Slashdot Mirror
PayPal Security Holes Expose Customer Card Data, Personal Details
mask.of.sanity writes "Dangerous website flaws have been discovered in PayPal that grant attackers access to customer credit card data, account balances and purchase histories. The holes still exist. One was publicly disclosed after a failed effort in July to responsibly disclose them under PayPal's bug bounty program. PayPal is working to close the holes."
And it's unfortunate that people sometimes consider it as safe as one. It's more like giving money to a trusted acquaintance to pay somebody for you. And about as reliable.
Paypal Europe is a Luxembourg based Bank and regulated in the EU as such.
If this bug has been known since July your failure to publically announce it has left thousands of people vulnerable for months. That is irresponsible disclosure. Responsible disclosure is immediate disclosure. Period.
Give me Classic Slashdot or give me death!
Paypal Europe is a Luxembourg based Bank and regulated in the EU as such.
I keep hearing this. Maybe they should be regulated like one, but they definitely don't behave any different over here than they do over the US. I have an account in both places (I'm Spanish but used to live in the US) so I know quite well.
Paypal STILL abuses all they want. Just the other day, I applied for a *debit* card in my US account. It was denied instantly (possibly because I did it via a Spanish IP address). My account is now under supervision, and they want proof of SSN (which I had already sent years ago), picture ID, and more. If not, well, funds on hold, account useless and so on.
In general, using your perfectly fine account from overseas will cause problems. Serious ones. It's not like they call you to check things. They just put everything on hold and ask for documentation you may not have with you, and even if you did you may not want to share with them.
could be gotten by opening up my bank statement. Address, account number, past purchases, account balance (though likely a couple of days out of date). Heck anyone walking down the street can get my address, can see previous purchases if I have my curtains open, and could use my address to find my phone number. I'd be much more worried about someone waking up to my mailbox and opening my bank statement, but only because then they're right at my door (and could come in and attack me), rather than who-knows-where viewing it on the internet. But why fear that information getting out at all? My bank account has protections against use by unauthorized people, and if I had a real credit card it would as well (personally I use prepaid credit cards which don't have such protections, but I only put on what I'm going to use). I have at least half a brain and don't leave money in paypal. So I'm not sure exactly the fear here. Paypal can't even be used for adult services, so it's not like someone is going to print out your fleshlight purchases and send it to your boss/wife/etc..
If Paypal were regulated like a bank, all similar services would be as well, and that would just raise the bar of entry and ensure no competitor ever puts up a fight against paypal. It would also eventually ensure that people that can't get a bank account or credit card for whatever reason, can't do online transactions. (I'm sorry but I am willing to take peoples' money even if they overdrew their account when they were a broke college student and ended up in Chexsystems.) Paypal sucks, but personally I NEED what it does, as do MANY other people - so either it needs to keep doing it or someone else has to start doing it better. If someone could start a service doing what it does but with all the regulations of a bank, they'd be doing it.
You can always file a class action lawsuit. Oh. Wait.
Should this not cause everyone who has a PayPal account serious concern since Discover will be issuing cards to each person with a PayPal account? Will this card number be linked to your PayPal account AND visible in your PayPal account information?
While I don't think they have started issuing cards yet, this is still a current and future problem. IF they had started issuing cards and even if you had no money in your PayPal account, they could still attempt to use the Discover number, if known, and see what they can get. If I was Discover, I'd be blowing up PayPal's phones with calls to the CEO discussing this situation - and our very reasonable consideration to kill the deal.
Dream as if you'll live forever.
Live as if you'll die tomorrow.
~Anonymous~
as long as they can Hold Funds (and basically say Not Going to Tell You Why So FOAD) they should either
1 be required to release funds by Court Order
or
2 be prosecuted under RICO laws (and any other banking fraud regs)
i wouldn't require them to hold to the entire stack of regs that a full Bank would but holding Millions of Dollars in funds for %random_reason% needs to stop NOW.
Any person using FTFY or editing my postings agrees to a US$50.00 charge
Are you sure that your problems aren't caused by regulation? I can quite easily see a regulatory requirement that they avoid international transfers between fake accounts. By opening accounts in two countries, you could easily be falling prey to such a regulation. Banks tend to be more picky about such things, not less. I once tried to cash a check while my driver's license was suspended. No go; no way. This was while I was in college, so I had student ID. Unfortunately, they wouldn't accept it.
This behavior is primarily to protect against ID theft. They work under the assumption that if someone performs account actions in a country foreign from their home address, it's reasonably likely they are not actually there and someone has stolen their account information.
Actual banks perform similar activities to prevent ID theft, which is currently rampant. Several times I have had my debit card (through a bank) frozen due to sudden account activity in another US state, not even overseas. Usually this is just a source of frustration, but one time I was very glad that it happened, since the account activity really was fraudulent.
Many years ago I disclosed a vulnerability to Ebay to get any user's email.
It took 2-3 hours to talk to their tech support and convince them that this is a serious problem. I had to show multiple examples of telling them emails of users randomly picked by tech support. Eventually they closed the hole. Within 12 hours actually, which was not too bad.
Several years later, when I had some issues with Ebay, they did not want to take that help into account.
Ebay & Paypal had so many changes over the past 5 years and pissed off a lot of people as a result. No wonder someone went public with the issues. I used to have multiple power seller accounts, and after all these changes I stopped selling there.
If I saw a vulnerability now with either ebay or paypal, I'd not bother telling them. I'd actually just wait for a story like that and laugh at them from a perspective of what goes around - comes around.
This behavior is primarily to protect against ID theft. They work under the assumption that if someone performs account actions in a country foreign from their home address, it's reasonably likely they are not actually there and someone has stolen their account information.
How the fuck is asking me to send someone I don't know at all a scanned copy of a picture ID *help* protect my ID? You really have it backwards.
If Visa, Mastercard, Amex etc are treating everyone fairly, it seems like PayPal would now be due for a major smackdown courtesy of the big-name credit card networks. I'm talking about a $10^9 order of magnitude smackdown. If I recall correctly, proper compliance means certifying a bunch of stuff under penalty of perjury, which means that PayPal is not only organizationally breaking the rules but may have individuals breaking the rules as well.
Of course, equally likely, these companies will be too worried about hurting their relationship with a big payment processor to actually do anything about it.
I am officially gone from
could be gotten by opening up my bank statement. Address, account number, past purchases, account balance (though likely a couple of days out of date)
Its not the same info if you give paypal a temporary credit card number, the sort your bank gives you through their webpage. These numbers are aliases for your real number but you get to pick the max amount to be charged and the month the card expires in. Some of these numbers even lock to the first vendor to post a charge. So if "stolen" and there is money left on the alias a 3rd party can't post a charge.
Good point. If you use paypal like that, it would give out little more info than anyone walking down your street - or anyone looking at Google maps, for those of you yelling that it's different online for some reason - can already see.
All those I get saying there's a problem with PayPal I've been discarding as spam, now I know they must be true.
And this is precisely the sort of scenario that motivated me to take PayPal up on its unusual offer to "opt out" of its new recent adjustment to its service agreement that attempts to force customers to only use singular arbitration and prohibit class actions altogether. These news clauses are all the rage in service industries; all the corporate kids are dying to get one. Valve has one, AT&T has one, and now PayPal. I'm sure there are hundreds more I don't know about or mindlessly clicked-thru. Why PayPal chose to give customers the ability to reject that clause I can't figure, but I exercised it and this incident is demonstrative why. The rest of you have until December 31st IIRC to consider the same; you aren't likely to get this choice often.
As to why these clauses are a big fucking deal, the New York Times and TechDirt both published good analyses of the Supreme Court decision last year that inspired it and the inevitable effects. It's the same Court that gave us the Citizens United ruling and others that are almost slavishly favorable to business at the expense of the common good.
This behavior is primarily to protect against ID theft. They work under the assumption that if someone performs account actions in a country foreign from their home address, it's reasonably likely they are not actually there and someone has stolen their account information.
How the fuck is asking me to send someone I don't know at all a scanned copy of a picture ID *help* protect my ID? You really have it backwards.
Picture ID is generally used as a cursory method of proving your identity. If you let someone take care of your money but aren't comfortable with them having your picture ID, then you will need to find someone besides paypal, as they aren't in the business of money laundering.
Though I do agree that it would be better if they called you to check on a suspicious transaction. Banks do this, and usually don't require as many hoops to jump through as paypal does, oddly enough.
Unfortunately, given the standard of regulation of banks in the relevant jurisdiction, that doesn't mean very much at all. In practice, you would probably still have to take legal action against them in another country if they screwed you in one of their notorious surprise moves, such as freezing your account because you irritated some automated potential fraud algorithm with an imperfect heuristic.
Unless they locked up an account belonging to a business with serious transaction volumes (and by that point they reportedly pay more attention to customer service anyway) it seems unlikely that most people would find it cost effective to go after them in court. So being regulated as a bank in Luxembourg isn't really worth much at all, except for apparently being quite effective in convincing people like the parent poster that PayPal in Europe is a safer bet than their infamous US operation.
(I am neither a lawyer nor an accountant, but I have investigated this issue from a business point of view relatively recently. At that time the legal/regulatory situation appeared to be quite clear and obviously in PayPal's favour.)
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
I use Paypal all the time on websites because of the "devil you know" philosophy. I know them. They are pretty evil, but at least I know to what extent they are evil. I'd like to sell stuff through them but well they are just too tough to deal with to make it worthwhile.
They have interfered with commerce on almost every level. Their API is pretty antiquated and full of obfuscated settings. By now I should be able to sign up to a website, give them my info, upload a virtual product, and collect money from whoever buys it.
I should NOT have to pay if someone tries to fuck them over. That's their problem. But Paypal totally ruins businesses that get targeted by chargeback scammers, to the extent that they SHOULD BE INVESTIGATED FOR FRAUD... because it's pretty likely that at least some employees in Paypal are fraudsters. This recent leak could have been an inside job.
If you ever need to dispute something with them just toss a coin. You'll never know if you'll win unless you have an agreement with them that is tested and works. But even then... who knows?
Don't try to do anything nice for anyone like collect charitable funds because you'll have a bad time.
The dangers of knowledge trigger emotional distress in human beings.
I used to work at PayPal. The article is unclear if any of the exposed data is real or fake. Generally all the QA stages have fake data. In fact I am almost sure that they all have fake data.
Every time there's a thread on PayPal people inevitably diverge into demanding "PayPal be regulated like a bank" or "PayPal is making profit on my money sitting in account's balance" or "PayPal should do this and that"... So much noise from people who know so little about what things actually are and are just looking for scapegoat to blame.
- PayPal *is* regulated like a bank in some parts of the world
- PayPal is *not* a bank in US so it does not (and can not!!!) make money on the balances - WellsFargo (PayPal's bank) is the one doing it
- If you know what and how PayPal should do things better you have two options - join PayPal and teach them (or help them fix things) or start you own alternative and "do things right". Oh, would I love to see you do that!!! A few attempts over the last years come to mind, notably Yahoo and Google. I'm sure *you* know how to do it right, right?
But I'm diverging as well... Coming back to the original post. Read it again, please. PLEASE! Did you not notice the "stageXmbXXX" in the text preceeding the screenshots? Gawd, people... Enough with the histeria, already. Though I agree it's "some" security risk to allow access to its internal staging environment (not production, testing!) I fail to see how that translates into "real" customer data and you feeling vulnerable. Someone saw a drawing of a prototype of your house and you immediately assume they have keys to it.
As much fun as it is to yell at "big targets" and feel all so powerful doing so it helps so much more to think for yourself and actually get to know the subject you are expressing an adamant opinion about.
PayPal security team will determine the bounty amount and all decisions are final.
Would you trust Paypal to reward you fairly?
not to sue / prosecute you - if they conclude that your disclosure respects and meets all their guidelines. Oh and the program is "subject to change or to cancellation at any point without notice".
And, regretably, the ugly reality for consumers dealing with the eBafia/PreyPal complex ...
“Shill Bidding Fraud on eBay: Case Study #5” ...
http://bit.ly/N1nTlc