Bypass PayPal's Two-Factor Authentication

Bypass PayPal's Two-Factor Authentication(duosecurity.com)

112 points by seanponeil 12 years ago | 28 comments

I'm glad this was found independently and reported. While I was at PayPal I had started email threads about it but nothing was done. I am sure I was not the only one there who "discovered" this. For instance, even if you have 2FA you can add PayPal to Uber as if you never had 2FA.

The other big issue with their 2FA authentication is that it really isn't two factor. You can say you don't have the token and instead can answer security questions. Two factor is supposed to be something you know plus something you have. "Falling back" to security questions is basically just relying on things you know.

derefr 12 years ago | |

I would think that, if you have a big fraud-detection engine like Paypal's in place, 2FA isn't so much an enforced requirement for login, as it is a big fraud-signal when the user chooses to circumnavigate it.

Like any other fraud-signal, though, it can be countered with enough evidence that you are who you say you are--with security questions at a weak level (maybe enough to counter a 2FA token that was only set up a few days ago), or with demands for scanned photo ID at a higher level (if you use 2FA all the time.)

mseebach 12 years ago | | |

If there is no legitimate reason to circumnavigate 2FA, i.e. the S/N of detecting fraud by detecting circumnavigation is 1.0, why not just automate the anti-fraud enforcement and make the circumnavigation impossible?

Serow225 12 years ago | |

Yes, I've contacted PayPal before and asked them for a user setting to be able to disable the 2FA fallbacks, but they don't really seem to care that much for security. I hope someone from PayPal Security team reads this and considers implementing this change.

Serow225 12 years ago | | |

I was also thinking that the community should start calling this type of implementation 2FAil, to give the companies a little extra 'shame peer pressure'... Anyone up for making a logo, heartbleed-style? :)

RachelF 12 years ago | |

It is not real two factor authentication, if you can bypass it with questions.

It is more security theatre, giving PayPal's users a feeling of security.

rdl 12 years ago |

Based on this timeline, I don't understand why Duo didn't go public on 2014-04-28 when PayPal began being weasely about their bug bounty program. This probably would be better for users for two reasons: one, in the past 2 months, this bug may have been exploited in the wild, and two, it would make it easier for users to make informed decisions about which payments providers to use in the future (as well as which 2fa providers are technically competent).

mh_ 12 years ago | |

The disclosure process is always fraught with peril (and pain) and its a safe bet that no matter what a discloser does, there will be some person or group who thinks they should have handled it differently. In a case like this, when reasonable time is given, and the world gets to benefit from a great deal of work (effectively done for free), i tend to simply say thanks, and make notes..

duiker101 12 years ago | |

I was wondering the same. I think paypal was very unresponsive and the could have for sure done a better job. That said when they asked for 3 days more I think Duo could have complied and would have made everyone more happy.

pilif 12 years ago | | |

> That said when they asked for 3 days

they asked for a month and 3 days. Duo wanted to disclose on June 25th, PayPal has a fix on July 28th.

anujnayar 12 years ago |

Hey guys - its Anuj from PayPal. I just published a blog post that explains what we are doing to address this. https://www.paypal-community.com/t5/PayPal-Forward/Working-w...

prohor 12 years ago |

A bigger problem for me is that two-factor authentication for PayPal is available only in few countries (US, UK and Germany I think). I tried to get a token but no chance; not even software with mobile app. When contacting support I was considered as a freak probably - they completely didn't what is the problem without 2FA. I really don't get it, why being global they limit 2FA to a few countries.

therealmarv 12 years ago | |

Actually I use PayPal more often since they provide 2FA. They are stupid because this could be a win-win for them and tech aware consumers like us. I also wished they used Google Authenticator instead of this SMS... they (SMS) sometimes take ages before delivered.

prohor 12 years ago | | |

They also support VeriSign VIP (https://idprotect.verisign.com/mainmenu.v), which you could take mobile app - should be better than waiting for SMS. At least in theory as I cannot validate it, because 2FA is not available in Poland.

Rapzid 12 years ago |

You never trust the client; this is amateur hour shit TBH. How could a company like PayPal let something like this through? SURELY there were employees raising hell before it ever hit the app stores?

rlly 12 years ago | |

This. When the employee wrote that popup and manually logged out of the app they must have been high.

electronous 12 years ago | |

It's shit like this that makes me trust bitcoin. Down with fiat.

scott_karana 12 years ago | | |

Right, because poorly designed software only gets written when fiat currency is involved?

I hope you were being sarcastic...

nooron 12 years ago |

It's interesting to watch corporations expose one another's vulnerabilities in a public way. It seems like this was done pretty fairly, giving PayPal ample time to address the bug-- so I guess that's neat.

ilyanep 12 years ago | |

Who else to keep companies honest but their competitors?

therealmarv 12 years ago |

I also do not like the two factor authentification from PayPal. Sometimes the SMS takes ages before it arrives (I waited more than 10 minutes here in Germany). And it is absolutely not possible to pay in eBay with Paypal and 2FA when using mobile browser or eBay Android app. I wished they use solutions like Google Authenticator for their 2FA.

VMG 12 years ago |

I don't know if this is common knowledge but PayPal lets you log in with your CC number instead of the auth token sent via text message. I know because the text messages often do not arrive at all for me, even after repeated requests.

It "only" works one time though, the second time you're asked the dreaded "security question"

driverdan 12 years ago |

Three months??? It took a major global payment processor three months to fix an issue as big as this?

And people wonder why I'm constantly telling them to stop using PayPal.

M4v3R 12 years ago |

It's not suprising that Duo Security is interested in exposing this flaw in their 2FA flow, since their product is a somewhat better 2FA solution. I've evaluated their solution for my project, but ultimately settled with MePIN which offered similar security at lower price.

kylequest 12 years ago | |

You can end up with the same problem even if you use Duo.