11 ms·

Hacking PayPal Accounts with one click

324 points by butwhy 12y ago

lost_name 12y ago
Paypal's Bug Bounty program, for the curious: https://www.paypal.com/webapps/mpp/security/reporting-security-issues https://www.paypal.com/webapps/mpp/security/reporting-securi...
- talles 12y ago
  Paypal detects that I'm in Brazil and gives me the brazilian version of the website, in which the link is 'Not Found'. There is no locale on url whatsoever. I have to manually change my country to United States in their menu and then I'm able to access the url. So annoying. Why not showing the page with a simple warning such as "Sorry, we don't have this content in your language, here's the original:"...
  - rtpg 12y ago
    From what I've understood about Paypal, international entities are more or less completely separate from Paypal US (hence these sorts of events). Commonly it was API features that work subtly differently depending on the region of the world you're in, but help pages also end up with completely different URL schemes.
    - jbkkd 12y ago
      That's not an excuse really, they could easily have gotten that sorted if they PayPal HQ (US I guess?) wanted to.
    - fiatjaf 12y ago
      They cannot be: I had an account at the american Paypal and it was automatically transferred to Brazil when they opened here.
      - jotm 12y ago
        Huh, they just told me to open a new account in Europe...
  - stickydink 12y ago
    It's a bad link, doesn't work in the US either
    - pc86 12y ago
      Works fine for me
  - baby 12y ago
    Doesn't work in France either :(
  - MichaelGG 12y ago
    This kind of thing is so frustrating. It's one of those features where "somebody got a raise for that", except it's so hostile towards users. Google is absolutely the worst. Installed an app in one country that's not available in another? Cool now you get a 404 in the play store. In Denver, Google has also at times decided I'm in France, then Hungary, with absolutely no way to fully disable it on sites like YouTube or Google.com (you always get the links and logos, and alt-text for images is still in the "local" language). Play Store shows certain section subtitles in one language, even though Android and everything else is in another. I recently went to buy some books for my kids. The publisher's site detected I was in another country, and hid the book information with a page suggesting I contact a local reseller. Despite that I was just visiting another country at the time. No way to override. Chrome would do the same on install, and offer no way to remove the default search engine from the localized copy. You could change to another one, but not fully delete it. Meanwhile, the entire UI stays in whatever language they decided. So despite using Windows in English, browser in English, etc. etc., Google though it'd be cool to run in Spanish, or Russian, or whatever, based on your IP address. Moronic. Netflix has similar problems - the site does not respect language preferences completely and things like search autocomplete will use the "detected" language. Traveling and contacting support? Cool. Despite every indication you're using English, they'll route you to support in a local language. It's insane. The one thing the HTTP spec got right, Accept-Language, and everyone just ignores it and implements this shitty geo localization + language handling. And they think it's a feature, and every time someone implements this, they probably get a pat on the back and a raise for doing something intelligent. FFS.
- danielsamuels 12y ago
  Correct link: https://www.paypal.com/us/webapps/mpp/security/reporting-security-issues https://www.paypal.com/us/webapps/mpp/security/reporting-sec...
  - Derpdiherp 12y ago
    Is it just me or are these bounties really low. Unless I'm misunderstanding identification bypass could be incredibly damaging for the company and their customers, but it's only got a $3000 reward? In my personal opinion you want to balance bounties against how much money that the person could receive using the exploits, vs the amount of trouble they could potentially get into.
    - atmosx 12y ago
      That's kinda hard to evaluate not having actually do it. That said, such a bug, if works as expected might be much more highly priced in the black market.
    - ceejayoz 12y ago
      They're a "here's a token of thanks", not a "please don't sell it".
    - driverdan 12y ago
      It's insultingly low. Auth bypass is easily worth 5 or 6 figures if you can use it to transfer money.
      - onewaystreet 12y ago
        You overestimate the value of these bugs to the black market. There is no shortage of hacked PayPal accounts for sale on the various dark net markets because the hard part is getting money off the accounts. PayPal will flag a transfer for a dozen different reasons. If you don't login to the hacked account from an IP close to the location of its owner; if you immediately attempt to transfer money off the account to a bank account; etc.
    - 12y ago
dmix 12y ago
Reminds me of how PayPal implemented 2FA, then someone immediately found a bypass since they only made 2FA a requirement for a particular web login page instead of EVERY login entry-point (ie mobile or APIs). PayPal's security continues to be embarrassingly bad.
- pm90 12y ago
  They're not laughably bad, they have had to manage a huge, aging software system and build infrastructure on top and around it. They may have made many mistakes, but some of the smartest people I know work there, and most of the work they do is first-class.
  - dmix 12y ago
    > most of the work they do is first-class Are we talking about the same PayPal? Have you seen their web interface or their APIs? It hasn't evolved at all in 10 years. It's the same convoluted, bloated, and slow web experience as it was in 2005. Just because a few smart people work there doesn't mean the project is outputting quality software. Countless software companies have been able to take aging and massive codebases and evolve them to more modern usable states. Most of the time these big companies such as Microsoft or Oracle still output bad software but at least they show signs of evolution and investment. From an outsiders perspective Paypal is particularly bad at this, their software quality and UX has been in a perpetual stasis while Stripe and others eat their lunch. And that's not simply because of their famously bad customer service.
    - thibaut_barrere 12y ago
      I'm not a PayPal fan - but at least on my account, the UX has changed significantly since 2005 (especially last year or something), and I could find everything I need for my accounting easily.
      - ericcholis 12y ago
        The general consumer interface is great now. The business interface, however, is not. It's still the same slow UI from 2005. Actually, it feels like they are still running on servers from 2005. Simple (email, date range, etc...) searches take FOREVER.
Nanzikambe 12y ago
Anyone know what the interception proxy/tool he's using in the screenshots is? I could really have used that a few days ago
- chilgart 12y ago
  It's Burp Suite. http://www.portswigger.net/ http://www.portswigger.net/
tshadwell 12y ago
Pivotal paragraph: "We have found out that an Attacker can obtain the CSRF Auth which can be valid for ALL users, by intercepting the POST request from a page that provide an Auth Token before the Logging-in process, check this page for the magical CSRF Auth “https://www.paypal.com/eg/cgi-bin/webscr?cmd=_send-money” https://www.paypal.com/eg/cgi-bin/webscr?cmd=_send-money”. At this point the attacker Can CSRF “almost” any request on behave of this user." He captured a cross-site request forgery token which was valid for all users.
- probablyfiction 12y ago
  Someone (or even more frightening, multiple someones) at Paypal didn't understand the point of CSRF tokens. A new random value for each request is essential to maintain the integrity of the measure. CSRF tokens should never be used as a type of global authentication value. The fact that this made it to production is mind-blowing. EDIT: Looks like I am wrong on HN. Damn.
  - ZoFreX 12y ago
    > A new random value for each request is essential to maintain the integrity of the measure No it isn't - Having CSRF tokens be unique per-session is perfectly adequate.
    - mike-cardwell 12y ago
      From what I can see, it should be good enough to just use the same session id which is stored in the cookie as the CSRF token. If an attacker has your session id, then CSRF is the least of your problems. I don't know why people come up with more complicated schemes... Am I wrong?
      - sisk 12y ago
        That would make tokens valid across different applications that share a session. A compromise of one application would then jeopardize all your applications. Just reduces the risk surface a bit.
jrochkind1 12y ago
Oh man. Security is hard, and I expect security flaws to be found in almost any software. But these don't _seem_ to be flaws that you'd have if you were spending as much money/resources/prioritization on security as I'd expect a business in Paypal's business to be spending. Am I wrong?
- beachstartup 12y ago
  well, by definition you're wrong. it wouldn't surprise me if companies such as paypal have moles who actively compromise software through subtle means. if it can happen in the government it can definitely happen in a huge software company.
  - lostcolony 12y ago
    Possibly even -by- the government. No tinfoil hat needed; thanks, NSA!
- Someone1234 12y ago
  Maybe, but maybe it is strategy rather than money. This exploit is the result of several bugs in different systems coming together into one "super bug." If you have the same developers who wrote the code go back over that same code they may not spot the bugs. Microsoft do code reviews but they also do fuzzing, unit testing, path diagrams, and other methods with the hope that each type of testing will uncover different bugs. However when you have bugs caused by multiple systems working together badly, it might be better solved by policy (e.g. this ONE piece of code does all of our CSRF from now on, no re-implementing it five different times).
thekylemontag 12y ago
I can only imagine how much money he got for this one. Very serious bug given how easy it was to reproduce.
- aligajani 12y ago
  Says in his blog comments he got paid $10,000
Globz 12y ago
10K for this kind of vuln is very cheap on their part. This is serious when you consider that they are moving millions of transactions every day... CSRF valid for ALL users, ouch!
- ripb 12y ago
  If it's any consolation, 10k USD is about 14x the median monthly salary in Egypt. http://sites.miis.edu/educationinegypt/files/2013/05/CIEsalaryEgypt.pdf http://sites.miis.edu/educationinegypt/files/2013/05/CIEsala...
  - discardorama 12y ago
    So what? The value of the vulnerability to PayPal does not change whether the finder is in Egypt or Norway. PayPal should pay based on its perceived value, and not the finders.
  - hobs 12y ago
    Consider what the finder could have sold the exploit for, and the damage it could have caused. I think given that you could effectively steal from any account for which you knew the email was worth significantly more than 10k.
    - Mahn 12y ago
      > you could effectively steal from any account for which you knew the email If you succeed in CSRF attack him, that is.
- xbonez 12y ago
  Their bounty program[1] states: > We may pay beyond the range at times when bugs are found to have significant risk. If they don't consider this a significant risk, I'm not sure what is. [1] https://www.paypal.com/webapps/mpp/security/reporting-security-issues https://www.paypal.com/webapps/mpp/security/reporting-securi...
- bbcbasic 12y ago
user1024 12y ago
Scary stuff. My Paypal was compromised earlier this week; wondering if this vulnerability or one like it was used.
downandout 12y ago
I think I speak for us all when I say ???????!!!!!!!. This exploit is as big as they come. They should have paid him many times their $10k maximum bounty in exchange for an NDA, as I am sure I am not alone in saying that this shakes my confidence in PayPal. While I have never trusted them as far as random account freezings etc., I didn't ever expect something as fundamental and serious as this. When you think of all the engineers they must have dedicated to security, it is almost unfathomable that this was missed.
- oxalo 12y ago
  Security is hard. I think the more important thing here is that Paypal fixed it quickly and honored the bug bounty. I'd be more worried if they tried to shove it under the rug.
  - downandout 12y ago
    > Security is hard. Secuirty is hard. But activating tokens before a user has actually logged in is a breathtakingly incompetent, fundamental design flaw. How such code ever made it into the production code base of a company responsible for protecting billions of dollars along with financial information for a significant portion of the world is incomprehensible. It makes me wonder what else is lurking over there.
codegeek 12y ago
Thanks for this. Another reason for me to get off Paypal as fast as I can. I understand that vulnerabilities can exist with any system but Paypal just continues to amaze. Unfortunately, I still have 3 customers on paypal :(
IkmoIkmo 12y ago
Paypal should literally pay upwards of $100k for a bug like this. This is a game changing systemic security issue putting literally every single customer at risk, as well as put at least a minor dent in a the brand of a $40 billion dollar company. $10k is a joke. Wouldn't say $10k isn't nice. Rather, I'd say that history has told us people are susceptible to money. And if someone can choose between $10k and selling information worth much more, let's just conservatively say without pulling numbers from my ass, people would choose the latter option more than Paypal ought to want them to, and that this costs them way more than the $10k they'd otherwise lose. I think that's a pretty fair statement. Anyway, about the issue itself... Really don't know what to think, it's pretty insane, puts a lot of things into perspective once more. (the whole 'if Paypal can't secure xyz, can my local hospital keep my health records safe, am I equiped to handle my own digital security responsibilities?' train of thought). Oh if anyone feels like thinking this through, how bad do you guys think this hack could have turned out if deployed by a malicious group? Paypal is pretty walled in with various limits, fraud checks, frozen accounts, multi-day bank transaction processing, reversible transactions, partnerships with banks to do chargebacks there, and they do KYC on every account. The offramps are therefore pretty limited unless you completely expose your identity. Of course they could buy a ton of stuff online, but how anonymous would the shipping be, and what could you buy with Paypal that would be liquid enough, would ship quickly and could be received fairly anonymously (you don't want to use this hack and end up with 100 playstations and on 3-day shipping to your own home and have police arrive before the goods do!). I wonder what the best plan of action would be, I can't really come up with any solid way to actually walk away, anonymously, with a ton of money but surely there must be one. Indulge me if you want!
- olemoudi 12y ago
  Attacking company reputation is more valuable than any stuff you manage to buy with a bug like this. You just need to snatch some transactions from enough people and leak the story to the media. You do not actually need to monetize those transactions.
  - BHSPitMonkey 12y ago
    Valuable to a small handful of competing corporate interests, maybe, but useless to the rest of us. What are you suggesting, that Amazon might agree to funnel you a large sum of money under the table in return for divulging something like this?
lcfcjs 12y ago
Should have used js, fuckin noobs

324 points by butwhy 12y ago

Paypal's Bug Bounty program, for the curious: https://www.paypal.com/webapps/mpp/security/reporting-security-issues https://www.paypal.com/webapps/mpp/security/reporting-securi...

talles 12y ago
Paypal detects that I'm in Brazil and gives me the brazilian version of the website, in which the link is 'Not Found'. There is no locale on url whatsoever. I have to manually change my country to United States in their menu and then I'm able to access the url. So annoying. Why not showing the page with a simple warning such as "Sorry, we don't have this content in your language, here's the original:"...
- rtpg 12y ago
  From what I've understood about Paypal, international entities are more or less completely separate from Paypal US (hence these sorts of events). Commonly it was API features that work subtly differently depending on the region of the world you're in, but help pages also end up with completely different URL schemes.
  - jbkkd 12y ago
    That's not an excuse really, they could easily have gotten that sorted if they PayPal HQ (US I guess?) wanted to.
  - fiatjaf 12y ago
    They cannot be: I had an account at the american Paypal and it was automatically transferred to Brazil when they opened here.
    - jotm 12y ago
      Huh, they just told me to open a new account in Europe...
- stickydink 12y ago
  It's a bad link, doesn't work in the US either
  - pc86 12y ago
    Works fine for me
- baby 12y ago
  Doesn't work in France either :(
- MichaelGG 12y ago
  This kind of thing is so frustrating. It's one of those features where "somebody got a raise for that", except it's so hostile towards users. Google is absolutely the worst. Installed an app in one country that's not available in another? Cool now you get a 404 in the play store. In Denver, Google has also at times decided I'm in France, then Hungary, with absolutely no way to fully disable it on sites like YouTube or Google.com (you always get the links and logos, and alt-text for images is still in the "local" language). Play Store shows certain section subtitles in one language, even though Android and everything else is in another. I recently went to buy some books for my kids. The publisher's site detected I was in another country, and hid the book information with a page suggesting I contact a local reseller. Despite that I was just visiting another country at the time. No way to override. Chrome would do the same on install, and offer no way to remove the default search engine from the localized copy. You could change to another one, but not fully delete it. Meanwhile, the entire UI stays in whatever language they decided. So despite using Windows in English, browser in English, etc. etc., Google though it'd be cool to run in Spanish, or Russian, or whatever, based on your IP address. Moronic. Netflix has similar problems - the site does not respect language preferences completely and things like search autocomplete will use the "detected" language. Traveling and contacting support? Cool. Despite every indication you're using English, they'll route you to support in a local language. It's insane. The one thing the HTTP spec got right, Accept-Language, and everyone just ignores it and implements this shitty geo localization + language handling. And they think it's a feature, and every time someone implements this, they probably get a pat on the back and a raise for doing something intelligent. FFS.
danielsamuels 12y ago
Correct link: https://www.paypal.com/us/webapps/mpp/security/reporting-security-issues https://www.paypal.com/us/webapps/mpp/security/reporting-sec...
- Derpdiherp 12y ago
  Is it just me or are these bounties really low. Unless I'm misunderstanding identification bypass could be incredibly damaging for the company and their customers, but it's only got a $3000 reward? In my personal opinion you want to balance bounties against how much money that the person could receive using the exploits, vs the amount of trouble they could potentially get into.
  - atmosx 12y ago
    That's kinda hard to evaluate not having actually do it. That said, such a bug, if works as expected might be much more highly priced in the black market.
  - ceejayoz 12y ago
    They're a "here's a token of thanks", not a "please don't sell it".
  - driverdan 12y ago
    It's insultingly low. Auth bypass is easily worth 5 or 6 figures if you can use it to transfer money.
    - onewaystreet 12y ago
      You overestimate the value of these bugs to the black market. There is no shortage of hacked PayPal accounts for sale on the various dark net markets because the hard part is getting money off the accounts. PayPal will flag a transfer for a dozen different reasons. If you don't login to the hacked account from an IP close to the location of its owner; if you immediately attempt to transfer money off the account to a bank account; etc.
  - 12y ago

dmix 12y ago

Reminds me of how PayPal implemented 2FA, then someone immediately found a bypass since they only made 2FA a requirement for a particular web login page instead of EVERY login entry-point (ie mobile or APIs). PayPal's security continues to be embarrassingly bad.

pm90 12y ago
They're not laughably bad, they have had to manage a huge, aging software system and build infrastructure on top and around it. They may have made many mistakes, but some of the smartest people I know work there, and most of the work they do is first-class.
- dmix 12y ago
  > most of the work they do is first-class Are we talking about the same PayPal? Have you seen their web interface or their APIs? It hasn't evolved at all in 10 years. It's the same convoluted, bloated, and slow web experience as it was in 2005. Just because a few smart people work there doesn't mean the project is outputting quality software. Countless software companies have been able to take aging and massive codebases and evolve them to more modern usable states. Most of the time these big companies such as Microsoft or Oracle still output bad software but at least they show signs of evolution and investment. From an outsiders perspective Paypal is particularly bad at this, their software quality and UX has been in a perpetual stasis while Stripe and others eat their lunch. And that's not simply because of their famously bad customer service.
  - thibaut_barrere 12y ago
    I'm not a PayPal fan - but at least on my account, the UX has changed significantly since 2005 (especially last year or something), and I could find everything I need for my accounting easily.
    - ericcholis 12y ago
      The general consumer interface is great now. The business interface, however, is not. It's still the same slow UI from 2005. Actually, it feels like they are still running on servers from 2005. Simple (email, date range, etc...) searches take FOREVER.

Nanzikambe 12y ago

Anyone know what the interception proxy/tool he's using in the screenshots is? I could really have used that a few days ago

chilgart 12y ago
It's Burp Suite. http://www.portswigger.net/ http://www.portswigger.net/

tshadwell 12y ago

Pivotal paragraph: "We have found out that an Attacker can obtain the CSRF Auth which can be valid for ALL users, by intercepting the POST request from a page that provide an Auth Token before the Logging-in process, check this page for the magical CSRF Auth “https://www.paypal.com/eg/cgi-bin/webscr?cmd=_send-money” https://www.paypal.com/eg/cgi-bin/webscr?cmd=_send-money”. At this point the attacker Can CSRF “almost” any request on behave of this user." He captured a cross-site request forgery token which was valid for all users.

probablyfiction 12y ago
Someone (or even more frightening, multiple someones) at Paypal didn't understand the point of CSRF tokens. A new random value for each request is essential to maintain the integrity of the measure. CSRF tokens should never be used as a type of global authentication value. The fact that this made it to production is mind-blowing. EDIT: Looks like I am wrong on HN. Damn.
- ZoFreX 12y ago
  > A new random value for each request is essential to maintain the integrity of the measure No it isn't - Having CSRF tokens be unique per-session is perfectly adequate.
  - mike-cardwell 12y ago
    From what I can see, it should be good enough to just use the same session id which is stored in the cookie as the CSRF token. If an attacker has your session id, then CSRF is the least of your problems. I don't know why people come up with more complicated schemes... Am I wrong?
    - sisk 12y ago
      That would make tokens valid across different applications that share a session. A compromise of one application would then jeopardize all your applications. Just reduces the risk surface a bit.

jrochkind1 12y ago

Oh man. Security is hard, and I expect security flaws to be found in almost any software. But these don't _seem_ to be flaws that you'd have if you were spending as much money/resources/prioritization on security as I'd expect a business in Paypal's business to be spending. Am I wrong?

beachstartup 12y ago
well, by definition you're wrong. it wouldn't surprise me if companies such as paypal have moles who actively compromise software through subtle means. if it can happen in the government it can definitely happen in a huge software company.
- lostcolony 12y ago
  Possibly even -by- the government. No tinfoil hat needed; thanks, NSA!
Someone1234 12y ago
Maybe, but maybe it is strategy rather than money. This exploit is the result of several bugs in different systems coming together into one "super bug." If you have the same developers who wrote the code go back over that same code they may not spot the bugs. Microsoft do code reviews but they also do fuzzing, unit testing, path diagrams, and other methods with the hope that each type of testing will uncover different bugs. However when you have bugs caused by multiple systems working together badly, it might be better solved by policy (e.g. this ONE piece of code does all of our CSRF from now on, no re-implementing it five different times).

thekylemontag 12y ago

I can only imagine how much money he got for this one. Very serious bug given how easy it was to reproduce.

aligajani 12y ago
Says in his blog comments he got paid $10,000

Globz 12y ago

10K for this kind of vuln is very cheap on their part. This is serious when you consider that they are moving millions of transactions every day... CSRF valid for ALL users, ouch!

ripb 12y ago
If it's any consolation, 10k USD is about 14x the median monthly salary in Egypt. http://sites.miis.edu/educationinegypt/files/2013/05/CIEsalaryEgypt.pdf http://sites.miis.edu/educationinegypt/files/2013/05/CIEsala...
- discardorama 12y ago
  So what? The value of the vulnerability to PayPal does not change whether the finder is in Egypt or Norway. PayPal should pay based on its perceived value, and not the finders.
- hobs 12y ago
  Consider what the finder could have sold the exploit for, and the damage it could have caused. I think given that you could effectively steal from any account for which you knew the email was worth significantly more than 10k.
  - Mahn 12y ago
    > you could effectively steal from any account for which you knew the email If you succeed in CSRF attack him, that is.
xbonez 12y ago
Their bounty program[1] states: > We may pay beyond the range at times when bugs are found to have significant risk. If they don't consider this a significant risk, I'm not sure what is. [1] https://www.paypal.com/webapps/mpp/security/reporting-security-issues https://www.paypal.com/webapps/mpp/security/reporting-securi...
bbcbasic 12y ago

user1024 12y ago

Scary stuff. My Paypal was compromised earlier this week; wondering if this vulnerability or one like it was used.

downandout 12y ago

I think I speak for us all when I say ???????!!!!!!!. This exploit is as big as they come. They should have paid him many times their $10k maximum bounty in exchange for an NDA, as I am sure I am not alone in saying that this shakes my confidence in PayPal. While I have never trusted them as far as random account freezings etc., I didn't ever expect something as fundamental and serious as this. When you think of all the engineers they must have dedicated to security, it is almost unfathomable that this was missed.

oxalo 12y ago
Security is hard. I think the more important thing here is that Paypal fixed it quickly and honored the bug bounty. I'd be more worried if they tried to shove it under the rug.
- downandout 12y ago
  > Security is hard. Secuirty is hard. But activating tokens before a user has actually logged in is a breathtakingly incompetent, fundamental design flaw. How such code ever made it into the production code base of a company responsible for protecting billions of dollars along with financial information for a significant portion of the world is incomprehensible. It makes me wonder what else is lurking over there.

codegeek 12y ago

Thanks for this. Another reason for me to get off Paypal as fast as I can. I understand that vulnerabilities can exist with any system but Paypal just continues to amaze. Unfortunately, I still have 3 customers on paypal :(

IkmoIkmo 12y ago

Paypal should literally pay upwards of $100k for a bug like this. This is a game changing systemic security issue putting literally every single customer at risk, as well as put at least a minor dent in a the brand of a $40 billion dollar company. $10k is a joke. Wouldn't say $10k isn't nice. Rather, I'd say that history has told us people are susceptible to money. And if someone can choose between $10k and selling information worth much more, let's just conservatively say without pulling numbers from my ass, people would choose the latter option more than Paypal ought to want them to, and that this costs them way more than the $10k they'd otherwise lose. I think that's a pretty fair statement. Anyway, about the issue itself... Really don't know what to think, it's pretty insane, puts a lot of things into perspective once more. (the whole 'if Paypal can't secure xyz, can my local hospital keep my health records safe, am I equiped to handle my own digital security responsibilities?' train of thought). Oh if anyone feels like thinking this through, how bad do you guys think this hack could have turned out if deployed by a malicious group? Paypal is pretty walled in with various limits, fraud checks, frozen accounts, multi-day bank transaction processing, reversible transactions, partnerships with banks to do chargebacks there, and they do KYC on every account. The offramps are therefore pretty limited unless you completely expose your identity. Of course they could buy a ton of stuff online, but how anonymous would the shipping be, and what could you buy with Paypal that would be liquid enough, would ship quickly and could be received fairly anonymously (you don't want to use this hack and end up with 100 playstations and on 3-day shipping to your own home and have police arrive before the goods do!). I wonder what the best plan of action would be, I can't really come up with any solid way to actually walk away, anonymously, with a ton of money but surely there must be one. Indulge me if you want!

olemoudi 12y ago
Attacking company reputation is more valuable than any stuff you manage to buy with a bug like this. You just need to snatch some transactions from enough people and leak the story to the media. You do not actually need to monetize those transactions.
- BHSPitMonkey 12y ago
  Valuable to a small handful of competing corporate interests, maybe, but useless to the rest of us. What are you suggesting, that Amazon might agree to funnel you a large sum of money under the table in return for divulging something like this?

lcfcjs 12y ago

Should have used js, fuckin noobs