(debunked) PayPal vulnerability allows access to any account within 30 seconds

http://thenextweb.com/industry/2011/06/16/paypal-vulnerability-allows-access-to-any-account-within-30-seconds/

by dwynings • 15 years ago

142 53 15 years ago

zheng2• 15 years ago

Seems to be fixed, if not I'm missing something and need to wipe my account. Can anyone verify?

dangrossman4• 15 years ago

How do you know if this is fixed or not? The article didn't provide any details about the exploit beyond saying there's a bug in the e-mail system for password recovery.

zheng2• 15 years ago

Well, the article said "any paypal account", and I can't get it to send a reset token to an unauthorized email, so at the least it seems that either the claim was wrong, or they fixed it.

yeahsure• 15 years ago

It would be great if the article had a proof of concept (or at least a more detailed explanation). I don't feel like doing it myself to verify if it's true, and put my account at risk at the same time.

zbanks• 15 years ago

There's no reason to publicly describe the attack. Even if you weren't planning on being evil, it would be incredibly easy to abuse.

muppetman• 15 years ago

This is rather scary.

Surely my bank would notify me though if my credit card started getting hammered. I don't suppose I'm the target thieves would be looking for though, it'd be those with large balances sitting in their account.

The article is rather light on details though, I wonder just how true it really is. That said, they have nothing to gain (other than impressions) for running it.

VladRussian• 15 years ago

may be using that exploit i'd finally be able to get back access to my account that i set up with my previous work email address and forgot to update before i left the company and lost the access to the email address.

noonespecial3• 15 years ago

Heh. You should suggest that to paypal's tech support so we can get a bugfix in faster. They might care a great deal more about you getting your stranded money back than crackers stealing users cash...

redsymbol• 15 years ago

I don't have any information about this other than what's in the article. However, as a proactively paranoid precaution, I've chosen to temporarily de-associate my company's bank account from its paypal account, just to make it impossible for an attacker to drain those funds.

I know that if this does turn out to be a legit security issue, Paypal's engineers will soon deploy a fix, after which I will just re-associate it.

The procedure is:

  1) log into your paypal account
  2) click "profile"
  3) Click on "My Money"; or if you don't see that, look for the subheading "Financial Information" and click "Bank accounts"
  4) You should see a link for the bank account; select it
  5) click "Remove"
  6) *confirm* on the next screen (be sure to click that "confirm remove" button)
  7) See the confirmation message

That's it. Depending on your Paypal balance, you may want to try transferring funds into the account before dissociating. [EDIT: Or maybe not, sounds like it could block the disassociation procedure - check the comments below.] I don't know if you can do both in sequence quickly; fortunately our paypal balance happened to be really low today.

noonespecial3• 15 years ago

This seems prudent. From what I can see in our account, its a single passwordless click to empty the associated account into the paypal once you have the paypal password. (probably right up to the limit of the so-called "overdraft protection" on the bank account)

I was always more afraid of paypal itself being able to get at the mandatory associated bank account so we created a special account just to link to paypal. Its kept mostly empty most of the time.

It was hell-and-a-half to get the bank to turn off the "overdraft protection" on the account.

thaumaturgy2• 15 years ago

It won't let me do this at the moment because a withdrawal is already pending.

dangrossman4• 15 years ago

I'm actually more afraid of delinking then relinking a bank account setting off some kind of red flag at PayPal's risk department than losing the balance of a bank account. PayPal's the preferred way to pay for millions of people, losing access to it forever as a business may be worth more than my current linked assets.

thaumaturgy2• 15 years ago

Man, I seriously hope I never find my business relying so heavily on another business that I mistrust that much. That would keep me awake at night.

kahawe2• 15 years ago

Is there a way of having one's account completely deleted from paypal by request? Through the support website? I only found a link for "close account" and I cannot use it since my account has been "limited" and I have no interest in sending paypal even more of my personal information like copy of passport and what not.

urlwolf• 15 years ago

I just did this, but it tells me they cannot close the account because there's a transaction open. I bought a domain yesterday. This is with the German paypal, and a German bank, which are known to be the among the most retrograde and cumbersome. Does anyone have a workaround?

dangrossman4• 15 years ago

Mr. Langley posted screenshots and additional information on Namesake earlier today:

http://namesake.com/conversation/mattlangley/i-just-accident...

Among other interesting tidbits: "All users are potentially vulnerable, but users of free email services are the most vulnerable, for reasons that I won't divulge until Paypal have fixed it."

caf• 15 years ago

That implies that it's easier to get the password change email sent to an address with a different local part at the same domain than to a completely different domain.

jfriedly• 15 years ago

He also noted:

  @Alex Khomenko told me in another place, that there may be
  a secondary authentication on password changes from the
  forgotten password link, in the US PayPal. If true and
  currently in place this would mean that the US is not
  vulnerable, although they may still have the email bug

He said he doesn't use PayPal himself and that he only requested a change password link when he was trying to contact them about "effective spam". Perhaps he supplied them with one of his email addresses and it happened to have a counterpart at a different subdomain (like example@email.com vs example@email.com.au)?

EDIT: Formatting.

nplusone• 15 years ago

The opening statement (and URL) of this post is rather interesting: "I just accidental hacked PayPal" followed by "it took 30 seconds and I had total access to someone else's account".

ssclafani• 15 years ago

For US accounts, PayPal requires a person to verify the security question on the account if one was set or the credit/debit card number before being able to change the password.

sanxiyn• 15 years ago

I suspect it may have to do with RFC 822 arcana. There are a lot of ways to encode the same email address.

crag• 15 years ago

Just how serious is this? Is this just some guy who stumbled on a hack and can't repeat it? Or is this some fundamental flaw in Paypals security.

In other words, do I need to worry about my Paypal account? My account is link to a checking account and cc.

ltamake• 15 years ago

Well done, PayPal. Well done. The one thing that I don't need compromised... :(

kahawe2• 15 years ago

Well, at least Mr Francis Tan and thenextweb.com won't have to worry about their accounts' safety anymore... since they will definitely get frozen ASAP.

moeffju• 15 years ago

Seeing how he and the guy he hacked are both on gmail, I would guess that this might be a case of "mjfoo is the same as m.j.foo", or a gmail account that had been deleted before, but is still associated with a Paypal account. Paypal exist because of fraud detection and working security. If they had singe stupid bug like unescaped wildcards or something, that would be quite a shadow cast on their one main selling point.

d_r• 15 years ago

At least no one can say that PayPal is ever lax on security. This vulnerability, if it exists, could be more of an honest developer mistake.

I was recently travelling abroad, and decided to buy Glyphish icons to finish an app I was working on. This proved to be tough. Upon logging in to my PayPal account, I got locked out.

"We want to check with you to make sure that no one has logged in to your account without your permission."

My account now states that it is "limited" and has some drivel about me having to send my driver license/passport/etc. copies to re-enable my account. I understand that this is all in the name of security, but really, I wish they didn't use such heavy-handed one-size-fits-all measures.

mukyu• 15 years ago

The post has been updated to state that this was debunked, though there are no details.

mikemaccana• 15 years ago

NOTE: According to the source, this has now been debunked.

zemaj• 15 years ago

Updated. Doesn't looks like a huge issue, although obviously needs to be fixed;

"It seems that the 'victim' had opened an account using an email address of mine, with extra characters thrown in, which Gmail ignores and accepts as the same email address, so it was gmail which uncorrupted the email address and sent the emails to me, not Paypal. I had previously reported an account set-up with fraudulent email address to Paypal many times in the past, but only yesterday noticed that the email address was different to mine, in a way which on any other email system in the world would be a different email address."

From http://namesake.com/conversation/mattlangley/i-just-accident...

topbanana• 15 years ago

Update: "It seems that the 'victim' had opened an account using an email address of mine, with extra characters thrown in, which Gmail ignores and accepts as the same email address, so it was gmail which uncorrupted the email address and sent the emails to me, not Paypal. I had previously reported an account set-up with fraudulent email address to Paypal many times in the past, but only yesterday noticed that the email address was different to mine, in a way which on any other email system in the world would be a different email address."

arn• 15 years ago

Appears this is a non-issue. For those who have been following. Matt Langley (the person who "discovered" the issue) has been posting updates here:

http://namesake.com/conversation/mattlangley/i-just-accident...

Relevant post:

Cheeky bugger. I'm gonna have to ask them to close it down or at least change the email address.

but I guess I owe you all an apology" - Matt Langley

edit: someone else posted this too.

so, some commentary. This should have been verified before posting, as it has caused some trouble for people who delinked their account etc. That said, I understand the rapid news cycle of blogging, though with something this potentially serious, I would think it would need to be verified.

Side note, first time I'd seen Namesake and it's kinda cool. Wish I could search.

andypants2• 15 years ago

When you sign up for a gmail address, all dot variations of the email address belong to you. So if you have andzdroid@gmail.com, then emails to andz.droid@gmail.com will also go to you, and a.n.d.z.d.r.o.i.d@gmail.com will also go to you.

What happened to the OP is that somebody signed up using a variation of his email. Obviously, if I signed up at paypal with YOUR email address, you'd start receiving MY paypal emails.

There is no vulnerability. Only stupid people signing up with other peoples' emails.

zeedotme3• 15 years ago

he's receiving emails from a fraudulent account that was set up with his email address but with a "." in it. I can't see the vulnerability there but it is important to point out. Paypal should be aware that Gmail allows it. I just created 3 different paypal accounts with the three different email addresses that only differ by the position of the dot.

MattLangley6• 15 years ago

Yup, that's about the size of it.

staktrace• 15 years ago

You can also tack on a +<anything> to your gmail. So if you have example@gmail, you also own example+foo@gmail, example+bar@gmail, and so on.

ja27• 15 years ago

But there continue to be reports that GMail has some issues with the dots where andzdroid@gmail.com and andz.droid@gmail.com can be two different accounts:

http://www.google.com/support/forum/p/gmail/thread?tid=60cbf... http://www.google.com/support/forum/p/gmail/thread?tid=2d9f3...

eik3_de• 15 years ago

completely OT:

> Side note, first time I'd seen Namesake and it's kinda cool.

This reminds me of convore. Does anyone know who was first?

pama• 15 years ago

Namesake is indeed kinda cool. I created an entry for a separate discussion:

http://news.ycombinator.com/item?id=2661165

zeedotme3• 15 years ago

This is Zee from The Next Web. Just woken up to this and have personally spoken to Matt Langley the person in question who - after some convincing - explained the entire process to me.

It is indeed not a massive security vulnerability but a much smaller one. We're updating our piece as we speak and can only apologise that we published before being absolutely sure of the level of the treat.

zeedotme3• 15 years ago

So this is the gist...There is a small vulnerability because Gmail allows you to include dots in your email address, it essentially allows anyone to create multiple Paypal accounts with the same email address because Paypal recognises the inclusion of a dot as a separate email address entirely. It's seems like a flaw but not a massive security vulnerability.

Also Paypal also doesn't appear to verify email addresses on registration so anyone can create multiple accounts for the same person without any need to click a confirmation link in a verification email. Again, a flaw but not a massive security vulnerability as far as we can tell.

andypants2• 15 years ago

It's not true and it's not a 'vulnerability'.

What happened to the OP is that somebody signed up using a variation of his email. Obviously, if I signed up at paypal with YOUR email address, you'd start receiving MY paypal emails.

There is no vulnerability. Only stupid people signing up with other peoples' emails.

BasDirks• 15 years ago

Mind changing the title of this thread?

MattLangley6• 15 years ago

Don't Panic!

MattLangley6• 15 years ago

Always wanted to say this. #silverlining

MattLangley6• 15 years ago

Having slept on it, I would like to point out that I did gain complete control of someone else's account, viewed their personal information, and could have conducted transactions against any credit card or bank details they had set-up.

The reason its a non-issue is that this only happened because they set up the account with an email address they did not control, but that only became apparent later by which time this has got away from me.

khomenko• 15 years ago

Next time you think you discovered a gigantic easily exploitable security hole in a mature service that has been around for 10+ years, please think again and research it a lot more before you make a fuss about it. It's possible, of course - but not very damn likely. It's much more likely you are confused. I tried to tell Matt Langley that yesterday on Quora, but he didn't quite buy it, and now he's drinking one big mug of mea culpa. Hopefully this thing will blow over soon, but as a former employee it pains me to see PayPal having to debunk this in social media this morning.

(debunked) PayPal vulnerability allows access to any account within 30 seconds

Related Stories