6 ms·

10K for this kind of vuln is very cheap on their part. This is serious when you consider that they are moving millions of transactions every day... CSRF valid

by Globz 12y ago

10K for this kind of vuln is very cheap on their part. This is serious when you consider that they are moving millions of transactions every day... CSRF valid for ALL users, ouch!

ripb 12y ago
If it's any consolation, 10k USD is about 14x the median monthly salary in Egypt. http://sites.miis.edu/educationinegypt/files/2013/05/CIEsalaryEgypt.pdf http://sites.miis.edu/educationinegypt/files/2013/05/CIEsala...
- discardorama 12y ago
  So what? The value of the vulnerability to PayPal does not change whether the finder is in Egypt or Norway. PayPal should pay based on its perceived value, and not the finders.
- hobs 12y ago
  Consider what the finder could have sold the exploit for, and the damage it could have caused. I think given that you could effectively steal from any account for which you knew the email was worth significantly more than 10k.
  - Mahn 12y ago
    > you could effectively steal from any account for which you knew the email If you succeed in CSRF attack him, that is.
xbonez 12y ago
Their bounty program[1] states: > We may pay beyond the range at times when bugs are found to have significant risk. If they don't consider this a significant risk, I'm not sure what is. [1] https://www.paypal.com/webapps/mpp/security/reporting-security-issues https://www.paypal.com/webapps/mpp/security/reporting-securi...
bbcbasic 12y ago
Perhaps it is so they don't give staff incentive to leak a vulnerability. If they offer 100k it may be more tempting for a staff member to tell a friend of a friend, and share the prize. It would be stupid of course, but possible.
- rjaco31 12y ago
  Then just allow staff to also claim the prize? Seriously, given the risks and the money rewards, it's a bargain.
  - bbcbasic 12y ago
    It may encourage sloppy coding, because the worse the code, the more potential for your teammates to win a prize. However a separate salaried 'cracking' team in another city, with bonuses for exploits found might work.

by Globz 12y ago

10K for this kind of vuln is very cheap on their part. This is serious when you consider that they are moving millions of transactions every day... CSRF valid for ALL users, ouch!

ripb 12y ago

If it's any consolation, 10k USD is about 14x the median monthly salary in Egypt. http://sites.miis.edu/educationinegypt/files/2013/05/CIEsalaryEgypt.pdf http://sites.miis.edu/educationinegypt/files/2013/05/CIEsala...

discardorama 12y ago
So what? The value of the vulnerability to PayPal does not change whether the finder is in Egypt or Norway. PayPal should pay based on its perceived value, and not the finders.
hobs 12y ago
Consider what the finder could have sold the exploit for, and the damage it could have caused. I think given that you could effectively steal from any account for which you knew the email was worth significantly more than 10k.
- Mahn 12y ago
  > you could effectively steal from any account for which you knew the email If you succeed in CSRF attack him, that is.

xbonez 12y ago

Their bounty program[1] states: > We may pay beyond the range at times when bugs are found to have significant risk. If they don't consider this a significant risk, I'm not sure what is. [1] https://www.paypal.com/webapps/mpp/security/reporting-security-issues https://www.paypal.com/webapps/mpp/security/reporting-securi...

bbcbasic 12y ago

Perhaps it is so they don't give staff incentive to leak a vulnerability. If they offer 100k it may be more tempting for a staff member to tell a friend of a friend, and share the prize. It would be stupid of course, but possible.

rjaco31 12y ago
Then just allow staff to also claim the prize? Seriously, given the risks and the money rewards, it's a bargain.
- bbcbasic 12y ago
  It may encourage sloppy coding, because the worse the code, the more potential for your teammates to win a prize. However a separate salaried 'cracking' team in another city, with bonuses for exploits found might work.