Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PayPal 2FA Bypass

henryhoggard.co.uk

Post reply on HN
Print view View original

101–110 of 148 posts

Re: PayPal 2FA Bypass

#101

Post by noamyoungerm »

ryanfreeborn wrote: post #13

Is 17 days an acceptable TAT here? I know investigation and fixes can be a challenge, but with the severity of this exploit+PayPal being a serious financial service, I kind of would hope for a faster fix. Maybe I'm off base...I really don't know; curious what others think. How much time would've had to pass (without PayPal doing anything) before the author is ethically obligated to post to HN/media/etc about the hack…

Notice that 17 days is basically what is needed to add the issue to the next sprint, complete its development along with everything else for that sprint, and deploy to a live site. To me that sounds fair.

Re: PayPal 2FA Bypass

#102

Post by Vendan »

gant wrote: post #53
bostik wrote: post #41

Earlier quoted context omitted.

The cardinal rule of security is: you never, ever, trust anything the client sends . This bypass is a perfect example. Although author doesn't mention which interception proxy he used, I'm 99% sure it was Burp. Replaying modified content is trivial.

Even with a free software tool like mitmproxy modifying requests is trivial. You don't even need Burp.

the free version of burp is completely capable of doing this, and so much more

Re: PayPal 2FA Bypass

#103

Post by dylanz »

tptacek wrote: post #97
dkopi wrote: post #56

Mistakes were made, and there are definitely lessons to be learned, but if we want to improve the state of security, we really need to change the way we react to these types of bugs. If a service has an outage and a company posts a postmortem, we all think: "wow! that was an interesting bug, lets learn from this". We shouldn't be treating security issues differently. People who make security mistakes aren't idiots. T…

While I strongly agree with the thrust of your comment, I'd like to chime in and say that this is not a cool bug. On the scale of web security bugs, this is the kind of thing you expect an intern to find. I actually think the post was written in recognition of that fact, and was amused by the thudding, abrupt conclusion it had; it was like the author was sharing a joke. "Yup, it was that easy". People who do this kin…

What are some tools you'd recommend running? I'd love to have more awareness as I passively browse.

Re: PayPal 2FA Bypass

#104

Post by tptacek »

dylanz wrote: post #103
tptacek wrote: post #97

Earlier quoted context omitted.

While I strongly agree with the thrust of your comment, I'd like to chime in and say that this is not a cool bug. On the scale of web security bugs, this is the kind of thing you expect an intern to find. I actually think the post was written in recognition of that fact, and was amused by the thudding, abrupt conclusion it had; it was like the author was sharing a joke. "Yup, it was that easy". People who do this kin…

What are some tools you'd recommend running? I'd love to have more awareness as I passively browse.

The open source tooling here is getting better but the gold standard, used by virtually every professional application security worker in the industry, is Burp Suite. Lots of people have tried to make modernized, open source versions of Burp, but at this point cloning it is like cloning Microsoft Word.

If I was your director of security, one of the first things I'd do is build a plan to get all your developers trained up on Burp. It's useful for more than just security testing.

Re: PayPal 2FA Bypass

#106

Post by TazeTSchnitzel »

pkamb wrote: post #105

Sounds like a lot of work! Paypal will just turn off two-factor themselves if you ask nicely via an unverified twitter DM. http://imgur.com/a/Tu1AN https://www.reddit.com/r/SocialEngineering/comments/3kgw3s/p...

PayPal's 2FA broke on me when it started locking my account every time I attempted to use it, because I'd previously made it send too many SMSes (poor signal).

I was thankful that support let me disable it, but it was worrying they didn't try to verify that I actually controlled my device first.

Re: PayPal 2FA Bypass

#107

Post by TazeTSchnitzel »

DavidWanjiru wrote: post #69

Am I the only one who found it odd that the author had internet access, but there was no phone signal? Maybe it's because I'm Kenyan, where phone penetration is much higher than internet penetration, and where internet access over GSM has the biggest share of the internet access pie chart.

> Am I the only one who found it odd that the author had internet access, but there was no phone signal?

This happens to me at home. Poor cell reception, but WiFi.

Re: PayPal 2FA Bypass

#108

Post by Sophira »

Drdrdrq wrote: post #99
TeMPOraL wrote: post #58

Earlier quoted context omitted.

> If you can't - just generate a random password as the answer. "I_ty/:QWuCllV?'6ILs`O12kl;d0-`1" is an excellent name for your first dog / high school. Just don't forget to use a password manager to store these. Be wary of social engineering attacks though. - I'd also need you to provide me an answer to your security question. What was your first dog's name? - Oh, you know, it's a long string of random characters I…

That's why mine answers are "DO NOT ACCEPT THIS ANSWER!!! ". Hopefully the support person will get the hint. :-/

Unfortunately, if they don't or are forced by policy, then you've just told the Internet your security answers.

If I were you I'd edit that and reword it without specifics.

Re: PayPal 2FA Bypass

#109

Post by Sophira »

jstanley wrote: post #90
i336_ wrote: post #77

Earlier quoted context omitted.

But it must be said that GPU evolution, and that password cracking software developers are naturally going to go where the passwords are, that this type of simple password design does NOT work anymore.

How so? The point of a random-four-words password isn't that it won't be hit by existing brute force software, it's that it's easy to remember but impractical to brute force with any software - with a 60,000 word dictionary there are more than 2^63 possible passwords.

That's true, but the whole point of the strip was that you use words that evoke an easily-memorable scene in your head.

That will probably mean you can confine your list to words that most people know, which reduces the search space significantly. "correct", "horse", 'battery" and "staple" are all very common words.

Re: PayPal 2FA Bypass

#110

Post by raesene9 »

dylanz wrote: post #103
tptacek wrote: post #97

Earlier quoted context omitted.

While I strongly agree with the thrust of your comment, I'd like to chime in and say that this is not a cool bug. On the scale of web security bugs, this is the kind of thing you expect an intern to find. I actually think the post was written in recognition of that fact, and was amused by the thudding, abrupt conclusion it had; it was like the author was sharing a joke. "Yup, it was that easy". People who do this kin…

What are some tools you'd recommend running? I'd love to have more awareness as I passively browse.

In addition to burp that's already had a mention, I'd recommend looking at OWASP ZAP. It's fully open source, which is nice and has had a lot of new features over the last couple of years.

It can also be integrated into CI pipelines for automated security testing.

Post reply on HN