5 ms·

Paypal should literally pay upwards of $100k for a bug like this. This is a game changing systemic security issue putting literally every single customer at ris

Paypal should literally pay upwards of $100k for a bug like this. This is a game changing systemic security issue putting literally every single customer at risk, as well as put at least a minor dent in a the brand of a $40 billion dollar company. $10k is a joke. Wouldn't say $10k isn't nice. Rather, I'd say that history has told us people are susceptible to money. And if someone can choose between $10k and selling information worth much more, let's just conservatively say without pulling numbers from my ass, people would choose the latter option more than Paypal ought to want them to, and that this costs them way more than the $10k they'd otherwise lose. I think that's a pretty fair statement. Anyway, about the issue itself... Really don't know what to think, it's pretty insane, puts a lot of things into perspective once more. (the whole 'if Paypal can't secure xyz, can my local hospital keep my health records safe, am I equiped to handle my own digital security responsibilities?' train of thought). Oh if anyone feels like thinking this through, how bad do you guys think this hack could have turned out if deployed by a malicious group? Paypal is pretty walled in with various limits, fraud checks, frozen accounts, multi-day bank transaction processing, reversible transactions, partnerships with banks to do chargebacks there, and they do KYC on every account. The offramps are therefore pretty limited unless you completely expose your identity. Of course they could buy a ton of stuff online, but how anonymous would the shipping be, and what could you buy with Paypal that would be liquid enough, would ship quickly and could be received fairly anonymously (you don't want to use this hack and end up with 100 playstations and on 3-day shipping to your own home and have police arrive before the goods do!). I wonder what the best plan of action would be, I can't really come up with any solid way to actually walk away, anonymously, with a ton of money but surely there must be one. Indulge me if you want!

olemoudi 12y ago
Attacking company reputation is more valuable than any stuff you manage to buy with a bug like this. You just need to snatch some transactions from enough people and leak the story to the media. You do not actually need to monetize those transactions.
- BHSPitMonkey 12y ago
  Valuable to a small handful of competing corporate interests, maybe, but useless to the rest of us. What are you suggesting, that Amazon might agree to funnel you a large sum of money under the table in return for divulging something like this?
  - jclarkcom 12y ago
    As a thought exercise - I suppose you could short eBay stock and then leak the information underground. I don't think this would be considered insider info by the SEC and if you let other people do the actual stealing from accounts you haven't violated laws in that regard. When paypal finally discovers the problem and fixes it, you inform the media what happened (assuming paypal doesn't fess-up) and then buy back your shorted stock after the inevitable drop in stock price. Maybe someone with more knowledgeable could comment if if/where this might be illegal?
    - tempestn 12y ago
      Since you could time the release of the news, put options with relatively short expiry could get you a much larger windfall than shorting the stock. Regardless though I'm sure this would be illegal in several ways. Even if you don't hack them yourself, you're going to be responsible for sharing the info. (And if you're just worried about getting caught, I wouldn't be surprised at all if the FBI looks at suspicious trading surrounding an incident like that, which might be all that's needed to start them on your trail.)
    - IkmoIkmo 12y ago
      I'd assume there's rules against this sort of stuff, perhaps falling under bigger items like aiding and abetting in a crime. And I'd definitely assume it'd be considered insider trading. But it's a very clean way. There aren't really any direct traces to you as you didn't enter into any actual agreement or conversations with anyone. You'd just dump information one sided, that's pretty easy to do anonymously. And if you look at the volume of trade on eBay, it'd be very unlikely they'd be able to pinpoint who was the source of the hack based on trading alone, if they even look for a link between traders and the hack in the first place. And even if they can reasonably say it might be you cause you just shorted $250k out of the blue (still puny volume for a stock like this), there'd be no way to prove anything else. The biggest issue I'd say is having been tracked by server logs while finding out about the security leak. As for whether it's a good plan... I wouldn't take it myself if I was evil. First it's probable that wherever you leak it underground to, will go to Paypal and collect a bounty. It'd be a quick fix probably in a span of mere hours after they become aware of it. It wouldn't show up on the price charts much if at all, I mean this story went pretty unreported, right? Even if you put of $100k, the price may drop 1-3%, that's peanuts for an opportunity like this, and it requires a shitton of spare money. Even if you leverage it, you might just coincide it with some big news. For example, since he reported the bug publicly, the price has risen by 9-10%. If you shorted that with leverage, ouch. Safe but not very effective I think, good try in any case!
peteretep 12y ago
Their bug bounty is $10k, plus you get to talk about it, plus you don't go to jail. That's a pretty compelling package when compared to the $100k but your suspicious activity is forwarded to the cops.
- Kalium 12y ago
  And at $100k, there would be a lot fewer people taking the jail-and-silence risk.
- logn 12y ago
  Plus you don't have to figure out how to hide $100K on your taxes.
  - toolz 12y ago
    I personally would take the 10k because the reputation from finding a bug like this alone is worth more than that, but pretending I wanted to go black market, I can't imagine it would be particularly hard to launder money as long as you paid the taxes that came with that money.
- kenrikm 12y ago
  Or you sell the exploit to some organized crime ring and are not the one on the hook for the actual attack. Not that I agree with that, however my point is that there are people out there that purchase exploits like this.
- lotsofmangos 12y ago
  You could probably make a lot more from a government agency and still not go to jail - http://readwrite.com/2012/10/04/the-shadowy-world-of-selling-software-bugs-and-how-it-makes-us-all-less-safe http://readwrite.com/2012/10/04/the-shadowy-world-of-selling...
tempestn 12y ago
I expect for most people^, their moral codes would be more of an obstacle to exploiting this than the fear of getting caught, but I still agree with you that $10k sounds low and that there should perhaps be an exception to the maximum for bugs of this severity. As far as the best way to remove money from the system, I would think the first step would be buying bitcoins with paypal (perhaps from a bunch of different localbitcoins sellers), then using a mixing service to anonymize them, and hold onto them for a reasonably long period of time before spending. I haven't looked into it in any detail myself, but I'm sure there are "best practices" out there for anonymizing your bitcoin transactions. ^I should clarify that I would be one of those people! That doesn't make the intellectual exercise of thinking through how one would pull it off less interesting though.
- qnr 12y ago
  > I would think the first step would be buying bitcoins with paypal This is where your plan fails. Since it is very easy to rollback the payment with paypal, no one is going to sell you bitcoins in exchange for it, except for tiny amounts. If you look at localbitcoins for example, there are very few sellers who accept paypal, all of them limit trades to very small amounts (mostly $100-200) and require high feedback scores and some form of KYC Excerpt from one of the offers: "Due to previous fraudulent transactions. I can only sell you bitcoin via PayPal if you take a photo of yourself holding valid U.S. government issued ID where your face matches the photo. "
  - tempestn 12y ago
    Ah, I see. Didn't realize it was that easy to reverse Paypal transactions (and I've obviously never tried to buy BTC with Paypal.) Back to the drawing board I guess! Any online casinos still take Paypal?
- IkmoIkmo 12y ago
  Don't think that this one will get you too far. Buying any significant amount of bitcoin using Paypal is next to impossible, unless you're a highly trusted party (e.g. friends or family or a reputable business like SecondMarket, but they wouldn't use Paypal anyway). It pretty much doesn't happen (apart from scams where a scammer will try to buy from unsuspecting users, then reverse the Paypal transaction and then lie to Paypal pretending they didn't buy anything. Paypal will side with the bad guy in 999/1000 cases, not because they're evil but it's policy. In fact, paypal shuts down bitcoin sellers by freezing their account.
downandout 12y ago
Paypal Prepaid cards [1] are available instantly at retailers nationwide. You buy a physical card for ~$5 and can do instant PayPal loads of up to $300 each day with a monthly rolling limit of $2,000. You can literally take these cards to ATM's and get cash. In my experience the non-instant loads - up to $7500 - take less than 24 hours to post to the card even though it says 3-5 business days. So, you buy some Paypal Prepaid cards, activate them and setup PayPal accounts with info bought from hacker forums, transfer money from hacked accounts to the new accounts, and use both the instant and regular Paypal load feature to load the PayPal prepaid cards to get as much cash out as possible. That card as a $940/day ATM limit, so even with 10 or 20 of them you're talking about real money for most of these criminal types. I wouldn't do this obviously, but you asked how someone might take advantage of it. [1] https://paypal.com/prepaid https://paypal.com/prepaid
- IkmoIkmo 12y ago
  >> USA PATRIOT Act — IMPORTANT INFORMATION ABOUT PROCEDURES FOR OPENING A NEW CARD ACCOUNT: To help the government fight the funding of terrorism and money laundering activities, federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens a Card Account. What this means for you: When you open a Card Account, we will ask for your name, address, date of birth, and other information that will allow us to identify you. We may also ask to see a copy of your driver's license or other identifying documents. I also wonder if they have some verification on these cards before they're activated. (e.g. the card activation number is sent to your fake address.) It'd definitely be a solid plan IF you could create identifying documents based on stolen identities you can buy online that can fool a 17-year old cashier at a retailer, like an ID card. This is probably not trivial, but very far from impossible. And then use those cards without having to connect them to a verified Paypal account and without needing to activate the card. Nice idea! Would need a ton of prep though if you want to walk away with more than $10k. If I had to choose (as an evil person, say) I'd still take the bounty over this idea.
  - downandout 12y ago
    You can buy the cards at retail with no ID at all. When you get home, you need to activate the card online. To do that all you need is a valid DOB/SSN/address/name combination (checked against credit header file info). They only ask for copies of ID's etc. if their online activation system can't automatically verify the info through the credit bureaus. Fortunately, full profiles with this info are available on the cheap on Russian hacker forums (less than $5 per record). They do send a permanent card in the mail about 10 days after activation, but the temporary one bought in the store and activated online is all you need to take cash from ATM's. By the time the permanent card arrived at the address you used to activate it, you would have long been done using the account.
deleted 12y ago
[deleted]

olemoudi 12y ago

Attacking company reputation is more valuable than any stuff you manage to buy with a bug like this. You just need to snatch some transactions from enough people and leak the story to the media. You do not actually need to monetize those transactions.

BHSPitMonkey 12y ago
Valuable to a small handful of competing corporate interests, maybe, but useless to the rest of us. What are you suggesting, that Amazon might agree to funnel you a large sum of money under the table in return for divulging something like this?
- jclarkcom 12y ago
  As a thought exercise - I suppose you could short eBay stock and then leak the information underground. I don't think this would be considered insider info by the SEC and if you let other people do the actual stealing from accounts you haven't violated laws in that regard. When paypal finally discovers the problem and fixes it, you inform the media what happened (assuming paypal doesn't fess-up) and then buy back your shorted stock after the inevitable drop in stock price. Maybe someone with more knowledgeable could comment if if/where this might be illegal?
  - tempestn 12y ago
    Since you could time the release of the news, put options with relatively short expiry could get you a much larger windfall than shorting the stock. Regardless though I'm sure this would be illegal in several ways. Even if you don't hack them yourself, you're going to be responsible for sharing the info. (And if you're just worried about getting caught, I wouldn't be surprised at all if the FBI looks at suspicious trading surrounding an incident like that, which might be all that's needed to start them on your trail.)
  - IkmoIkmo 12y ago
    I'd assume there's rules against this sort of stuff, perhaps falling under bigger items like aiding and abetting in a crime. And I'd definitely assume it'd be considered insider trading. But it's a very clean way. There aren't really any direct traces to you as you didn't enter into any actual agreement or conversations with anyone. You'd just dump information one sided, that's pretty easy to do anonymously. And if you look at the volume of trade on eBay, it'd be very unlikely they'd be able to pinpoint who was the source of the hack based on trading alone, if they even look for a link between traders and the hack in the first place. And even if they can reasonably say it might be you cause you just shorted $250k out of the blue (still puny volume for a stock like this), there'd be no way to prove anything else. The biggest issue I'd say is having been tracked by server logs while finding out about the security leak. As for whether it's a good plan... I wouldn't take it myself if I was evil. First it's probable that wherever you leak it underground to, will go to Paypal and collect a bounty. It'd be a quick fix probably in a span of mere hours after they become aware of it. It wouldn't show up on the price charts much if at all, I mean this story went pretty unreported, right? Even if you put of $100k, the price may drop 1-3%, that's peanuts for an opportunity like this, and it requires a shitton of spare money. Even if you leverage it, you might just coincide it with some big news. For example, since he reported the bug publicly, the price has risen by 9-10%. If you shorted that with leverage, ouch. Safe but not very effective I think, good try in any case!

peteretep 12y ago

Their bug bounty is $10k, plus you get to talk about it, plus you don't go to jail. That's a pretty compelling package when compared to the $100k but your suspicious activity is forwarded to the cops.

Kalium 12y ago
And at $100k, there would be a lot fewer people taking the jail-and-silence risk.
logn 12y ago
Plus you don't have to figure out how to hide $100K on your taxes.
- toolz 12y ago
  I personally would take the 10k because the reputation from finding a bug like this alone is worth more than that, but pretending I wanted to go black market, I can't imagine it would be particularly hard to launder money as long as you paid the taxes that came with that money.
kenrikm 12y ago
Or you sell the exploit to some organized crime ring and are not the one on the hook for the actual attack. Not that I agree with that, however my point is that there are people out there that purchase exploits like this.
lotsofmangos 12y ago
You could probably make a lot more from a government agency and still not go to jail - http://readwrite.com/2012/10/04/the-shadowy-world-of-selling-software-bugs-and-how-it-makes-us-all-less-safe http://readwrite.com/2012/10/04/the-shadowy-world-of-selling...

tempestn 12y ago

I expect for most people^, their moral codes would be more of an obstacle to exploiting this than the fear of getting caught, but I still agree with you that $10k sounds low and that there should perhaps be an exception to the maximum for bugs of this severity. As far as the best way to remove money from the system, I would think the first step would be buying bitcoins with paypal (perhaps from a bunch of different localbitcoins sellers), then using a mixing service to anonymize them, and hold onto them for a reasonably long period of time before spending. I haven't looked into it in any detail myself, but I'm sure there are "best practices" out there for anonymizing your bitcoin transactions. ^I should clarify that I would be one of those people! That doesn't make the intellectual exercise of thinking through how one would pull it off less interesting though.

qnr 12y ago
> I would think the first step would be buying bitcoins with paypal This is where your plan fails. Since it is very easy to rollback the payment with paypal, no one is going to sell you bitcoins in exchange for it, except for tiny amounts. If you look at localbitcoins for example, there are very few sellers who accept paypal, all of them limit trades to very small amounts (mostly $100-200) and require high feedback scores and some form of KYC Excerpt from one of the offers: "Due to previous fraudulent transactions. I can only sell you bitcoin via PayPal if you take a photo of yourself holding valid U.S. government issued ID where your face matches the photo. "
- tempestn 12y ago
  Ah, I see. Didn't realize it was that easy to reverse Paypal transactions (and I've obviously never tried to buy BTC with Paypal.) Back to the drawing board I guess! Any online casinos still take Paypal?
IkmoIkmo 12y ago
Don't think that this one will get you too far. Buying any significant amount of bitcoin using Paypal is next to impossible, unless you're a highly trusted party (e.g. friends or family or a reputable business like SecondMarket, but they wouldn't use Paypal anyway). It pretty much doesn't happen (apart from scams where a scammer will try to buy from unsuspecting users, then reverse the Paypal transaction and then lie to Paypal pretending they didn't buy anything. Paypal will side with the bad guy in 999/1000 cases, not because they're evil but it's policy. In fact, paypal shuts down bitcoin sellers by freezing their account.

downandout 12y ago

Paypal Prepaid cards [1] are available instantly at retailers nationwide. You buy a physical card for ~$5 and can do instant PayPal loads of up to $300 each day with a monthly rolling limit of $2,000. You can literally take these cards to ATM's and get cash. In my experience the non-instant loads - up to $7500 - take less than 24 hours to post to the card even though it says 3-5 business days. So, you buy some Paypal Prepaid cards, activate them and setup PayPal accounts with info bought from hacker forums, transfer money from hacked accounts to the new accounts, and use both the instant and regular Paypal load feature to load the PayPal prepaid cards to get as much cash out as possible. That card as a $940/day ATM limit, so even with 10 or 20 of them you're talking about real money for most of these criminal types. I wouldn't do this obviously, but you asked how someone might take advantage of it. [1] https://paypal.com/prepaid https://paypal.com/prepaid

IkmoIkmo 12y ago
>> USA PATRIOT Act — IMPORTANT INFORMATION ABOUT PROCEDURES FOR OPENING A NEW CARD ACCOUNT: To help the government fight the funding of terrorism and money laundering activities, federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens a Card Account. What this means for you: When you open a Card Account, we will ask for your name, address, date of birth, and other information that will allow us to identify you. We may also ask to see a copy of your driver's license or other identifying documents. I also wonder if they have some verification on these cards before they're activated. (e.g. the card activation number is sent to your fake address.) It'd definitely be a solid plan IF you could create identifying documents based on stolen identities you can buy online that can fool a 17-year old cashier at a retailer, like an ID card. This is probably not trivial, but very far from impossible. And then use those cards without having to connect them to a verified Paypal account and without needing to activate the card. Nice idea! Would need a ton of prep though if you want to walk away with more than $10k. If I had to choose (as an evil person, say) I'd still take the bounty over this idea.
- downandout 12y ago
  You can buy the cards at retail with no ID at all. When you get home, you need to activate the card online. To do that all you need is a valid DOB/SSN/address/name combination (checked against credit header file info). They only ask for copies of ID's etc. if their online activation system can't automatically verify the info through the credit bureaus. Fortunately, full profiles with this info are available on the cheap on Russian hacker forums (less than $5 per record). They do send a permanent card in the mail about 10 days after activation, but the temporary one bought in the store and activated online is all you need to take cash from ATM's. By the time the permanent card arrived at the address you used to activate it, you would have long been done using the account.

deleted 12y ago

[deleted]