9 ms·

Even yesterday there was this thread https://news.ycombinator.com/item?id=22403565 https://news.ycombinator.com/item?id=22403565 PayPal needs to seriously reev

by s5ma6n 7y ago

Even yesterday there was this thread https://news.ycombinator.com/item?id=22403565 https://news.ycombinator.com/item?id=22403565 PayPal needs to seriously reevaluate how they want to approach the vulnerabilities. Why have a bounty program if you are going to act hostile towards the white hat community or even ignore their reports?

tptacek 7y ago
The two stories are unrelated, though the reporter cites the former. From the vulnerabilities disclosed in that report, it seems pretty unlikely that yesterday's stories caused a rash of thefts; they were all pretty low-severity. Note that here, Paypal paid a substantial bounty a year ago.
- rasengan 7y ago
  From the article: “We reported this in February 2019 to PayPal via HackerOne,” they say. “After an initial rejection and several discussions, PayPal paid a bug bounty of $4,400.” The pair have not heard from PayPal, they say, since April 2019. But this week “tried and could still use the virtual credit card for online payments.” That means, they told me, “the bug has not been fixed.” To reiterate the OP, what is the point of a bug bounty program that ignores or fails to address reported issues? > The two stories are unrelated They are related in the sense that both stories show a failure to respond to reported issues. > Note that here, Paypal paid a substantial bounty a year ago. They paid but didn’t fix the issue? This is not taking account security serious at all. At best, PayPal has a critical flaw in their bug bounty program.
  - pvg 7y ago
    At best, PayPal has a critical flaw [...] This seems curiously confident given that just about every single one of your many comments on the other story was inaccurate or a misinterpretation.
    - rasengan 7y ago
      > This seems curiously confident given that just about every single one of your many comments on the other story was inaccurate or a misinterpretation. So you don’t think that sending a bug bounty reward a year ago to a security researcher who exposed a flaw, that is still being exploited to take money from people, is a critical flaw in the program?
      - pvg 7y ago
        Do I think it's possible PayPal had an incomplete fix or had a regression or an organizational screwup of some kind? Absolutely, that is possible. Do I think your 'motivated googling' approach to analyzing either story is likely to produce worthwhile insight? Not really. We've already seen it be remarkably inaccurate.
        rasengan 7y ago
        > Do I think it's possible PayPal had an incomplete fix or had a regression or an organizational screwup of some kind? Absolutely, that is possible. Great! You’re in agreement!
- paulmd 7y ago
  > Note that here, Paypal paid a substantial bounty a year ago. $4400 is not a substantial bounty for a bug of this severity, compared to the value on the black market. Like, the article even cites that attackers have extracted over $1000 from some individuals, multiply by thousands of users. The black market value of this exploit is certainly into the hundreds of thousands.
  - tptacek 7y ago
    You'll excuse me if I don't take this very seriously given that on previous threads people have --- not making this up --- made cases for logout CSRFs having high value on the black market. After all: the competitors to the vulnerable service could have used logout CSRFs to drive customers away! Vulnerabilities are worth money in markets when they fit into pre-existing business/operational models. That's why clientside RCE in popular clients is valuable: multiple competing buyers have whole operational frameworks where new RCEs are drop-in compatible. Nobody speculatively builds new business models around the prospect of a random serverside vulnerability. Maybe a vulnerability like this has value --- we don't know what it is, or how much interaction is required, or how quickly it could have been killed --- if it directly produces cash every time it's applied. But that's still a maybe for a serverside vulnerability with a half-life of epsilon. Meanwhile: $4400 is a strong bounty for a serverside logic vulnerability. Serious vulnerabilities like stored XSS have bounty values in the hundreds of dollars despite the fact that people on HN seem to think they're worth 6 figures on some hypothetical black market. I have no opinion about how Paypal handled this vulnerability after paying up for it; I'm exclusively interested in how this story intersects with yesterday's Paypal thread, which was a shitshow.
    - paulmd 7y ago
      The business model already exists: order videogame consoles or luxury purses or some other high-value good that is easily fungible with cash (Craigslist) and then either porch pirate the package when it arrives, or if you're brazen enough just order it right to yourself. This is something that is routinely done already with credit card fraud. This is how thieves "cash out" the cards they steal with skimmers at gas pumps and stores. The angle here is that they no longer need to steal your digits with a skimmer, they can just use your contactless payment wallet, because Paypal didn't lock them down properly. Or so the researchers allege (they don't give the exact details of the vuln for obvious reasons).
dagurp 7y ago
They need to be audited IMO

by s5ma6n 7y ago

tptacek 7y ago

The two stories are unrelated, though the reporter cites the former. From the vulnerabilities disclosed in that report, it seems pretty unlikely that yesterday's stories caused a rash of thefts; they were all pretty low-severity. Note that here, Paypal paid a substantial bounty a year ago.

rasengan 7y ago
From the article: “We reported this in February 2019 to PayPal via HackerOne,” they say. “After an initial rejection and several discussions, PayPal paid a bug bounty of $4,400.” The pair have not heard from PayPal, they say, since April 2019. But this week “tried and could still use the virtual credit card for online payments.” That means, they told me, “the bug has not been fixed.” To reiterate the OP, what is the point of a bug bounty program that ignores or fails to address reported issues? > The two stories are unrelated They are related in the sense that both stories show a failure to respond to reported issues. > Note that here, Paypal paid a substantial bounty a year ago. They paid but didn’t fix the issue? This is not taking account security serious at all. At best, PayPal has a critical flaw in their bug bounty program.
- pvg 7y ago
  At best, PayPal has a critical flaw [...] This seems curiously confident given that just about every single one of your many comments on the other story was inaccurate or a misinterpretation.
  - rasengan 7y ago
    > This seems curiously confident given that just about every single one of your many comments on the other story was inaccurate or a misinterpretation. So you don’t think that sending a bug bounty reward a year ago to a security researcher who exposed a flaw, that is still being exploited to take money from people, is a critical flaw in the program?
    - pvg 7y ago
      Do I think it's possible PayPal had an incomplete fix or had a regression or an organizational screwup of some kind? Absolutely, that is possible. Do I think your 'motivated googling' approach to analyzing either story is likely to produce worthwhile insight? Not really. We've already seen it be remarkably inaccurate.
      - rasengan 7y ago
        > Do I think it's possible PayPal had an incomplete fix or had a regression or an organizational screwup of some kind? Absolutely, that is possible. Great! You’re in agreement!
paulmd 7y ago
> Note that here, Paypal paid a substantial bounty a year ago. $4400 is not a substantial bounty for a bug of this severity, compared to the value on the black market. Like, the article even cites that attackers have extracted over $1000 from some individuals, multiply by thousands of users. The black market value of this exploit is certainly into the hundreds of thousands.
- tptacek 7y ago
  You'll excuse me if I don't take this very seriously given that on previous threads people have --- not making this up --- made cases for logout CSRFs having high value on the black market. After all: the competitors to the vulnerable service could have used logout CSRFs to drive customers away! Vulnerabilities are worth money in markets when they fit into pre-existing business/operational models. That's why clientside RCE in popular clients is valuable: multiple competing buyers have whole operational frameworks where new RCEs are drop-in compatible. Nobody speculatively builds new business models around the prospect of a random serverside vulnerability. Maybe a vulnerability like this has value --- we don't know what it is, or how much interaction is required, or how quickly it could have been killed --- if it directly produces cash every time it's applied. But that's still a maybe for a serverside vulnerability with a half-life of epsilon. Meanwhile: $4400 is a strong bounty for a serverside logic vulnerability. Serious vulnerabilities like stored XSS have bounty values in the hundreds of dollars despite the fact that people on HN seem to think they're worth 6 figures on some hypothetical black market. I have no opinion about how Paypal handled this vulnerability after paying up for it; I'm exclusively interested in how this story intersects with yesterday's Paypal thread, which was a shitshow.
  - paulmd 7y ago
    The business model already exists: order videogame consoles or luxury purses or some other high-value good that is easily fungible with cash (Craigslist) and then either porch pirate the package when it arrives, or if you're brazen enough just order it right to yourself. This is something that is routinely done already with credit card fraud. This is how thieves "cash out" the cards they steal with skimmers at gas pumps and stores. The angle here is that they no longer need to steal your digits with a skimmer, they can just use your contactless payment wallet, because Paypal didn't lock them down properly. Or so the researchers allege (they don't give the exact details of the vuln for obvious reasons).

dagurp 7y ago

They need to be audited IMO