TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Hacking PayPal Accounts with one click

324 pointsby butwhyover 10 years ago

12 comments

tshadwellover 10 years ago
Pivotal paragraph: &quot;We have found out that an Attacker can obtain the CSRF Auth which can be valid for ALL users, by intercepting the POST request from a page that provide an Auth Token before the Logging-in process, check this page for the magical CSRF Auth “<a href="https://www.paypal.com/eg/cgi-bin/webscr?cmd=_send-money”" rel="nofollow">https:&#x2F;&#x2F;www.paypal.com&#x2F;eg&#x2F;cgi-bin&#x2F;webscr?cmd=_send-money”</a>. At this point the attacker Can CSRF “almost” any request on behave of this user.&quot;<p>He captured a cross-site request forgery token which was valid for all users.
评论 #8695486 未加载
评论 #8696291 未加载
IkmoIkmoover 10 years ago
Paypal should literally pay upwards of $100k for a bug like this. This is a game changing systemic security issue putting literally every single customer at risk, as well as put at least a minor dent in a the brand of a $40 billion dollar company. $10k is a joke.<p>Wouldn&#x27;t say $10k isn&#x27;t nice. Rather, I&#x27;d say that history has told us people are susceptible to money. And if someone can choose between $10k and selling information worth much more, let&#x27;s just conservatively say without pulling numbers from my ass, people would choose the latter option more than Paypal ought to want them to, and that this costs them way more than the $10k they&#x27;d otherwise lose. I think that&#x27;s a pretty fair statement.<p>Anyway, about the issue itself... Really don&#x27;t know what to think, it&#x27;s pretty insane, puts a lot of things into perspective once more. (the whole &#x27;if Paypal can&#x27;t secure xyz, can my local hospital keep my health records safe, am I equiped to handle my own digital security responsibilities?&#x27; train of thought).<p>Oh if anyone feels like thinking this through, how bad do you guys think this hack could have turned out if deployed by a malicious group? Paypal is pretty walled in with various limits, fraud checks, frozen accounts, multi-day bank transaction processing, reversible transactions, partnerships with banks to do chargebacks there, and they do KYC on every account. The offramps are therefore pretty limited unless you completely expose your identity. Of course they could buy a ton of stuff online, but how anonymous would the shipping be, and what could you buy with Paypal that would be liquid enough, would ship quickly and could be received fairly anonymously (you don&#x27;t want to use this hack and end up with 100 playstations and on 3-day shipping to your own home and have police arrive before the goods do!). I wonder what the best plan of action would be, I can&#x27;t really come up with any solid way to actually walk away, anonymously, with a ton of money but surely there must be one. Indulge me if you want!
评论 #8697838 未加载
评论 #8697403 未加载
评论 #8696636 未加载
评论 #8697183 未加载
评论 #8699419 未加载
dmixover 10 years ago
Reminds me of how PayPal implemented 2FA, then someone immediately found a bypass since they only made 2FA a requirement for a particular web login page instead of EVERY login entry-point (ie mobile or APIs). PayPal&#x27;s security continues to be embarrassingly bad.
评论 #8694938 未加载
评论 #8694746 未加载
评论 #8695816 未加载
评论 #8695592 未加载
downandoutover 10 years ago
I think I speak for us all when I say ???????!!!!!!!. This exploit is as big as they come. They should have paid him many times their $10k maximum bounty in exchange for an NDA, as I am sure I am not alone in saying that this shakes my confidence in PayPal. While I have never trusted them as far as random account freezings etc., I didn&#x27;t ever expect something as fundamental and serious as this. When you think of all the engineers they must have dedicated to security, it is almost unfathomable that this was missed.
评论 #8696497 未加载
Globzover 10 years ago
10K for this kind of vuln is very cheap on their part.<p>This is serious when you consider that they are moving millions of transactions every day...<p>CSRF valid for ALL users, ouch!
评论 #8696290 未加载
评论 #8697769 未加载
评论 #8695976 未加载
lost_nameover 10 years ago
Paypal&#x27;s Bug Bounty program, for the curious: <a href="https://www.paypal.com/webapps/mpp/security/reporting-security-issues" rel="nofollow">https:&#x2F;&#x2F;www.paypal.com&#x2F;webapps&#x2F;mpp&#x2F;security&#x2F;reporting-securi...</a>
评论 #8694611 未加载
评论 #8694616 未加载
jrochkind1over 10 years ago
Oh man. Security is hard, and I expect security flaws to be found in almost any software.<p>But these don&#x27;t _seem_ to be flaws that you&#x27;d have if you were spending as much money&#x2F;resources&#x2F;prioritization on security as I&#x27;d expect a business in Paypal&#x27;s business to be spending.<p>Am I wrong?
评论 #8695916 未加载
评论 #8695410 未加载
codegeekover 10 years ago
Thanks for this. Another reason for me to get off Paypal as fast as I can. I understand that vulnerabilities can exist with any system but Paypal just continues to amaze. Unfortunately, I still have 3 customers on paypal :(
Nanzikambeover 10 years ago
Anyone know what the interception proxy&#x2F;tool he&#x27;s using in the screenshots is? I could really have used that a few days ago
评论 #8694919 未加载
user1024over 10 years ago
Scary stuff. My Paypal was compromised earlier this week; wondering if this vulnerability or one like it was used.
thekylemontagover 10 years ago
I can only imagine how much money he got for this one. Very serious bug given how easy it was to reproduce.
评论 #8695099 未加载
lcfcjsover 10 years ago
Should have used js, fuckin noobs