19 ms·

“We found PayPal vulnerabilities and PayPal punished us for it”

980 points by teslademigod1 7y ago

LegitShady 7y ago
>When we pushed the HackerOne staff for clarification on these issues, they removed points from our Reputation scores, relegating our profiles to a suspicious, spammy level. This happened even when the issue was eventually patched, although we received no bounty, credit, or even a thanks. Instead, we got our Reputation scores (which start out at 100) negatively impacted, leaving us worse off than if we’d reported nothing at all. That seems like a good way to make sure nobody trusts your business. What say you, hackerone? How can anyone trust this business acting against what ostensibly is its core functions.
- thaumasiotes 7y ago
  They had out-of-scope issues closed as being out-of-scope, which automatically lowers their reputation on the platform. The researchers are outraged: > When we submitted this to HackerOne, they responded that this is an “out-of-scope” issue since it requires stolen PayPal accounts. As such, they closed the issue as Not Applicable, costing us 5 reputation points in the process. But Paypal's policy really couldn't be clearer: > Out-of-Scope Vulnerabilities > Vulnerabilities involving stolen credentials or physical access to a device ( https://hackerone.com/paypal https://hackerone.com/paypal ) If Paypal says "don't send us this type of report", and you send one anyway, are you really surprised when your account gets a warning attached saying "this person usually files low-value reports"?
  - teslademigod1 7y ago
    but this is it: "This happened even when the issue was eventually patched..." which, based on that, I understand their gripe here
    - thaumasiotes 7y ago
      That would be a valid complaint if their report had been closed Not Applicable on the grounds that the behavior didn't present a significant security risk. But it wasn't; it was closed Not Applicable on the grounds that it was ineligible for the program regardless of whether it was a security risk.
      - teslademigod1 7y ago
        hmm yes, I see your point
  - kidintech 7y ago
    with the acquired information, the researcher has a few options: - bulk acquire stolen credentials, bypass 2FA, bypass the security checks when sending money, and accumulate wealth - sell above process to anyone that has an internet-connected device, the desire to accumulate wealth, and willingness to commit fraud (which I would guess is a non-trivial % of the world's population) - disclose the vulnerabilities to paypal through any available channels The fact that they went with the latter AND were punished for it doesn't shock you? Jesus.
  - rideontime 7y ago
    Their "In-Scope Vulnerabilities" explicitly includes XSS exploits, though, which they also closed as Not Applicable (after patching the issue). Tangentially, as a (former?) PayPal user, it's wild to see that they consider vulnerabilities involving stolen credentials as a non-issue. Why do they offer 2FA at all, then? e: After taking another look at that massive Out-of-Scope list, I'm having a hard time imagining a bug that couldn't be closed as "Not Applicable." What a sham.
    - thaumasiotes 7y ago
      I can't really evaluate #5, but their screenshot undermines them -- it shows a chat session between the victim and "PayPal Virtual Agent", with the virtual agent offering some canned text. If that's all you can do, then this is a self-XSS, which is excluded. #6 is much more clear; that one's very obviously a self-XSS.
      - rideontime 7y ago
        Their full "out of scope" list also includes MITM attacks, which would exclude most of what's in this article. I guess my confusion now is why PayPal even purports to offer bug bounties if they're going to craft an "out of scope" list that allows them to reject every submitted report.
        thaumasiotes 7y ago
        > I guess my confusion now is why PayPal even purports to offer bug bounties if they're going to craft an "out of scope" list that allows them to reject every submitted report. They're not; you're just choosing to assume bad things about them. Their out-of-scope list is fairly standard. If you asked a guy on the street "what would hacking PayPal look like?", the answer they imagined would probably be in scope. For example, if I send you a link to my personal website, and when you visit the website your PayPal account automatically sends $500 to my PayPal account, that's in scope.
        rideontime 7y ago
  - ohithereyou 7y ago
    All the more reason to not submit bugs like this to HackerOne. If you can bypass 2FA by having only one factor then I wouldn't consider that 'stolen credentials' and more a singular stolen credential. Their system is designed to defend against this and it does so ineffectively. That is, by definiton, a security issue. I wish I could define what is and isn't a bug in my code at work. My defect rate would be incredible.
    - joking 7y ago
      The mitical “it’s not a bug, it’s a feature!”
  - EthanHeilman 7y ago
    Yet paypal's policy explictly says authentication bypasses, like the 2FA bypass they showed, are in scope >Authentication or authorization flaws, including insecure direct object references and authentication bypass Reading with the context of the other out-of-scope issues. I think they meant that the ability to buy or steal someones credentials is not a vulnerability in and of itself. >Vulnerabilities involving stolen credentials or physical access to a device It is a poorly worded and confusing policy. Yet, if I found a 2FA bypass and I read that policy I would conclude that it is in scope and submit the issue.
    - lonelappde 7y ago
      Bypass means skipping steps on PayPal's side (like reading user data without a a password), not skipping steps on user side (stealing their password).
    - thaumasiotes 7y ago
      > It is a poorly worded and confusing policy. Yet, if I found a 2FA bypass and I read that policy I would conclude that it is in scope and submit the issue. If you wanted my advice as something of an insider to the platform, I'd say that you should point to the ambiguity there ("One policy says yes, another policy says no?") and ask for an Informational close rather than Not Applicable. (H1 hates it when researchers ask for a specific close status, but it's common and often reasonable.) Closing your report Informational instead of Not Applicable costs the company nothing, so even an argument that isn't very strong on the merits can carry the day. I wouldn't push for a payout, given the out-of-scope phrasing. If executing a successful attack requires you to possess stolen credentials, they're on solid ground when they tell you the attack is excluded by their policy.
    - hedora 7y ago
      They apparently have fake / security theater 2FA, where things are as inconvenient as 2FA, but pay pal explicitly doesn’t care that it’s easily bypassed, and full of security bypasses. They also have opt-in 2FA. It’s unclear which one the author bypassed. Perhaps the confusion is by design on paypal’s side? Presumably giving people a false sense of security helps them close disputes without paying out?
  - staz 7y ago
    The vulnerabilities they found allow bypassing the two factor auth so works with only part of the credentials
hprotagonist 7y ago
paypalsucks has been a registered domain since 2002 for a good reason.
- aneutron 7y ago
  That is a hilarious random fact. Thanks for the info.
ohithereyou 7y ago
I've seen several stories about how HackerOne doesn't pay out bug bounties when bugs are reported. I, for one, wouldn't submit bugs/PoC to them, and I would actively, publically, and immediately disclose bugs that affect anybody who is a client of HackerOne.
- sn4pp 7y ago
  > I would actively, publically, and immediately disclose bugs that affect anybody who is a client of HackerOne. Sadly you can't feed your children from media drama. Maybe, in the long run, but it's more likely to get sued.
  - ohithereyou 7y ago
    The market for a freelance security researcher out there is hard, no doubt, but disclosing bugs publically is an addition to your resume, akin to any other professional development you do. It demonstrates you can do the work and it shows the skills you have. Suing someone for disclosing an actual bug is a long term losing proposition for any company in a competitive industry.
    - sn4pp 7y ago
      > but disclosing bugs publically is an addition to your resume Request disclosure on hackerone then. Idk, breaking the law to get a job doesn't seem ok to me.
      - thaumasiotes 7y ago
        The screenshot in #2 does show the H1 Staff screwing up -- @cybernews requests disclosure and gets a response saying "you may request disclosure if you would like this reviewed, using the drop down menu" (which @cybernews has already done). @cybernews' behavior in that thread isn't ideal, but they're more in the right than in the wrong on that one, judging by the screenshot.
        7y ago
soared 7y ago
Are hackerone analysts employees of the company? If so the conclusion drawn sounds like complete bs. If the analysts are just other users, then it definitely sounds like there is a problem.
- teslademigod1 7y ago
  not sure: https://www.hackerone.com/blog/Getting-to-know-the-HackerOne-triage-team-with-Zach-Dando https://www.hackerone.com/blog/Getting-to-know-the-HackerOne... "When they aren’t triaging reports on our platform, they are spending time on their own bug bounty hunts."
- thaumasiotes 7y ago
  Bug triagers may be employees of HackerOne, employees of the company (e.g. Paypal here), or contractors indirectly working for the company (I worked in this role for a year). They're not going to be random other researchers. The screenshots in this article show a "HackerOne Staff" stamp, so those triagers are employees of H1.
  - soared 7y ago
    So it’s pretty far fetched that they would be purposely delaying reports so they could steal the rewards.
    - thaumasiotes 7y ago
      Hmmm. > Other criticisms have pointed out that Security Analysts can first delay the reported vulnerability, report it themselves on a different bug bounty platform, collect the bounty (without disclosing it of course), and then closing the reported issue as Not Applicable, or perhaps Duplicate. Time to response is tracked. Reports are timestamped. So delaying response to a report is a bad strategy -- reports are supposed to get precedence based on when they were filed, not based on when they were responded to, and the delay will be a black mark on your triaging record. This is the main objection to Cybernews' conclusion. Similarly, I'd be a little surprised if one company had a presence on multiple bug bounty platforms. The standard flow is that you find a bug, look up the company, and report it to them using whatever they tell you is their standard. I've seen many reports including text like "Hello, I sent you this report by email, and I was told I should file it on HackerOne". (Including this text, if it's true, is a good idea for multiple reasons.) Centralizing reports makes many things more convenient -- including timestamp comparisons, but much more importantly it makes checking for earlier duplicate reports easier. I'd also be a little surprised if HackerOne allowed their triagers to file reports for the same companies they do triage for. They hire triagers from the researcher pool, and they do allow triagers to hunt bounties on their own time, but it would be a common-sense protection to prohibit them from reporting to the same companies they triage for. I haven't worked directly for H1; I don't know whether they have such a policy or not. In conclusion, there is some potential for abuse, but it's unlikely that a triager can abuse the system in the most obvious way, by personally stealing reports that come to them for triage. I'd worry more about a triager prioritizing their friend's report over a stranger's. I don't think triager abuse is a significant risk of reporting through H1. I don't know the details of what protections are in place. later edit: on H1, each report has an ID number assigned in sequence -- if you dupe an earlier report to a later report, the researcher will definitely notice and complain.
sn4pp 7y ago
> They deemed this issue a Duplicate, and we lost another 5 points. A dupe costs points?! On bugcrowd you GET points for dupes...
- thaumasiotes 7y ago
  The points associated with a duplicate report depend on the status of the report you get duped to. I assume in this case the original report was Not Applicable.
  - sn4pp 7y ago
    Oh so an N/A dupe? That sounds plausable.
    - thaumasiotes 7y ago
      The policy of the company I worked for was only to dupe to closed issues if those issues were Resolved -- if the duplicate issue was already closed Informational or N/A, we just closed the new one with the same status. This has advantages in avoiding researcher confusion, as illustrated here. But that was a company policy, not an H1 policy. It's perfectly possible to dupe to a closed issue. (And of course, it's also possible that you get duped to an open issue which is later closed N/A, though that's pretty awkward. You kind of hope for N/A issues to be closed right away, not to stay open for long periods.) And not duping to closed issues causes other issues -- it meant always having to leave an internal comment citing the other issue that this one was secretly a duplicate of.
      - Androider 7y ago
        Could you could state that the newly reported issue is both duplicate and that the original report was closed as N/A? Not applicable typically means the reporter is free to try to argue that is in fact applicable, but by stating it's both duplicate and N/A neither the second reporter nor the company will spend further time arguing back and forth, as even if the issue was applicable the credit would go to the original reporter.
cosmodisk 7y ago
Sound like PayPal business as usual. Crappy company with crappy attitudes. It's fascinating when people spend their time and effort on good causes instead of joining the dark side just to be shown the middle finger instead.
rideontime 7y ago
From PayPal's response to a 2FA bypass: > If the attacker has the victim's password, they would already be able to gain access to the account via web UI too. As such, the account is already compromised. As such, there does not appear to be any security implications as a direct result of this behavior. Seriously? This means PayPal's 2FA is just security theater. I'd rather they didn't offer it at all in this case, at least then I'd know how insecure my account really was.
- mtgx 7y ago
  I think if you Google Paypal 2FA security issue, you'll find multiple such bugs found over the years. They've never fixed it.
- nebulous1 7y ago
  From reading a different article, the terminology seems to be a bone of contention here. This ’2FA' is an email message PayPal send when they detect a new login location. They do not call it 2FA and they do offer actual 2FA that cybernews have not bypassed.
  - ijpsud 7y ago
    It's very obviously a distinction without a difference though. Like the authors say, this is a amazing opportunity for black-market paypal account buyers. It's the only line of defense that thousands of people have between black hats and their bank account. In any case, I'd definitely call this 2-factor authentication - the only difference is the trigger (every login vs suspicious logins). It just so happens that they have different code for each of those two cases, and these bounty hunters have discovered a bug in one of them.
    - nebulous1 7y ago
      I don't think I can agree that there's no difference, because if you say to me that you've bypassed PayPal's 2FA I'm going to think that you've bypassed the opt-in one, not the extra security check one. PayPal does not consider these accounts to "have" 2FA. Overall that may be being too pedantic, and shouldn't give PayPal a pass on the issue. Perhaps even entertaining it is just muddying the waters allowing PayPal to slip away. The extra check is a security check. If cybernews have by bypassed it then they have bypassed a security check. Logically this is therefore a security issue, and if PayPal are saying that it's not a security concern then they're saying that they were just wasting everybody's time with the unnecessary check to begin with. That would clearly be a lie, as the fact that they developed and continued to use the system indicate that they think it provides security.
rasengan 7y ago
PCI DSS requirements specify that companies have 30 days to refute or remediate externally reported issues [1]. If they don’t respond or fix some of these issues, then PayPal will no longer be compliant and all credit card companies will be forced to stop working with them unless they wish to set precedence that PCI-DSS compliance is no longer required to be followed. According to this image [2], they did not respond or refute within 30 days. If PayPal’s PCI-DSS compliance certification isn’t revoked then PCI-DSS is a farce. [1] https://www.itgovernance.co.uk/blog/a-guide-to-the-pci-dsss-vulnerability-scanning-and-penetration-testing-requirements https://www.itgovernance.co.uk/blog/a-guide-to-the-pci-dsss-... [2] https://cybernews.com/wp-content/uploads/2020/02/paypal-2fa-bypass2.png https://cybernews.com/wp-content/uploads/2020/02/paypal-2fa-...
- admax88q 7y ago
  > then PCI-DSS is a farce. Take a wild guess on what you think will happen.
  - cryptica 7y ago
    All these regulations are bs. Designed to keep small players out.
    - giancarlostoro 7y ago
      To be fair they are probably not designed specifically for that, the issue is big players are much more likely to have more political leverage. Or is that one much like GDPR? Crazy fines that only big players can afford, in such a case, that was poorly designed.
      - lonelappde 7y ago
        GDPR only charges big fines to big players.
        giancarlostoro 7y ago
leejo 7y ago
This doesn't surprise me. I'm currently trying to get a refund out of PayPal after what looks like a massive flaw in their refund process. I paid for something on eBay and it appears to have been a compromised account. The original auction, feedback history, etc, looked legit. The flow was this: 1) I pay for a product on eBay using PayPal, using my creditcard (direct from card, not from any existing PayPal balance). 2) Seller marks item as shipped but then 5mins later issues an e-check refund (rather than a refund on my creditcard). 3) Seller cancels and deletes the original item on eBay so i can no longer raise a dispute there. 4) The e-check refund continues to bounce as clearly the compromised paypal account can't pull those funds from the other source. 5) The refund being in limbo means my dispute with PayPal gets closed as "a refund was previously issue" (which did, and will continue to, bounce). The important part is 2 - since I paid for this on my card the refund should have gone direct to my card. However, since I paid for this on my creditcard I've raised a chargeback with the issuing bank, which should hopefully make PayPal sit up and put a bit more effort into sorting this out.
- lonelappde 7y ago
  You put in way too much effort. Call your credit card company first. Your credit card company profits from vendor (PayPal) mistakes by charging fees, so they are always happy to help you.
  - mtnGoat 7y ago
    calling the Card issuer is always my first stop. CS these days is abysmal at most companies.
    - strbean 7y ago
      Unfortunately, any platform with any kind of lock in will have you over a barrel here. Try disputing a card transaction with Steam - your 18 y/o account with thousands of games and dollars invested will be gone in a flash. Same goes for Google/Amazon/Microsoft/etc.
      - 7y ago
dev_hacker 7y ago
Moral of story is obvious: Next time sell the exploits on the dark web and skip the blog post.
- m-p-3 7y ago
  It's all that PayPal deserves of they get a pass for PCI-DSS non-compliance.
  - AnIdiotOnTheNet 7y ago
    I'm sure that'll be a great comfort to the victims of whoever those flaws are sold to.
    - annoyingnoob 7y ago
      Who would you like to be upset with in a case where the black market is more efficient than HackerOne? If the legitimate channels are not working then the system is broken and you should blame PayPal and HackerOne. Be pissed at PayPal for not making it easier to report real issues. Be pissed at PayPal for not finding the issues themselves.
      - AnIdiotOnTheNet 7y ago
        Or, and I know this might be hard to grasp if you're the kind of unscrupulous individual who would sell exploits to criminals, I could also blame the unscrupulous individual who sold exploits to criminals. Are they deserving of a pass for some reason? Fuck them.
        annoyingnoob 7y ago
        Bad Guys exist and we can't ignore them, like it or not. A head-in-the-sand approach is not good for security either. Yes, fuck the bad guys but seriously fuck those that refuse to acknowledge and fix real issues.
      - 7y ago
guidovranken 7y ago
HackerOne appears to be completely broken and I wouldn't recommend it to anyone. Disagreements are to be expected on a bug bounty platform, but these days they just stop responding altogether and don't pay. It borders on outright fraud. I've been trying to report a Squid RCE (CVE-2020-8450) since October. The Squid maintainers seemed unprepared for dealing with the report as they kept being unresponsive and it took 2 months to merge my patch. Maybe they're volunteers, so I can't blame them. Reported it to the bug bounty [1] which promises high rewards on January 20th and apart from triaging it, there has been radio silence since despite having invoked HackerOne mediation. I have more Squid memory bugs and I'd rather rm -rf them than go through this process again. HackerOne used to be decent but this appears to be a structural problem now [2]. [1] https://hackerone.com/ibb-squid-cache https://hackerone.com/ibb-squid-cache [2] https://twitter.com/DevinStokes/status/1228014268567547905 https://twitter.com/DevinStokes/status/1228014268567547905
- luch 7y ago
  Squid is vastly under-equipped to deal with the security hygiene needed for a project this important. That's the tragedy of the open source world : mission critical for everyone, but no actor willing to maintain it properly. It's Heartbleed all over again.
  - jacobush 7y ago
    Upvoted, but not sure it's a tragedy. Much like that quote about democracy, it's a bad system, except the others are worse. Would be nice to have something better tho.
    - ijpsud 7y ago
      > the others are worse I think we need more experimentation with solutions to the (open-source) public goods problem before we can say that the others are worse. Ditto with experimentation on variants of democracy. Significantly harder to experiment with that than with open source funding though.
harikb 7y ago
There is plenty of blame to go around beyond the management. Management is always going to deflect, deny, or do whatever to save their face. There must be “architect/lead engineer” level folks whose primary task is to engineer these stuff well. WTF are they doing? There should be a wall of shame for these (not by person, but by company and group). Next time you get a contact/candidate who “lead the sign-on 2fa management” at PayPal, we will know to be extremely cautious. There is no “karma” in tech world. People design the shittiest systems in company 1 and then move on to some other role in company 2 and float around taking credit for more and more stuff someone else did.
- dinkydrew 7y ago
  As someone in management, I will somewhat agree that management too often deflects from their ownership and responsibility, but what you are saying is also a form of deflection, unless you also espouse a kind of paternalistic oversight over architects/engineers that would absolve them of responsibility by simply being mindless executors of management's commands and lead. I suspect that is not something most here would support. There needs to be a balance, each party needs to play their own role and work in unison. As much as managers need to manage things and largely clear the way for architects and engineers, architects and engineers need to perform their job and role, to which I would argue belongs adhering to industry standards for security as a core aspect. If there was clear pressure or even overriding of architects/engineers insisting on adhering to standards by managers who were not performing their role of advocating on behalf of or negotiating with architects/engineers, and instead were even sabotaging them and their product, then sure, it's a management failure; but at that point, architects/and engineers should have also even out right refused and revolted against managers or at the very least clearly and expressly voiced their vehement opposition. As a manager, I would have even stuck my neck out and sided with an architect and engineer rebellion if they were pressured or even asked to sacrifice core requirements. I also understand though that not all organizations have managers that would do that, especially in careerist organizations where managers see people as bodies to pile up to climb the ladder faster.
  - harikb 7y ago
    I am surprised you read it that way. I was justifying what management does - as in the are usually paid to make sure shit doesn’t hit the fan. But the architect/engineer who design these should have made better decisions.
jokoon 7y ago
I say it all the time, there are no incentives or rules regarding cybersecurity standards, or companies have no obligations to follow them. The cost and risks of cybersecurity is pretty high, the public are always the first victims and pay the damage. Cybersecurity always has been a national problem which should be solved by laws. Insurance companies or banks should at least be encouraged to do more. Cybersecurity shouldn't be improved with bug bounties.
dinkydrew 7y ago
This is a bit tangential to the topic, but I find it immensely more interesting that after literal decades of utterly egregious abuses and downright evil behavior by PayPal, people still seem to be surprised by this type of behavior. I find it so fascinating because it is a kind of manifestation of what is clearly a kind of mentality of abused people, the kind of people who usually others see as being trapped in a kind of inability to internalize the abuse being perpetrated against them, and therefore rationalize, excuse, ignore, etc. to simply push away and hide and suppress the clear abuses happening to them. It's just as sad as it is interesting to me because of the inherent illogical puzzle it represents, a puzzle that clearly has not yet been solved or for which there exists no easy and clean solution. How do you get someone out of an abusive relationship, be it a personal relationship or something like a formalized cult? We are all abused by PayPal and other tech companies on a constant basis, yet all we do is lament the treatment, while simply just continuing on in the abusive relationship. Someone should tell PayPal, etc. "no, you are not allowed to abuse us anymore. We have human rights and your lies, deceit, abuse, manipulation, gaslighting, monopolization, etc are not going to be tolerated anymore." But I guess our other abusers in Congress get too much money and free meals out of it to change that.
mjparrott 7y ago
Given that there seems to be no consequence to getting hacked, I could see companies putting their bug bounties into a filibuster program. They can outsource their liability. I doubt the insurance companies who rate them care if the 3rd party bounty administrator is effective.
znpy 7y ago
The author might as well have sold the exploits for the best offer. If a company advertises a bug bounty problem but fails to follow through, such company kinda deserves to be hacked. I mean, you are wasting people's time and still getting critical bug reports, probably along with a detailed write-up. Also, we might also discuss about the fact that for a company that moves (and earns) so much money as PayPal, 30 kUSD is probably very little when compared to the possible outcomes of being hacked.
Moru 7y ago
I know of a really nice vulnerability but I know when to shut up. I almost scammed a legitimate business by mistake. Made sure to pay them with a normal bank transfer instead. Don't want to complain in case their account gets closed down or something. Not touching PayPal again.
tfandango 7y ago
I have not used Paypal since I had to file a dispute over an item I bought on ebay via Paypal. As a response they snail-mailed me a bunch of screenshots of an internal web-app with a bunch of info for someone else, SSN, CC number, address, etc. Everything I would need to do something bad. I called them and they did not seem to care so I called the guy (I had his number of course) but he never answered or responded to my email. A few months later I got a voicemail from paypal, apparently my original call bubbled up. They asked if I had destroyed the info and to let them know if I had not (I did). Then there was a long pause (I guess they assumed the voicemail was over), and it turned out there were 4-5 people on that call and they then discussed how the call went and whether or not it was sufficient to CYA. I've not used it since, and I hoped they got their act together (sounds like maybe not).
- fxleach 7y ago
  My experience with PayPal, from dev support to account managers, has been an absolute shit show. They were simply the first to their market and it's hard to kick them out.
  - tfandango 7y ago
    It was difficult at first, this happened quite some time ago, but these days it seems there are lots of non-paypal options.
    - ValentineC 7y ago
      Most turnkey ecommerce solutions (for my case, event ticketing services like Tito and Eventbrite) seem to mainly support only Stripe and PayPal.
- Cynddl 7y ago
  What does CYA mean? Haven't seen this acronym before.
  - JimiofEden 7y ago
d4n 7y ago
Unfortunately, for many companies, bug bounty programs have been the best invention in silencing security research and CVEs. They promise the world, beat you down on severity / payouts, sometimes just claim duplicate or known issue with no way to verify, and then block public disclosure. Very frustrating.
strictnein 7y ago
I've had plenty of problems with bug bounty platforms and have completely stopped doing them. But most/all of these "critical" reports aren't critical and some of the behavior of their "researchers" is unprofessional at best. There's maybe one legit report here, and that's #2. #1 "In order to bypass PayPal’s 2FA, our researcher used the PayPal mobile app and a MITM proxy, like Charles proxy." So you need to be MITM'd and have a malicious cert installed? Yeah... not "critical" and out-of-scope for most places. For "#2 Phone verification without OTP", look at the messages they were sending. Did they not understand H1's responses? Repeatedly demanding answers isn't a great look. It's not surprising it was locked. For #3: it requires stolen creds. A "security" flaw that requires stolen creds and brute forcing isn't going to get much traction anywhere. #4 was a dupe #5 is a self XSS, no one accepts these #6 is a stored self XSS and a dupe
- deleted 7y ago
  [deleted]
- ramimac 7y ago
  I agree that none of these reports could be considered "critical." I also agree that the tone is a bit unprofessional. I'd add that I generally find these publicity pushes using fairly bland findings to be distasteful. All that being said, I'd like to clarify a bit based on my read of #1. > #1 "In order to bypass PayPal’s 2FA, our researcher used the PayPal mobile app and a MITM proxy, like Charles proxy." > So you need to be MITM'd and have a malicious cert installed? Yeah... not "critical" and out-of-scope for most places. In generally, using a proxy to perform a 2FA bypass wouldn't decrease the risk. In this case, the attacker already has compromised credentials, and they are trying to bypass the secondary control. As they are the one authenticating, the need for MiTM isn't a huge deal. That being said, another point that was made is that the "2FA" they are bypassing isn't actually Paypal's 2FA. Instead, it is a secondary, risk-based validation. A bit of a semantic difference, but important to note that if a user was leveraging 2FA this bypass wouldn't actually get an attack who had compromised credentials access.
- Dylan16807 7y ago
  > So you need to be MITM'd and have a malicious cert installed? No. The attacker is the man in the middle to himself, because why are you trusting the client. > A "security" flaw that requires stolen creds and brute forcing isn't going to get much traction anywhere. The feature is meant to stop people from using stolen creds. It does not work. Given that stolen creds exist, that sounds like a security flaw to me.
ghostpepper 7y ago
Off topic, but did anyone else think that the diagonal black line on the Share button on cybernews.com looks like a very thin hair on your screen? Almost feels like it was done on purpose
hoppla 7y ago
My two last reports were closed as duplicate. I got some rep for one, and zero rep for the other. Both were real vulnerabilities. It is strange the reputation reward is not consistent.
- lgeorget 7y ago
  According to HackerOne help page on reputation, it depends on the status of the vulnerability: yet undisclosed, not applicable, publicly known...
rishabhd 7y ago
Been there, seen that. I find it hard to trust bug bounty platforms and their vulnerabilities as a researcher.
fulldecent2 7y ago
If you are receiving your money or reputation from a platform (like HackerOne) then you are going to be underappreciated, undervalued, and treated like an expense that should be minimized. Here is what responsible disclosure looks like in 2020 from somebody that has self-worth: > (Message posted to Hacker One, and emailed to any address you can find, and sent in a letter by mail. Yes mail. Also copied in all those ways to investors of the target.) > > Dear Sir or Madam: > > I have learned about a security issue in PayPal's service. This includes being able to login to user accounts without the credentials the system is expecting. [Be vague about how exactly it works, but explain the impact.] > > I am not an employee or contractor of PayPal and I will publish this on my blog at https://privacylog.blogspot.com https://privacylog.blogspot.com to build on my reputation for finding and improving the security of internet systems. > > This post will publish on 2020-03-09, which is two weeks from today. > > If you are committed to fix this issue before public disclosure, I will be happy to work with you. You can contact me at ... --- Key points: - The discussion is about my reputation and values. - I am not demanding any payment (not sure if that is legal). - Set a firm publish date. - This asks them to make a commitment to fix and frames the discussion going forward. And if they do not get back to you, then when you publish you explain it just like you see in newspapers: "the vendor failed to respond and act on this report when I contacted them by email, social media and paper mail with two weeks' notice".
HoustonRefugee 7y ago
None of this is surprising. I keep the lowest possible amount of money in paypal to cover eBay charges. Too many horror stories.
tptacek 7y ago
People have a weird mental model of how big-company bug bounty programs work. Paypal --- a big company for sure, with a large and talented application security team --- is not interested in stiffing researchers out of bounties. They have literally no incentive to do so. In fact: the people tasked with running the bounty probably have the opposite incentive: the program looks better when it is paying out bounties for strong findings. Here are the vulnerabilities in their report: 1. They can suppress a new-computer login challenge (they call this "2FA", but this is a risk-based login or anti-ATO feature, not 2FA). 2. They can register accounts for one phone, then change it to another phone, to "bypass" phone number confirmation. 3. There are risk-based controls in Paypal that prevent transactions when anomalies are detected, and some of them can apparently be defeated with brute force. 4. They can change names on accounts they control. 5. They found what appears to be self-XSS in a support chat system. 6. They found what appears to be self-XSS in the security questions challenge inputs. None of these are sev:hi vulnerabilities, let alone "critical". 2 of them --- #4 and #6 --- are duplicates of other people's issues. Self-XSS vulnerabilities are often excluded entirely from bounty programs. For the last 3 hours, the top comment on this thread has been an analysis saying that, because Paypal is PCI-encumbered, and HackerOne reports can function as "assessments" for PCI attestations, Paypal is in danger of losing its PCI status (and the fact that it won't is evidence that they are "too big to fail"). To put it gently: that is not how any of this stuff works. In reality, formal bug bounty programs are a firehose of reports suggesting that DKIM configuration quirks are critical vulnerabilities, and nobody in the world would expect any kind of regulatory outcome simply from the way a bounty report does or doesn't get handled. It should, I hope, go without saying that nobody is required to run a bounty in the first place, and most companies probably shouldn't. The login challenge bypass finding was actually interesting (it would be more interesting if they fully disclosed what it was and what Paypal's response was). But these reporters have crudded up their story with standard bug-bounty-reporter hype, and made it very difficult to judge what they found. I'm inclined not to believe their claim that Paypal acted abusively here (and I am not a fan of Paypal).
- rasengan 7y ago
  > 1. They can suppress a new-computer login challenge (they call this "2FA", but this is a risk-based login or anti-ATO feature, not 2FA). 2FA means 2 Factor Authentication. This works by forcing one to use two different forms of identification to authenticate, such as login/password and, in this case, identification of the computer used. So, with all respect sir, what I'm saying is while this isn't the best 2FA, it absolutely IS 2FA by definition.
WUHANCLAN 7y ago
HackerOne is complete garbage. I spent close to a month digging into Uber and compromised their m.uber.com mobile endpoint; they hemmed and hawed and then awarded the $25K to another HackerOne top performer stating that he had discovered the exact same vulnerability the day before I had submitted the report. What's weird about it is that I was using Burp Proxy for everything, and this guy was directly connected to PortSwigger (and Uber was running some promotional for a free three month license for Burp Proxy). HackerOne completely sided with Uber on everything, gave the Portswigger kid $25K and that was that. So, in summary: HackerOne is trash, and Burp Proxy may contain backdoor functionality which is relayed directly back to Portswigger whenever a high value critical vulnerability is discovered with it.
- thaumasiotes 7y ago
  What would you expect HackerOne to do in the situation you describe? You filed a duplicate report. All of the malfeasance you allege is coming from Portswigger.
  - WUHANCLAN 7y ago
    No idea which one it was, or both. 23K isn't something to sneeze at though, and would be plenty of incentive for the folk at Portswigger to work with douchebags like whoever this shubby dude is in order to collect these bounties. 24K for one bounty... or sell $299 licenses to nerds.. hmm, which one is more profitable...
    - thaumasiotes 7y ago
      ...the second one is significantly more profitable.
      - WUHANCLAN 7y ago
        Yeah I bet. It would be interesting to see how many U.S. DoD networks have been compromised with Burp Proxy.
- 7y ago
neycoda 7y ago
If a company or government ignores security vulnerability reports this way, then you publicize it,anonymously if necessary, through the press if necessary, to the bad guys if necessary.
blazespin 7y ago
Hmm, they don't look that bad - https://hackerone.com/paypal https://hackerone.com/paypal Here's an example of something that got paid out by paypal - https://hackerone.com/reports/739737 https://hackerone.com/reports/739737 (15K) Good writeup - https://medium.com/@alex.birsan/the-bug-that-exposed-your-paypal-password-539fc2896da9 https://medium.com/@alex.birsan/the-bug-that-exposed-your-pa... Interesting history with paypal - https://hackerone.com/alexbirsan https://hackerone.com/alexbirsan Here's how duplicate reports are dealt with - https://docs.hackerone.com/programs/duplicate-reports.html https://docs.hackerone.com/programs/duplicate-reports.html I am curious if paypal provided the OP with original reports. They don't say. I wonder how much the OP is not saying here, versus how much they understand the platform they are working on. This statement makes me very curious: "Other criticisms have pointed out that Security Analysts can first delay the reported vulnerability, report it themselves on a different bug bounty platform, collect the bounty (without disclosing it of course), and then closing the reported issue as Not Applicable, or perhaps Duplicate." How can you do that if you're providing the original report? Also, the guy is just wrong. You GAIN rep points for duplicates, unless you did something dumb and really amateur like not searching first for already publicly disclosed issues. https://docs.hackerone.com/hackers/reputation.html#effects-of-report-state-on-reputation https://docs.hackerone.com/hackers/reputation.html#effects-o...
Vysero 7y ago
I have heard enough. I am done using PayPal.
ryanlol 7y ago
> Most ethical hackers will remember the 2013 case of Robert Kugler, the 17-year old German student who was shafted out of a huge bounty after he discovered a critical bug on PayPal’s site. Kugler notified PayPal of the vulnerability on May 19, but apparently PayPal told him that because he was under 18, he was ineligible for the Bug Bounty Program. >But according to PayPal, the bug had already been discovered by someone else, but they also admitted that the young hacker was just too young. Bad PR like this shows that bug bounty programs are probably more trouble than they’re worth.
jonnycomputer 7y ago
I have no experience, but it seems to me that a bug bounty program would be ripe for abuse by employees intercepting reports, feeding them to a partner hacker, and then splitting the bounty between themselves. What stops that from happening?
stebann 7y ago
Hackers of the world, unite!
IronWolve 7y ago
Interesting timing, a pro hackone article on slashdot posted hours after this post about hackerone issues.
Darknessgazer 7y ago
If anyone in this thread is interested in talking about their experiences with HackerOne, please shoot me an email at david.morris@fortune.com. Positive or negative. We can set up a time to talk, or if you're more comfortable, just include details in your email.
homakov 7y ago
None of the bugs is critical, not even medium severity.
BrandoElFollito 7y ago
We run a private bug bounty (not via H1 but another platform), classical pentests, dynamic code assessment and a responsible disclosure program. Pentests are ok, they help to scrap plenty of bugs. I am not a great fan otherwise because it is based on a fixed rate. Private bb ended up fantastic. Great bugs, great researchers, reasonably good pay (not Apple grade but we paid some 30k€ irrc). Feedback from researchers was good, including unexpected public praise. Dynamic code reviews are a mixed bag. Usually crap, sometimes hidden gems. Responsible disclosure is a mixed bag too. It is very binary : 20% great from great researchers we usually invite to the private bounty afterwards, and 80% garbage. Oh man, the garbage. Often I do not even understand the submission (not being a native English speaker either). One other problem with public programs are legal implications to pay an anonymous reporter (imagine a US company paying someone affiliated with NC or Iran or Daesh, and that info published in the press)

980 points by teslademigod1 7y ago

>When we pushed the HackerOne staff for clarification on these issues, they removed points from our Reputation scores, relegating our profiles to a suspicious, spammy level. This happened even when the issue was eventually patched, although we received no bounty, credit, or even a thanks. Instead, we got our Reputation scores (which start out at 100) negatively impacted, leaving us worse off than if we’d reported nothing at all. That seems like a good way to make sure nobody trusts your business. What say you, hackerone? How can anyone trust this business acting against what ostensibly is its core functions.

thaumasiotes 7y ago
They had out-of-scope issues closed as being out-of-scope, which automatically lowers their reputation on the platform. The researchers are outraged: > When we submitted this to HackerOne, they responded that this is an “out-of-scope” issue since it requires stolen PayPal accounts. As such, they closed the issue as Not Applicable, costing us 5 reputation points in the process. But Paypal's policy really couldn't be clearer: > Out-of-Scope Vulnerabilities > Vulnerabilities involving stolen credentials or physical access to a device ( https://hackerone.com/paypal https://hackerone.com/paypal ) If Paypal says "don't send us this type of report", and you send one anyway, are you really surprised when your account gets a warning attached saying "this person usually files low-value reports"?
- teslademigod1 7y ago
  but this is it: "This happened even when the issue was eventually patched..." which, based on that, I understand their gripe here
  - thaumasiotes 7y ago
    That would be a valid complaint if their report had been closed Not Applicable on the grounds that the behavior didn't present a significant security risk. But it wasn't; it was closed Not Applicable on the grounds that it was ineligible for the program regardless of whether it was a security risk.
    - teslademigod1 7y ago
      hmm yes, I see your point
- kidintech 7y ago
  with the acquired information, the researcher has a few options: - bulk acquire stolen credentials, bypass 2FA, bypass the security checks when sending money, and accumulate wealth - sell above process to anyone that has an internet-connected device, the desire to accumulate wealth, and willingness to commit fraud (which I would guess is a non-trivial % of the world's population) - disclose the vulnerabilities to paypal through any available channels The fact that they went with the latter AND were punished for it doesn't shock you? Jesus.
- rideontime 7y ago
  Their "In-Scope Vulnerabilities" explicitly includes XSS exploits, though, which they also closed as Not Applicable (after patching the issue). Tangentially, as a (former?) PayPal user, it's wild to see that they consider vulnerabilities involving stolen credentials as a non-issue. Why do they offer 2FA at all, then? e: After taking another look at that massive Out-of-Scope list, I'm having a hard time imagining a bug that couldn't be closed as "Not Applicable." What a sham.
  - thaumasiotes 7y ago
    I can't really evaluate #5, but their screenshot undermines them -- it shows a chat session between the victim and "PayPal Virtual Agent", with the virtual agent offering some canned text. If that's all you can do, then this is a self-XSS, which is excluded. #6 is much more clear; that one's very obviously a self-XSS.
    - rideontime 7y ago
      Their full "out of scope" list also includes MITM attacks, which would exclude most of what's in this article. I guess my confusion now is why PayPal even purports to offer bug bounties if they're going to craft an "out of scope" list that allows them to reject every submitted report.
      - thaumasiotes 7y ago
        > I guess my confusion now is why PayPal even purports to offer bug bounties if they're going to craft an "out of scope" list that allows them to reject every submitted report. They're not; you're just choosing to assume bad things about them. Their out-of-scope list is fairly standard. If you asked a guy on the street "what would hacking PayPal look like?", the answer they imagined would probably be in scope. For example, if I send you a link to my personal website, and when you visit the website your PayPal account automatically sends $500 to my PayPal account, that's in scope.
        rideontime 7y ago
- ohithereyou 7y ago
  All the more reason to not submit bugs like this to HackerOne. If you can bypass 2FA by having only one factor then I wouldn't consider that 'stolen credentials' and more a singular stolen credential. Their system is designed to defend against this and it does so ineffectively. That is, by definiton, a security issue. I wish I could define what is and isn't a bug in my code at work. My defect rate would be incredible.
  - joking 7y ago
    The mitical “it’s not a bug, it’s a feature!”
- EthanHeilman 7y ago
  Yet paypal's policy explictly says authentication bypasses, like the 2FA bypass they showed, are in scope >Authentication or authorization flaws, including insecure direct object references and authentication bypass Reading with the context of the other out-of-scope issues. I think they meant that the ability to buy or steal someones credentials is not a vulnerability in and of itself. >Vulnerabilities involving stolen credentials or physical access to a device It is a poorly worded and confusing policy. Yet, if I found a 2FA bypass and I read that policy I would conclude that it is in scope and submit the issue.
  - lonelappde 7y ago
    Bypass means skipping steps on PayPal's side (like reading user data without a a password), not skipping steps on user side (stealing their password).
  - thaumasiotes 7y ago
    > It is a poorly worded and confusing policy. Yet, if I found a 2FA bypass and I read that policy I would conclude that it is in scope and submit the issue. If you wanted my advice as something of an insider to the platform, I'd say that you should point to the ambiguity there ("One policy says yes, another policy says no?") and ask for an Informational close rather than Not Applicable. (H1 hates it when researchers ask for a specific close status, but it's common and often reasonable.) Closing your report Informational instead of Not Applicable costs the company nothing, so even an argument that isn't very strong on the merits can carry the day. I wouldn't push for a payout, given the out-of-scope phrasing. If executing a successful attack requires you to possess stolen credentials, they're on solid ground when they tell you the attack is excluded by their policy.
  - hedora 7y ago
    They apparently have fake / security theater 2FA, where things are as inconvenient as 2FA, but pay pal explicitly doesn’t care that it’s easily bypassed, and full of security bypasses. They also have opt-in 2FA. It’s unclear which one the author bypassed. Perhaps the confusion is by design on paypal’s side? Presumably giving people a false sense of security helps them close disputes without paying out?
- staz 7y ago
  The vulnerabilities they found allow bypassing the two factor auth so works with only part of the credentials

hprotagonist 7y ago

paypalsucks has been a registered domain since 2002 for a good reason.

aneutron 7y ago
That is a hilarious random fact. Thanks for the info.

ohithereyou 7y ago

I've seen several stories about how HackerOne doesn't pay out bug bounties when bugs are reported. I, for one, wouldn't submit bugs/PoC to them, and I would actively, publically, and immediately disclose bugs that affect anybody who is a client of HackerOne.

sn4pp 7y ago
> I would actively, publically, and immediately disclose bugs that affect anybody who is a client of HackerOne. Sadly you can't feed your children from media drama. Maybe, in the long run, but it's more likely to get sued.
- ohithereyou 7y ago
  The market for a freelance security researcher out there is hard, no doubt, but disclosing bugs publically is an addition to your resume, akin to any other professional development you do. It demonstrates you can do the work and it shows the skills you have. Suing someone for disclosing an actual bug is a long term losing proposition for any company in a competitive industry.
  - sn4pp 7y ago
    > but disclosing bugs publically is an addition to your resume Request disclosure on hackerone then. Idk, breaking the law to get a job doesn't seem ok to me.
    - thaumasiotes 7y ago
      The screenshot in #2 does show the H1 Staff screwing up -- @cybernews requests disclosure and gets a response saying "you may request disclosure if you would like this reviewed, using the drop down menu" (which @cybernews has already done). @cybernews' behavior in that thread isn't ideal, but they're more in the right than in the wrong on that one, judging by the screenshot.
      - 7y ago

soared 7y ago

Are hackerone analysts employees of the company? If so the conclusion drawn sounds like complete bs. If the analysts are just other users, then it definitely sounds like there is a problem.

teslademigod1 7y ago
not sure: https://www.hackerone.com/blog/Getting-to-know-the-HackerOne-triage-team-with-Zach-Dando https://www.hackerone.com/blog/Getting-to-know-the-HackerOne... "When they aren’t triaging reports on our platform, they are spending time on their own bug bounty hunts."
thaumasiotes 7y ago
Bug triagers may be employees of HackerOne, employees of the company (e.g. Paypal here), or contractors indirectly working for the company (I worked in this role for a year). They're not going to be random other researchers. The screenshots in this article show a "HackerOne Staff" stamp, so those triagers are employees of H1.
- soared 7y ago
  So it’s pretty far fetched that they would be purposely delaying reports so they could steal the rewards.
  - thaumasiotes 7y ago
    Hmmm. > Other criticisms have pointed out that Security Analysts can first delay the reported vulnerability, report it themselves on a different bug bounty platform, collect the bounty (without disclosing it of course), and then closing the reported issue as Not Applicable, or perhaps Duplicate. Time to response is tracked. Reports are timestamped. So delaying response to a report is a bad strategy -- reports are supposed to get precedence based on when they were filed, not based on when they were responded to, and the delay will be a black mark on your triaging record. This is the main objection to Cybernews' conclusion. Similarly, I'd be a little surprised if one company had a presence on multiple bug bounty platforms. The standard flow is that you find a bug, look up the company, and report it to them using whatever they tell you is their standard. I've seen many reports including text like "Hello, I sent you this report by email, and I was told I should file it on HackerOne". (Including this text, if it's true, is a good idea for multiple reasons.) Centralizing reports makes many things more convenient -- including timestamp comparisons, but much more importantly it makes checking for earlier duplicate reports easier. I'd also be a little surprised if HackerOne allowed their triagers to file reports for the same companies they do triage for. They hire triagers from the researcher pool, and they do allow triagers to hunt bounties on their own time, but it would be a common-sense protection to prohibit them from reporting to the same companies they triage for. I haven't worked directly for H1; I don't know whether they have such a policy or not. In conclusion, there is some potential for abuse, but it's unlikely that a triager can abuse the system in the most obvious way, by personally stealing reports that come to them for triage. I'd worry more about a triager prioritizing their friend's report over a stranger's. I don't think triager abuse is a significant risk of reporting through H1. I don't know the details of what protections are in place. later edit: on H1, each report has an ID number assigned in sequence -- if you dupe an earlier report to a later report, the researcher will definitely notice and complain.

sn4pp 7y ago

> They deemed this issue a Duplicate, and we lost another 5 points. A dupe costs points?! On bugcrowd you GET points for dupes...

thaumasiotes 7y ago
The points associated with a duplicate report depend on the status of the report you get duped to. I assume in this case the original report was Not Applicable.
- sn4pp 7y ago
  Oh so an N/A dupe? That sounds plausable.
  - thaumasiotes 7y ago
    The policy of the company I worked for was only to dupe to closed issues if those issues were Resolved -- if the duplicate issue was already closed Informational or N/A, we just closed the new one with the same status. This has advantages in avoiding researcher confusion, as illustrated here. But that was a company policy, not an H1 policy. It's perfectly possible to dupe to a closed issue. (And of course, it's also possible that you get duped to an open issue which is later closed N/A, though that's pretty awkward. You kind of hope for N/A issues to be closed right away, not to stay open for long periods.) And not duping to closed issues causes other issues -- it meant always having to leave an internal comment citing the other issue that this one was secretly a duplicate of.
    - Androider 7y ago
      Could you could state that the newly reported issue is both duplicate and that the original report was closed as N/A? Not applicable typically means the reporter is free to try to argue that is in fact applicable, but by stating it's both duplicate and N/A neither the second reporter nor the company will spend further time arguing back and forth, as even if the issue was applicable the credit would go to the original reporter.

cosmodisk 7y ago

Sound like PayPal business as usual. Crappy company with crappy attitudes. It's fascinating when people spend their time and effort on good causes instead of joining the dark side just to be shown the middle finger instead.

rideontime 7y ago

From PayPal's response to a 2FA bypass: > If the attacker has the victim's password, they would already be able to gain access to the account via web UI too. As such, the account is already compromised. As such, there does not appear to be any security implications as a direct result of this behavior. Seriously? This means PayPal's 2FA is just security theater. I'd rather they didn't offer it at all in this case, at least then I'd know how insecure my account really was.

mtgx 7y ago
I think if you Google Paypal 2FA security issue, you'll find multiple such bugs found over the years. They've never fixed it.
nebulous1 7y ago
From reading a different article, the terminology seems to be a bone of contention here. This ’2FA' is an email message PayPal send when they detect a new login location. They do not call it 2FA and they do offer actual 2FA that cybernews have not bypassed.
- ijpsud 7y ago
  It's very obviously a distinction without a difference though. Like the authors say, this is a amazing opportunity for black-market paypal account buyers. It's the only line of defense that thousands of people have between black hats and their bank account. In any case, I'd definitely call this 2-factor authentication - the only difference is the trigger (every login vs suspicious logins). It just so happens that they have different code for each of those two cases, and these bounty hunters have discovered a bug in one of them.
  - nebulous1 7y ago
    I don't think I can agree that there's no difference, because if you say to me that you've bypassed PayPal's 2FA I'm going to think that you've bypassed the opt-in one, not the extra security check one. PayPal does not consider these accounts to "have" 2FA. Overall that may be being too pedantic, and shouldn't give PayPal a pass on the issue. Perhaps even entertaining it is just muddying the waters allowing PayPal to slip away. The extra check is a security check. If cybernews have by bypassed it then they have bypassed a security check. Logically this is therefore a security issue, and if PayPal are saying that it's not a security concern then they're saying that they were just wasting everybody's time with the unnecessary check to begin with. That would clearly be a lie, as the fact that they developed and continued to use the system indicate that they think it provides security.

rasengan 7y ago

PCI DSS requirements specify that companies have 30 days to refute or remediate externally reported issues [1]. If they don’t respond or fix some of these issues, then PayPal will no longer be compliant and all credit card companies will be forced to stop working with them unless they wish to set precedence that PCI-DSS compliance is no longer required to be followed. According to this image [2], they did not respond or refute within 30 days. If PayPal’s PCI-DSS compliance certification isn’t revoked then PCI-DSS is a farce. [1] https://www.itgovernance.co.uk/blog/a-guide-to-the-pci-dsss-vulnerability-scanning-and-penetration-testing-requirements https://www.itgovernance.co.uk/blog/a-guide-to-the-pci-dsss-... [2] https://cybernews.com/wp-content/uploads/2020/02/paypal-2fa-bypass2.png https://cybernews.com/wp-content/uploads/2020/02/paypal-2fa-...

admax88q 7y ago
> then PCI-DSS is a farce. Take a wild guess on what you think will happen.
- cryptica 7y ago
  All these regulations are bs. Designed to keep small players out.
  - giancarlostoro 7y ago
    To be fair they are probably not designed specifically for that, the issue is big players are much more likely to have more political leverage. Or is that one much like GDPR? Crazy fines that only big players can afford, in such a case, that was poorly designed.
    - lonelappde 7y ago
      GDPR only charges big fines to big players.
      - giancarlostoro 7y ago

leejo 7y ago

This doesn't surprise me. I'm currently trying to get a refund out of PayPal after what looks like a massive flaw in their refund process. I paid for something on eBay and it appears to have been a compromised account. The original auction, feedback history, etc, looked legit. The flow was this: 1) I pay for a product on eBay using PayPal, using my creditcard (direct from card, not from any existing PayPal balance). 2) Seller marks item as shipped but then 5mins later issues an e-check refund (rather than a refund on my creditcard). 3) Seller cancels and deletes the original item on eBay so i can no longer raise a dispute there. 4) The e-check refund continues to bounce as clearly the compromised paypal account can't pull those funds from the other source. 5) The refund being in limbo means my dispute with PayPal gets closed as "a refund was previously issue" (which did, and will continue to, bounce). The important part is 2 - since I paid for this on my card the refund should have gone direct to my card. However, since I paid for this on my creditcard I've raised a chargeback with the issuing bank, which should hopefully make PayPal sit up and put a bit more effort into sorting this out.

lonelappde 7y ago
You put in way too much effort. Call your credit card company first. Your credit card company profits from vendor (PayPal) mistakes by charging fees, so they are always happy to help you.
- mtnGoat 7y ago
  calling the Card issuer is always my first stop. CS these days is abysmal at most companies.
  - strbean 7y ago
    Unfortunately, any platform with any kind of lock in will have you over a barrel here. Try disputing a card transaction with Steam - your 18 y/o account with thousands of games and dollars invested will be gone in a flash. Same goes for Google/Amazon/Microsoft/etc.
    - 7y ago

dev_hacker 7y ago

Moral of story is obvious: Next time sell the exploits on the dark web and skip the blog post.

m-p-3 7y ago
It's all that PayPal deserves of they get a pass for PCI-DSS non-compliance.
- AnIdiotOnTheNet 7y ago
  I'm sure that'll be a great comfort to the victims of whoever those flaws are sold to.
  - annoyingnoob 7y ago
    Who would you like to be upset with in a case where the black market is more efficient than HackerOne? If the legitimate channels are not working then the system is broken and you should blame PayPal and HackerOne. Be pissed at PayPal for not making it easier to report real issues. Be pissed at PayPal for not finding the issues themselves.
    - AnIdiotOnTheNet 7y ago
      Or, and I know this might be hard to grasp if you're the kind of unscrupulous individual who would sell exploits to criminals, I could also blame the unscrupulous individual who sold exploits to criminals. Are they deserving of a pass for some reason? Fuck them.
      - annoyingnoob 7y ago
        Bad Guys exist and we can't ignore them, like it or not. A head-in-the-sand approach is not good for security either. Yes, fuck the bad guys but seriously fuck those that refuse to acknowledge and fix real issues.
    - 7y ago

guidovranken 7y ago

HackerOne appears to be completely broken and I wouldn't recommend it to anyone. Disagreements are to be expected on a bug bounty platform, but these days they just stop responding altogether and don't pay. It borders on outright fraud. I've been trying to report a Squid RCE (CVE-2020-8450) since October. The Squid maintainers seemed unprepared for dealing with the report as they kept being unresponsive and it took 2 months to merge my patch. Maybe they're volunteers, so I can't blame them. Reported it to the bug bounty [1] which promises high rewards on January 20th and apart from triaging it, there has been radio silence since despite having invoked HackerOne mediation. I have more Squid memory bugs and I'd rather rm -rf them than go through this process again. HackerOne used to be decent but this appears to be a structural problem now [2]. [1] https://hackerone.com/ibb-squid-cache https://hackerone.com/ibb-squid-cache [2] https://twitter.com/DevinStokes/status/1228014268567547905 https://twitter.com/DevinStokes/status/1228014268567547905

luch 7y ago
Squid is vastly under-equipped to deal with the security hygiene needed for a project this important. That's the tragedy of the open source world : mission critical for everyone, but no actor willing to maintain it properly. It's Heartbleed all over again.
- jacobush 7y ago
  Upvoted, but not sure it's a tragedy. Much like that quote about democracy, it's a bad system, except the others are worse. Would be nice to have something better tho.
  - ijpsud 7y ago
    > the others are worse I think we need more experimentation with solutions to the (open-source) public goods problem before we can say that the others are worse. Ditto with experimentation on variants of democracy. Significantly harder to experiment with that than with open source funding though.

harikb 7y ago

There is plenty of blame to go around beyond the management. Management is always going to deflect, deny, or do whatever to save their face. There must be “architect/lead engineer” level folks whose primary task is to engineer these stuff well. WTF are they doing? There should be a wall of shame for these (not by person, but by company and group). Next time you get a contact/candidate who “lead the sign-on 2fa management” at PayPal, we will know to be extremely cautious. There is no “karma” in tech world. People design the shittiest systems in company 1 and then move on to some other role in company 2 and float around taking credit for more and more stuff someone else did.

dinkydrew 7y ago
As someone in management, I will somewhat agree that management too often deflects from their ownership and responsibility, but what you are saying is also a form of deflection, unless you also espouse a kind of paternalistic oversight over architects/engineers that would absolve them of responsibility by simply being mindless executors of management's commands and lead. I suspect that is not something most here would support. There needs to be a balance, each party needs to play their own role and work in unison. As much as managers need to manage things and largely clear the way for architects and engineers, architects and engineers need to perform their job and role, to which I would argue belongs adhering to industry standards for security as a core aspect. If there was clear pressure or even overriding of architects/engineers insisting on adhering to standards by managers who were not performing their role of advocating on behalf of or negotiating with architects/engineers, and instead were even sabotaging them and their product, then sure, it's a management failure; but at that point, architects/and engineers should have also even out right refused and revolted against managers or at the very least clearly and expressly voiced their vehement opposition. As a manager, I would have even stuck my neck out and sided with an architect and engineer rebellion if they were pressured or even asked to sacrifice core requirements. I also understand though that not all organizations have managers that would do that, especially in careerist organizations where managers see people as bodies to pile up to climb the ladder faster.
- harikb 7y ago
  I am surprised you read it that way. I was justifying what management does - as in the are usually paid to make sure shit doesn’t hit the fan. But the architect/engineer who design these should have made better decisions.

jokoon 7y ago

I say it all the time, there are no incentives or rules regarding cybersecurity standards, or companies have no obligations to follow them. The cost and risks of cybersecurity is pretty high, the public are always the first victims and pay the damage. Cybersecurity always has been a national problem which should be solved by laws. Insurance companies or banks should at least be encouraged to do more. Cybersecurity shouldn't be improved with bug bounties.

dinkydrew 7y ago

This is a bit tangential to the topic, but I find it immensely more interesting that after literal decades of utterly egregious abuses and downright evil behavior by PayPal, people still seem to be surprised by this type of behavior. I find it so fascinating because it is a kind of manifestation of what is clearly a kind of mentality of abused people, the kind of people who usually others see as being trapped in a kind of inability to internalize the abuse being perpetrated against them, and therefore rationalize, excuse, ignore, etc. to simply push away and hide and suppress the clear abuses happening to them. It's just as sad as it is interesting to me because of the inherent illogical puzzle it represents, a puzzle that clearly has not yet been solved or for which there exists no easy and clean solution. How do you get someone out of an abusive relationship, be it a personal relationship or something like a formalized cult? We are all abused by PayPal and other tech companies on a constant basis, yet all we do is lament the treatment, while simply just continuing on in the abusive relationship. Someone should tell PayPal, etc. "no, you are not allowed to abuse us anymore. We have human rights and your lies, deceit, abuse, manipulation, gaslighting, monopolization, etc are not going to be tolerated anymore." But I guess our other abusers in Congress get too much money and free meals out of it to change that.

mjparrott 7y ago

Given that there seems to be no consequence to getting hacked, I could see companies putting their bug bounties into a filibuster program. They can outsource their liability. I doubt the insurance companies who rate them care if the 3rd party bounty administrator is effective.

znpy 7y ago

The author might as well have sold the exploits for the best offer. If a company advertises a bug bounty problem but fails to follow through, such company kinda deserves to be hacked. I mean, you are wasting people's time and still getting critical bug reports, probably along with a detailed write-up. Also, we might also discuss about the fact that for a company that moves (and earns) so much money as PayPal, 30 kUSD is probably very little when compared to the possible outcomes of being hacked.

Moru 7y ago

I know of a really nice vulnerability but I know when to shut up. I almost scammed a legitimate business by mistake. Made sure to pay them with a normal bank transfer instead. Don't want to complain in case their account gets closed down or something. Not touching PayPal again.

tfandango 7y ago

I have not used Paypal since I had to file a dispute over an item I bought on ebay via Paypal. As a response they snail-mailed me a bunch of screenshots of an internal web-app with a bunch of info for someone else, SSN, CC number, address, etc. Everything I would need to do something bad. I called them and they did not seem to care so I called the guy (I had his number of course) but he never answered or responded to my email. A few months later I got a voicemail from paypal, apparently my original call bubbled up. They asked if I had destroyed the info and to let them know if I had not (I did). Then there was a long pause (I guess they assumed the voicemail was over), and it turned out there were 4-5 people on that call and they then discussed how the call went and whether or not it was sufficient to CYA. I've not used it since, and I hoped they got their act together (sounds like maybe not).

fxleach 7y ago
My experience with PayPal, from dev support to account managers, has been an absolute shit show. They were simply the first to their market and it's hard to kick them out.
- tfandango 7y ago
  It was difficult at first, this happened quite some time ago, but these days it seems there are lots of non-paypal options.
  - ValentineC 7y ago
    Most turnkey ecommerce solutions (for my case, event ticketing services like Tito and Eventbrite) seem to mainly support only Stripe and PayPal.
Cynddl 7y ago
What does CYA mean? Haven't seen this acronym before.
- JimiofEden 7y ago

d4n 7y ago

Unfortunately, for many companies, bug bounty programs have been the best invention in silencing security research and CVEs. They promise the world, beat you down on severity / payouts, sometimes just claim duplicate or known issue with no way to verify, and then block public disclosure. Very frustrating.

strictnein 7y ago

I've had plenty of problems with bug bounty platforms and have completely stopped doing them. But most/all of these "critical" reports aren't critical and some of the behavior of their "researchers" is unprofessional at best. There's maybe one legit report here, and that's #2. #1 "In order to bypass PayPal’s 2FA, our researcher used the PayPal mobile app and a MITM proxy, like Charles proxy." So you need to be MITM'd and have a malicious cert installed? Yeah... not "critical" and out-of-scope for most places. For "#2 Phone verification without OTP", look at the messages they were sending. Did they not understand H1's responses? Repeatedly demanding answers isn't a great look. It's not surprising it was locked. For #3: it requires stolen creds. A "security" flaw that requires stolen creds and brute forcing isn't going to get much traction anywhere. #4 was a dupe #5 is a self XSS, no one accepts these #6 is a stored self XSS and a dupe

deleted 7y ago
[deleted]
ramimac 7y ago
I agree that none of these reports could be considered "critical." I also agree that the tone is a bit unprofessional. I'd add that I generally find these publicity pushes using fairly bland findings to be distasteful. All that being said, I'd like to clarify a bit based on my read of #1. > #1 "In order to bypass PayPal’s 2FA, our researcher used the PayPal mobile app and a MITM proxy, like Charles proxy." > So you need to be MITM'd and have a malicious cert installed? Yeah... not "critical" and out-of-scope for most places. In generally, using a proxy to perform a 2FA bypass wouldn't decrease the risk. In this case, the attacker already has compromised credentials, and they are trying to bypass the secondary control. As they are the one authenticating, the need for MiTM isn't a huge deal. That being said, another point that was made is that the "2FA" they are bypassing isn't actually Paypal's 2FA. Instead, it is a secondary, risk-based validation. A bit of a semantic difference, but important to note that if a user was leveraging 2FA this bypass wouldn't actually get an attack who had compromised credentials access.
Dylan16807 7y ago
> So you need to be MITM'd and have a malicious cert installed? No. The attacker is the man in the middle to himself, because why are you trusting the client. > A "security" flaw that requires stolen creds and brute forcing isn't going to get much traction anywhere. The feature is meant to stop people from using stolen creds. It does not work. Given that stolen creds exist, that sounds like a security flaw to me.

ghostpepper 7y ago

Off topic, but did anyone else think that the diagonal black line on the Share button on cybernews.com looks like a very thin hair on your screen? Almost feels like it was done on purpose

hoppla 7y ago

My two last reports were closed as duplicate. I got some rep for one, and zero rep for the other. Both were real vulnerabilities. It is strange the reputation reward is not consistent.

lgeorget 7y ago
According to HackerOne help page on reputation, it depends on the status of the vulnerability: yet undisclosed, not applicable, publicly known...

rishabhd 7y ago

Been there, seen that. I find it hard to trust bug bounty platforms and their vulnerabilities as a researcher.

fulldecent2 7y ago

If you are receiving your money or reputation from a platform (like HackerOne) then you are going to be underappreciated, undervalued, and treated like an expense that should be minimized. Here is what responsible disclosure looks like in 2020 from somebody that has self-worth: > (Message posted to Hacker One, and emailed to any address you can find, and sent in a letter by mail. Yes mail. Also copied in all those ways to investors of the target.) > > Dear Sir or Madam: > > I have learned about a security issue in PayPal's service. This includes being able to login to user accounts without the credentials the system is expecting. [Be vague about how exactly it works, but explain the impact.] > > I am not an employee or contractor of PayPal and I will publish this on my blog at https://privacylog.blogspot.com https://privacylog.blogspot.com to build on my reputation for finding and improving the security of internet systems. > > This post will publish on 2020-03-09, which is two weeks from today. > > If you are committed to fix this issue before public disclosure, I will be happy to work with you. You can contact me at ... --- Key points: - The discussion is about my reputation and values. - I am not demanding any payment (not sure if that is legal). - Set a firm publish date. - This asks them to make a commitment to fix and frames the discussion going forward. And if they do not get back to you, then when you publish you explain it just like you see in newspapers: "the vendor failed to respond and act on this report when I contacted them by email, social media and paper mail with two weeks' notice".

HoustonRefugee 7y ago

None of this is surprising. I keep the lowest possible amount of money in paypal to cover eBay charges. Too many horror stories.

tptacek 7y ago

People have a weird mental model of how big-company bug bounty programs work. Paypal --- a big company for sure, with a large and talented application security team --- is not interested in stiffing researchers out of bounties. They have literally no incentive to do so. In fact: the people tasked with running the bounty probably have the opposite incentive: the program looks better when it is paying out bounties for strong findings. Here are the vulnerabilities in their report: 1. They can suppress a new-computer login challenge (they call this "2FA", but this is a risk-based login or anti-ATO feature, not 2FA). 2. They can register accounts for one phone, then change it to another phone, to "bypass" phone number confirmation. 3. There are risk-based controls in Paypal that prevent transactions when anomalies are detected, and some of them can apparently be defeated with brute force. 4. They can change names on accounts they control. 5. They found what appears to be self-XSS in a support chat system. 6. They found what appears to be self-XSS in the security questions challenge inputs. None of these are sev:hi vulnerabilities, let alone "critical". 2 of them --- #4 and #6 --- are duplicates of other people's issues. Self-XSS vulnerabilities are often excluded entirely from bounty programs. For the last 3 hours, the top comment on this thread has been an analysis saying that, because Paypal is PCI-encumbered, and HackerOne reports can function as "assessments" for PCI attestations, Paypal is in danger of losing its PCI status (and the fact that it won't is evidence that they are "too big to fail"). To put it gently: that is not how any of this stuff works. In reality, formal bug bounty programs are a firehose of reports suggesting that DKIM configuration quirks are critical vulnerabilities, and nobody in the world would expect any kind of regulatory outcome simply from the way a bounty report does or doesn't get handled. It should, I hope, go without saying that nobody is required to run a bounty in the first place, and most companies probably shouldn't. The login challenge bypass finding was actually interesting (it would be more interesting if they fully disclosed what it was and what Paypal's response was). But these reporters have crudded up their story with standard bug-bounty-reporter hype, and made it very difficult to judge what they found. I'm inclined not to believe their claim that Paypal acted abusively here (and I am not a fan of Paypal).

rasengan 7y ago
> 1. They can suppress a new-computer login challenge (they call this "2FA", but this is a risk-based login or anti-ATO feature, not 2FA). 2FA means 2 Factor Authentication. This works by forcing one to use two different forms of identification to authenticate, such as login/password and, in this case, identification of the computer used. So, with all respect sir, what I'm saying is while this isn't the best 2FA, it absolutely IS 2FA by definition.

WUHANCLAN 7y ago

HackerOne is complete garbage. I spent close to a month digging into Uber and compromised their m.uber.com mobile endpoint; they hemmed and hawed and then awarded the $25K to another HackerOne top performer stating that he had discovered the exact same vulnerability the day before I had submitted the report. What's weird about it is that I was using Burp Proxy for everything, and this guy was directly connected to PortSwigger (and Uber was running some promotional for a free three month license for Burp Proxy). HackerOne completely sided with Uber on everything, gave the Portswigger kid $25K and that was that. So, in summary: HackerOne is trash, and Burp Proxy may contain backdoor functionality which is relayed directly back to Portswigger whenever a high value critical vulnerability is discovered with it.

thaumasiotes 7y ago
What would you expect HackerOne to do in the situation you describe? You filed a duplicate report. All of the malfeasance you allege is coming from Portswigger.
- WUHANCLAN 7y ago
  No idea which one it was, or both. 23K isn't something to sneeze at though, and would be plenty of incentive for the folk at Portswigger to work with douchebags like whoever this shubby dude is in order to collect these bounties. 24K for one bounty... or sell $299 licenses to nerds.. hmm, which one is more profitable...
  - thaumasiotes 7y ago
    ...the second one is significantly more profitable.
    - WUHANCLAN 7y ago
      Yeah I bet. It would be interesting to see how many U.S. DoD networks have been compromised with Burp Proxy.
7y ago

neycoda 7y ago

If a company or government ignores security vulnerability reports this way, then you publicize it,anonymously if necessary, through the press if necessary, to the bad guys if necessary.

blazespin 7y ago

Hmm, they don't look that bad - https://hackerone.com/paypal https://hackerone.com/paypal Here's an example of something that got paid out by paypal - https://hackerone.com/reports/739737 https://hackerone.com/reports/739737 (15K) Good writeup - https://medium.com/@alex.birsan/the-bug-that-exposed-your-paypal-password-539fc2896da9 https://medium.com/@alex.birsan/the-bug-that-exposed-your-pa... Interesting history with paypal - https://hackerone.com/alexbirsan https://hackerone.com/alexbirsan Here's how duplicate reports are dealt with - https://docs.hackerone.com/programs/duplicate-reports.html https://docs.hackerone.com/programs/duplicate-reports.html I am curious if paypal provided the OP with original reports. They don't say. I wonder how much the OP is not saying here, versus how much they understand the platform they are working on. This statement makes me very curious: "Other criticisms have pointed out that Security Analysts can first delay the reported vulnerability, report it themselves on a different bug bounty platform, collect the bounty (without disclosing it of course), and then closing the reported issue as Not Applicable, or perhaps Duplicate." How can you do that if you're providing the original report? Also, the guy is just wrong. You GAIN rep points for duplicates, unless you did something dumb and really amateur like not searching first for already publicly disclosed issues. https://docs.hackerone.com/hackers/reputation.html#effects-of-report-state-on-reputation https://docs.hackerone.com/hackers/reputation.html#effects-o...

Vysero 7y ago

I have heard enough. I am done using PayPal.

ryanlol 7y ago

> Most ethical hackers will remember the 2013 case of Robert Kugler, the 17-year old German student who was shafted out of a huge bounty after he discovered a critical bug on PayPal’s site. Kugler notified PayPal of the vulnerability on May 19, but apparently PayPal told him that because he was under 18, he was ineligible for the Bug Bounty Program. >But according to PayPal, the bug had already been discovered by someone else, but they also admitted that the young hacker was just too young. Bad PR like this shows that bug bounty programs are probably more trouble than they’re worth.

jonnycomputer 7y ago

I have no experience, but it seems to me that a bug bounty program would be ripe for abuse by employees intercepting reports, feeding them to a partner hacker, and then splitting the bounty between themselves. What stops that from happening?

stebann 7y ago

Hackers of the world, unite!

IronWolve 7y ago

Interesting timing, a pro hackone article on slashdot posted hours after this post about hackerone issues.

Darknessgazer 7y ago

If anyone in this thread is interested in talking about their experiences with HackerOne, please shoot me an email at david.morris@fortune.com. Positive or negative. We can set up a time to talk, or if you're more comfortable, just include details in your email.

homakov 7y ago

None of the bugs is critical, not even medium severity.

BrandoElFollito 7y ago

We run a private bug bounty (not via H1 but another platform), classical pentests, dynamic code assessment and a responsible disclosure program. Pentests are ok, they help to scrap plenty of bugs. I am not a great fan otherwise because it is based on a fixed rate. Private bb ended up fantastic. Great bugs, great researchers, reasonably good pay (not Apple grade but we paid some 30k€ irrc). Feedback from researchers was good, including unexpected public praise. Dynamic code reviews are a mixed bag. Usually crap, sometimes hidden gems. Responsible disclosure is a mixed bag too. It is very binary : 20% great from great researchers we usually invite to the private bounty afterwards, and 80% garbage. Oh man, the garbage. Often I do not even understand the submission (not being a native English speaker either). One other problem with public programs are legal implications to pay an anonymous reporter (imagine a US company paying someone affiliated with NC or Iran or Daesh, and that info published in the press)