2 ms·

> Note that here, Paypal paid a substantial bounty a year ago. $4400 is not a substantial bounty for a bug of this severity, compared to the value on the blac

by paulmd 7y ago

> Note that here, Paypal paid a substantial bounty a year ago. $4400 is not a substantial bounty for a bug of this severity, compared to the value on the black market. Like, the article even cites that attackers have extracted over $1000 from some individuals, multiply by thousands of users. The black market value of this exploit is certainly into the hundreds of thousands.

tptacek 7y ago
You'll excuse me if I don't take this very seriously given that on previous threads people have --- not making this up --- made cases for logout CSRFs having high value on the black market. After all: the competitors to the vulnerable service could have used logout CSRFs to drive customers away! Vulnerabilities are worth money in markets when they fit into pre-existing business/operational models. That's why clientside RCE in popular clients is valuable: multiple competing buyers have whole operational frameworks where new RCEs are drop-in compatible. Nobody speculatively builds new business models around the prospect of a random serverside vulnerability. Maybe a vulnerability like this has value --- we don't know what it is, or how much interaction is required, or how quickly it could have been killed --- if it directly produces cash every time it's applied. But that's still a maybe for a serverside vulnerability with a half-life of epsilon. Meanwhile: $4400 is a strong bounty for a serverside logic vulnerability. Serious vulnerabilities like stored XSS have bounty values in the hundreds of dollars despite the fact that people on HN seem to think they're worth 6 figures on some hypothetical black market. I have no opinion about how Paypal handled this vulnerability after paying up for it; I'm exclusively interested in how this story intersects with yesterday's Paypal thread, which was a shitshow.
- paulmd 7y ago
  The business model already exists: order videogame consoles or luxury purses or some other high-value good that is easily fungible with cash (Craigslist) and then either porch pirate the package when it arrives, or if you're brazen enough just order it right to yourself. This is something that is routinely done already with credit card fraud. This is how thieves "cash out" the cards they steal with skimmers at gas pumps and stores. The angle here is that they no longer need to steal your digits with a skimmer, they can just use your contactless payment wallet, because Paypal didn't lock them down properly. Or so the researchers allege (they don't give the exact details of the vuln for obvious reasons).
  - tptacek 7y ago
    That's like saying the existing business model is "crime". What I'm talking about is all the support code and processes that go into operationalizing a vulnerability. Again: it depends on what the vulnerability is, and we don't know, but if it's an elaborate serverside vulnerability that requires user interaction specific to this vulnerability, I'm comfortable out on the limb that says nobody is bidding against anyone to buy this on any black market. You're also only responding to a fraction of my argument. Even for clientside RCE, alternate market buyers don't pay full freight in a lump sum: they tranche payments because they know vendors will eventually kill the vulnerability and nobody is sure how long that will take. Here, you have a vulnerability where you'd more or less have to get paid royalties from direct fraud, because, again, Paypal can presumably kill the bug instantly. If you have more specific details on the vulnerability that will enable you to make a clearer case for how this could drop into a system of repeated profitable attacks, provide them. I'm interested in hearing them. Otherwise, my default response to people saying "this bounty is too cheap because the black market would pay 10x for it" is "yeah, sure, and for logout CSRFs too".

by paulmd 7y ago

tptacek 7y ago

You'll excuse me if I don't take this very seriously given that on previous threads people have --- not making this up --- made cases for logout CSRFs having high value on the black market. After all: the competitors to the vulnerable service could have used logout CSRFs to drive customers away! Vulnerabilities are worth money in markets when they fit into pre-existing business/operational models. That's why clientside RCE in popular clients is valuable: multiple competing buyers have whole operational frameworks where new RCEs are drop-in compatible. Nobody speculatively builds new business models around the prospect of a random serverside vulnerability. Maybe a vulnerability like this has value --- we don't know what it is, or how much interaction is required, or how quickly it could have been killed --- if it directly produces cash every time it's applied. But that's still a maybe for a serverside vulnerability with a half-life of epsilon. Meanwhile: $4400 is a strong bounty for a serverside logic vulnerability. Serious vulnerabilities like stored XSS have bounty values in the hundreds of dollars despite the fact that people on HN seem to think they're worth 6 figures on some hypothetical black market. I have no opinion about how Paypal handled this vulnerability after paying up for it; I'm exclusively interested in how this story intersects with yesterday's Paypal thread, which was a shitshow.

paulmd 7y ago
The business model already exists: order videogame consoles or luxury purses or some other high-value good that is easily fungible with cash (Craigslist) and then either porch pirate the package when it arrives, or if you're brazen enough just order it right to yourself. This is something that is routinely done already with credit card fraud. This is how thieves "cash out" the cards they steal with skimmers at gas pumps and stores. The angle here is that they no longer need to steal your digits with a skimmer, they can just use your contactless payment wallet, because Paypal didn't lock them down properly. Or so the researchers allege (they don't give the exact details of the vuln for obvious reasons).
- tptacek 7y ago
  That's like saying the existing business model is "crime". What I'm talking about is all the support code and processes that go into operationalizing a vulnerability. Again: it depends on what the vulnerability is, and we don't know, but if it's an elaborate serverside vulnerability that requires user interaction specific to this vulnerability, I'm comfortable out on the limb that says nobody is bidding against anyone to buy this on any black market. You're also only responding to a fraction of my argument. Even for clientside RCE, alternate market buyers don't pay full freight in a lump sum: they tranche payments because they know vendors will eventually kill the vulnerability and nobody is sure how long that will take. Here, you have a vulnerability where you'd more or less have to get paid royalties from direct fraud, because, again, Paypal can presumably kill the bug instantly. If you have more specific details on the vulnerability that will enable you to make a clearer case for how this could drop into a system of repeated profitable attacks, provide them. I'm interested in hearing them. Otherwise, my default response to people saying "this bounty is too cheap because the black market would pay 10x for it" is "yeah, sure, and for logout CSRFs too".