you trusting the client . > A "security" flaw that requires stolen creds and brute forcing isn't going to get much traction anywhere. The feature is meant to stop people from using stolen creds. It does not work. Given that stolen creds exist, that sounds like a security flaw to me.
As far as I can tell, "it's impossible to use stolen credentials" is not part of Paypal's security model or a promise that Paypal has actually made. It's important to distinguish flaws in a company's security model from additional security controls we think they ought to add.
But why does that system exist at all, if it's not supposed to do something?
It's not "impossible to use stolen credentials", it's "you have to clear this barrier to use stolen credentials". If that barrier is broken, that sounds like a flaw in the security model.
Re: “We found PayPal vulnerabilities and PayPal punished us for it”
#265Earlier quoted context omitted.
(remove message) Sorry, on further thought while I still disagree with the analysis above as being overly dismissive, I think the OP may share some blame for not writing higher quality reports with POCs. Also, the OP doesn't explain whether or not they saw the original reports for those marked Duplicate. That's a very critical point. See here - https://docs.hackerone.com/programs/duplicate-reports.html For anyone act…
I don't understand your argument here. "You patch you pay" is not a market term on any bug bounty; people report sev:infos all the time that ultimately get patched, but aren't worth anything (this is why some bounty programs stock sticker and t-shirt SWAG, to placate these submissions). Meanwhile: I don't care even a little bit how Paypal arrived at their "duplicate" response, because Paypal has no incentive to deny…
Oh, sorry about that. Bad habit. Had hoped to get to it before you wasted your time.
That all said, I think you have a knee jerk reaction (given your history) to side with Large Corp. It shows here and really felt like that. Way overly dismissive and condescending.
Having personally worked for large corporations, I can say that the "it's not personal, it's business" motto is pure evil bullshit better suited for mob.
If you (the royal you) can't treat people with respect that they deserve, don't engage until you can.
Re: “We found PayPal vulnerabilities and PayPal punished us for it”
#266I have not used Paypal since I had to file a dispute over an item I bought on ebay via Paypal. As a response they snail-mailed me a bunch of screenshots of an internal web-app with a bunch of info for someone else, SSN, CC number, address, etc. Everything I would need to do something bad. I called them and they did not seem to care so I called the guy (I had his number of course) but he never answered or responded to…
> Then there was a long pause (I guess they assumed the voicemail was over), and it turned out there were 4-5 people on that call and they then discussed how the call went and whether or not it was sufficient to CYA. That's hilarious. Please tell me you kept that recording.
I'd love to tell you that. I had it on my voicemails for a long time but forgot and switched carriers and lost it :(
Re: “We found PayPal vulnerabilities and PayPal punished us for it”
#267People have a weird mental model of how big-company bug bounty programs work. Paypal --- a big company for sure, with a large and talented application security team --- is not interested in stiffing researchers out of bounties. They have literally no incentive to do so. In fact: the people tasked with running the bounty probably have the opposite incentive: the program looks better when it is paying out bounties for…
What proof do you have that #6 is not persistent XSS? If it is, that's a potentially brutal vuln (as persistent XSS often is), even if you need the users password to exploit it. And persistent XSS is definitely not out of scope according to PayPal's guidelines. https://hackerone.com/paypal Why are you saying #6 --- are duplicates of other people's issues. ? It must have been marked as dupe of N/A. They would haved ga…
I agree that real stored XSS is a serious issue. Here, they're using a MITM to get the XSS payload injected, and Paypal has closed it saying it's not "externally exploitable". It sure looks like self-XSS to me. I agree: a POC would clear this up.
All I'll say beyond that is that if they had doc'd a real stored XSS bug in Paypal, my assumption would be that they'd get a bounty for that. That they did not get a bounty for it suggests that it was invalid. Paypal does not have any incentive to stiff researchers on valid submissions; they have in fact the opposite incentive.
Re: “We found PayPal vulnerabilities and PayPal punished us for it”
#268Earlier quoted context omitted.
I don't understand your argument here. "You patch you pay" is not a market term on any bug bounty; people report sev:infos all the time that ultimately get patched, but aren't worth anything (this is why some bounty programs stock sticker and t-shirt SWAG, to placate these submissions). Meanwhile: I don't care even a little bit how Paypal arrived at their "duplicate" response, because Paypal has no incentive to deny…
Oh, sorry about that. Bad habit. Had hoped to get to it before you wasted your time. That all said, I think you have a knee jerk reaction (given your history) to side with Large Corp. It shows here and really felt like that. Way overly dismissive and condescending. Having personally worked for large corporations, I can say that the "it's not personal, it's business" motto is pure evil bullshit better suited for mob.…
My history? I haven't worked for a "large corp" since 1998. Our company works exclusively with startups.
When I say that Paypal has incentives not to ruthlessly deny bounties, I mean actual incentives, not "it feels good to do good" type stuff. Even if their reputation among bounty hunters is factored out: they literally have an incentive to pay bounties. That's the metric by which bounty programs are judged.
Re: “We found PayPal vulnerabilities and PayPal punished us for it”
#269People have a weird mental model of how big-company bug bounty programs work. Paypal --- a big company for sure, with a large and talented application security team --- is not interested in stiffing researchers out of bounties. They have literally no incentive to do so. In fact: the people tasked with running the bounty probably have the opposite incentive: the program looks better when it is paying out bounties for…
I agree -- the tone of the article was cloak-and-daggers, which makes me think things are not what they seem they are. Unless we fully understand the exact set of issues, it is difficult to decide either way.
Sadly, this also undermines trust in the overall state of "security research", which most of the time, borders on being silly. :-/
Re: “We found PayPal vulnerabilities and PayPal punished us for it”
#270People have a weird mental model of how big-company bug bounty programs work. Paypal --- a big company for sure, with a large and talented application security team --- is not interested in stiffing researchers out of bounties. They have literally no incentive to do so. In fact: the people tasked with running the bounty probably have the opposite incentive: the program looks better when it is paying out bounties for…
I agree -- the tone of the article was cloak-and-daggers, which makes me think things are not what they seem they are. Unless we fully understand the exact set of issues, it is difficult to decide either way. Sadly, this also undermines trust in the overall state of "security research", which most of the time, borders on being silly. :-/
This is on the more-competent end of the spectrum of bounty submissions, for what it's worth. Because the median bounty submission is very, very bad.
These people at least appear to have done some actual work. Paypal is probably one of the most overfished ponds in application security, and they didn't come up with much, but it's at least sort of interesting.