- Jan 24, 2011
- 9,378
Until Egyptian cyber-security researcher Yasser Ali found it and reported it to PayPal, there was a security hole that meant 150 million-plus customers were one measly click away from account hijacking.
Ali said in a blog post that the "critical vulnerability" meant an attacker could hijack any PayPal user account and have their way with it, including but not limited to the ability to:
Ali also showed how it's done in this proof of concept video.
The researcher said that the exploit was enabled by a cross-site request forgery (CSRF) - also known as a "session riding" - flaw. Such an exploit provides a way for malicious website X to retrieve data that is only supposed to be revealed when you visit site Y.
All it would have taken, he said, was to convince a target to click a link, which is simple enough with a little help from social engineering: for example, by sending a link via email or chat.
Ali's now $10,000 (£6,380) richer, having bagged the top payout in PayPal's bug bounty program.
He said in his advisory that the captured authentication token his exploit managed to obtain was valid for all PayPal accounts.
A spokesperson said that the company hasn't detected any evidence of accounts having been compromised.
From the statement:
Read more https://nakedsecurity.sophos.com/2014/12/05/all-paypal-accounts-were-1-click-away-from-hijacking/
Ali said in a blog post that the "critical vulnerability" meant an attacker could hijack any PayPal user account and have their way with it, including but not limited to the ability to:
- Add/remove/confirm email address
- Add fully privileged users to a business account
- Change security questions
- Change billing/shipping address
- Change payment methods
- Change user settings (notifications/mobile settings)
Ali also showed how it's done in this proof of concept video.
The researcher said that the exploit was enabled by a cross-site request forgery (CSRF) - also known as a "session riding" - flaw. Such an exploit provides a way for malicious website X to retrieve data that is only supposed to be revealed when you visit site Y.
All it would have taken, he said, was to convince a target to click a link, which is simple enough with a little help from social engineering: for example, by sending a link via email or chat.
Ali's now $10,000 (£6,380) richer, having bagged the top payout in PayPal's bug bounty program.
He said in his advisory that the captured authentication token his exploit managed to obtain was valid for all PayPal accounts.
After a deep investigation I found out that the CSRF auth is reusable for a specific user email address or username.
This means attackers who found any of these CSRF tokens can [imitate] any logged in user.
[Attackers] can obtain the CSRF auth by intercepting the POST request from a page that provides an auth token before the logging-in process.
PayPal confirmed the bug to Vulture South - also known as The Register's Asia-Pacific bureau.This means attackers who found any of these CSRF tokens can [imitate] any logged in user.
[Attackers] can obtain the CSRF auth by intercepting the POST request from a page that provides an auth token before the logging-in process.
A spokesperson said that the company hasn't detected any evidence of accounts having been compromised.
From the statement:
Through the PayPal Bug Bounty Program, one of our security researchers recently made us aware of a way to bypass PayPal's Cross-Site Request Forgery (CSRF) Protection Authorization System when logging onto PayPal.com. Our team worked quickly to address this vulnerability, and we have already fixed the issue.
Read more https://nakedsecurity.sophos.com/2014/12/05/all-paypal-accounts-were-1-click-away-from-hijacking/
