Slashdot Mirror
PayPal's Two-Factor Authentication Can Be Bypassed Using eBay Bug
About six weeks ago, a hole in Paypal's two factor authentication and their mobile client was discovered. hypnosec (2231454) wrote in with news of another trivial way to bypass Paypal's two-factor authentication. A bug in a feature for eBay integration allows passing a GET parameter to completely bypass two-factor authentication, and you don't even need to be coming from eBay to use it. You still need the password, but additional protection is lost. From the article: eBay, in conjunction with Paypal, provide a service as to where you can link your eBay account to your Paypal account, and when you sell something on eBay, the fees automatically come out of your Paypal account. ... When you are redirected to the login page, the URL contains "=_integrated-registration." ... Once you're actually logged in, a cookie is set with your details, and you're redirected to a page to confirm the details of the process. And this is where the exploit lays. Now just load http://www.paypal.com/ , and you are logged in, and don't need to re-enter your login.
So, the actual bug itself is that the "=_integrated-registration" function does not check for a 2FA code, despite logging you into Paypal.
You could repeat the process using the same "=_integrated-registration" page unlimited times.
Perhaps I'm not understanding... but as my PayPal and eBay accounts have different passwords and i have two factor authentication setup using a DigiPass 5 rotating cypher key, I am unable to replicate what is being reported. No mater what, I am prompted for my DigiPass token key and password.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Hey now, without PayPal there would be no Tesla or Space X.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
I see comments like this all the time, but in my own personal experience paypal protected me as a seller from a fraudulent buyer who tried to steal several hundred dollars. Although the process was not quick, in the end Paypal discovered the truth, and I'll continue to use and recommend the service.
Same here. I've had multiple disputes on paypal and they all were decided in my favor.
My dad had several thousand dollars stolen from his account and paypal gave him all his money back.
I never leave money in my account so there is really nothing they can seize from me and their
arbitration leaves an extra layer of protection against fraud.
PayPal is great until it isn't. I paid an eBay seller from my checking account, an e-Check. A few days later eBay cancelled the sale and PayPal credited the amount withdrawn from my checking account to my PayPal account and then "permanently restricted" the account. No explanation why. Anything I can do? No. Can I have the money put back in my checking account? Nope, we are freezing it for 180 days. 180 days they redeposit the funds to the checking account. So much for eBay and PayPal, 10 year history with both with zero issues. No communication, no explanation, no appeal, no nothing.
I'll see your story and raise you mine. I bought a video card on eBay back in December, paid 1200 for it and waited for it to arrive to a pick up centre, but the seller used a wrong name on the package and so the package was returned. From POV of eBay the shipping was 'completed' because the tracking number was there, showing 'delivered', but the address of the delivery was back in New York, not my destination address. Then the 'seller' supposedly sent the package to me the second time, but this time wouldn't provide the tracking number, and the package never arrived. Talking to eBay appeared to be fruitless (as a side note, the 'seller' put the same item back for sale, and since she doesn't normally sell computer parts, I assume it was the same video card that was put for sale once again). I contacted eBay and PayPal, nothing. Eventually I worked it out through my credit card, they pressed on PayPal I guess, I got the money back but not thanks to eBay or PayPal. AFAIC (and I told them that) they continued working with somebody selling stolen property, but it didn't matter to them.
You can't handle the truth.
That's like allowing a gas station to change the amount to transfer after you entered your PIN
Except they already do that. The cardholder slides the card and puts in a PIN before pumping the fuel, at which time the pump doesn't know how much fuel the cardholder will pump. So the pump places an "authorization" for $100 or so, which lowers the cardholder's credit limit by $100 for the rest of the day, and turns on for up to $100 of fuel. Later, the pump performs a "capture" that releases the "authorization" and makes the payment final.