PayPal denies teenager reward for finding website bug

http://www.pcworld.com/article/2039940/paypal-denies-teenager-reward-for-finding-website-bug.html

by uladzislau • 13 years ago

124 61 13 years ago

ionforce• 13 years ago

I love the fact that he wanted at least a letter of verification for future job prospects. Future thinking kid! And, he has a history with Microsoft and Mozilla, and he's only 17!

I love it.

mikerastiello• 13 years ago

This is a good example of how to turn a good hacker into a bad hacker.

dspillett4• 13 years ago

Facebook to all those under 18: if you find a flaw in our site, sell the information to the black-hats as you mean nothing to us.

Of course there might be legal reasons for excluding those below a certain age (though 18 seems high for this boundary) as they don't want their offer to be seen as employing minors.

andyakb• 13 years ago

...this isn't facebook

dspillett4• 13 years ago

Sorry, I was discussing both companies in another forum just before coming over here. My poor little brain skipped track and had me type the wrong name...

objclxt• 13 years ago

Facebook? We're talking about PayPal here. Facebook's vulnerability program requires you just not be in a country subject to US sanctions (and presumably be over 13, the age you need to be to have a Facebook account in the first place).

blairbeckwith• 13 years ago

No reason you'd need a Facebook account to find some exploits.

dspillett4• 13 years ago

Sorry, I've been commenting on both companies in another forum and my brain skipped track there.

For any company that offers bounties, my points are still relevant: not handing the out to a subset could encourage that subset to look for reward elsewhere, and the perception of labour use could be an important consideration.

peterkelly4• 13 years ago

How is it employment if someone simply does some work through their own choice without having any sort of formal employment relationship in place?

dspillett4• 13 years ago

I'm not saying it is, just that it might be perceived to be.

Public relations has nothing to do with true facts, it has everything to do with how people interpret the details they see. If someone does mis-interpret and get on their high horse, others will join in without checking the facts themselves and it can be a nightmare trying to point out the truth of the matter over all that noise.

theboss• 13 years ago

No surprise here. I posted my thoughts about this on reddit, as someone who has dealt with paypal and their bug bounty program.

They will do anything they can to say the vulnerability is out of scope. Even some heinous vulnerabilities.

It's quite tragic paypal wants to discourage responsible disclosure when one incident will cost them their reputation.

6d0debc071• 13 years ago

What reputation? As far as I can tell they only manage to stay in business because banking laws are really perverse so competition's effectively non-existent if you want to do business with the US.

chris_wot4• 13 years ago

Emailing the link http://paypal.com is NOT something you'd generally give a bug reward for. Like shooting fish in a barrel.

twistedpair• 13 years ago

Hmmm... which they redirect to the https:// site. How do you hack this exactly? MITM before the redirect?

chris_wot4• 13 years ago

The bug is actually the man himself, who uses PayPal.

alt_• 13 years ago

Original seclist discussion from yesterday: https://news.ycombinator.com/item?id=5771647

benawabe896• 13 years ago

Looks like PayPal is trying hard to take EA's crown.

chris_wot4• 13 years ago

They took it some time ago.

wladimir• 13 years ago

Yet another Paypal PR disaster, they're good at spinning everything in the worst possible way. What are they trying to do, get some award for world's least popular company?

gngeal• 13 years ago

TL;DR: If you find an exploitable bug in a high-profile web site and discover that you're ineligible for a bug bounty, sell it to the bad guys instead. They won't treat you like s##t. ;-)

JimJames2• 13 years ago

Out of curiosity, would it be illegal to do that? I mean ethically it's definitely wrong, and I'm sure it's illegal to sell it to someone if you know they are going to try and exploit it for profit, is there a technical loophole to hide behind?

Say, you sell it to someone and to the best of your knowledge they want to claim the reward for themselves. To justify the increased price you received by selling it to a third party instead of submitting it for the bug reward you could say that the third party intends to claim the bug as his own work and the professional cred they'll receive justifies the increased price.

mischanix• 13 years ago

It's only illegal if you're caught.

peterkelly4• 13 years ago

Well, the US government buys exploits from people [1], which means it must be legal in the US. The government would never do anything against the law, right?

[1] http://www.techrepublic.com/blog/security/guess-whos-buying-...

trotsky• 13 years ago

It's not actually illegal to sell an exploit in most municipalities. You can be potentially charged with conspiracy if it applies in the case.

afreak2• 13 years ago

Companies like Vupen exist solely based on the development of exploits for profit.

markdown• 13 years ago

Sounds like it would be protected free speech akin to:

"Hey, that building has a broken window."

IANAL.

JimmaDaRustla2• 13 years ago

You need a PayPal account to be eligible for a bounty, which he does not because you must be 18 to own a PayPal account.

I have a few friends who work for PayPal support; apparently under 18 customers who put in a fake date of birth call all the time because they can't setup a bank account to receive their money (usually from minecraft server donations).

stefs• 13 years ago

he did provide a paypal account that wasn't his own, but his parents - who are his legal guardians.

either way, paypal is indeed handling this in the worst way possible.

peterkelly4• 13 years ago

Paypal could have paid him via other means, if that was the only issue.

tantalor• 13 years ago

When he turns 18 and create a legit account, can he claim the bounty?

JimmaDaRustla2• 13 years ago

I would hope so! Or they're just complete bastards.

I'm agreeing with everyone else - the work done is not dependent on age, nor is the payment of the gratuity, so give him the dough he deserves and quit embarrassing yourself PayPal!

driverdan• 13 years ago

PayPal's bounty system is a joke. Someone told me that he found a PP admin login page that was vulnerable to SQLi. He notified PP but wasn't rewarded and the bug hadn't been fixed when he checked it a month later. This was last year.

batgaijin• 13 years ago

What about that bullshit regulation that credit processors have to pass? Doesn't that have a clause about timely response/mitigations of reported bugs/flaws?

orphz• 13 years ago

From what I heard, PayPal exists in the gray area between merchants and banks.

Correct me if I'm wrong, but I don't believe that have to do... well, anything. They could shut down tomorrow and take all the money and it would be perfectly legal.

meritt• 13 years ago

They'd just lock down his account for suspicious activity as soon as they paid him, anyway.

300bps• 13 years ago

If Dwolla, Skrill or another PayPal competitor is paying attention they might be wise to pay the kid a bounty in the interest of "improving the integrity of transactions on the web" even if it improved the security of their main competitor.

Would do right by the kid and would tremendous free publicity for the companies looking to supplant PayPal.

will_brown• 13 years ago

You clearly understand the value of good PR more than most, certainly more than PayPal...Something like that might make me consider closing my PP account for a competitor.

joshdance• 13 years ago

+1 to that. Dwolla should hire him for a brief spell and pay the bounty PayPal denied.

denzil_correa• 13 years ago

PayPal seriously?!! I think you can pay him after he turns 18 and keep holding the amount (with interest of course) by that time.

Kiro• 13 years ago

Off-topic but I thought XSS was about injecting JS which other users can see. Is this really a vulnerability and not just a bug?

d3c0d3dab0d3• 13 years ago

If you can inject JS then you can steal session cookies. Other stuff too, but XSS is a big deal.

1SaltwaterC• 13 years ago

How many actual users suspect that something is wrong with the input, even without URL obfuscation? OTOH, with a permanent XSS it is pretty much game over, even though I doubt that's the case. XSS can do a lot of damage if used properly.

auctiontheory• 13 years ago

No one seems to like PayPal. I'm surprised Amazon Payments and Google Checkout haven't made more headway.

afreak2• 13 years ago

https://support.google.com/checkout/sell/answer/3080449?hl=e...

Considering Google is retiring checkout, there are not many players out there.

fooqux• 13 years ago

That's not that big a deal. They're basically just retiring the name- Google Wallet will be taking over and merchants can use it in much the same way.

alan_cx• 13 years ago

I have not looked, but can you use those two for eBay purchases and sales? I suspect that many stay using paypal because they want to use eBay.

I had to stop using ebay because of problems with paypal. Tried solving it for a few months, but gave up.

ck2• 13 years ago

As previous seen: https://news.ycombinator.com/item?id=5771647

(but good to see again)

yoster• 13 years ago

They could have at least given him Paypal credit or a giftcard. This company is fucking bullshit. Give the kid a donation to his college fund.

ssharp• 13 years ago

I'd imagine before someone reports a vulnerability, they're likely to research the company's history in dealing with reports. You don't want to openly reduce the incentives you give to people to report exploits instead of selling them. So PayPal deals with this exploit without it affecting their users, but their users now prone to be exploited in the future.

PayPal denies teenager reward for finding website bug

Related Stories