Feeds

PayPal post-checkout cash slurp a FEATURE not a BUG

Would you like a super-sized shipping charge with that?

Protecting users from Firesheep and other Sidejacking attacks with SSL

An apparent flaw that lets users add any amount of money onto already processed PayPal transactions is a feature, not a bug, according to the payments giant.

The function was designed to allow sellers to add additional costs for services like shipping on the top of transaction totals which customers had approved through the PayPal website.

Sellers would be expected to add small amounts but TU-Berlin IT student Jan Kechel found PayPal had not limited the amount of cash that could be swindled and sent the company a proof of concept script.

"In PayPal Express Checkout the online shop can transfer any amount, no matter which amount the client actual confirmed at the PayPal website," Kechel said.

"This proof of concept transfers only one Euro more than the confirmed amount, but I also tried with 200 Euros and it works just the same."

PayPal told Vulture South Kechel's bug was more of a shiny button.

"We can confirm that through our Bug Bounty Program a researcher reported a suspected vulnerability with our PayPal Express Checkout," a spokesperson said.

"After looking into the issue, we communicated this is not in fact a vulnerability. We work closely with our merchants who use Express Checkout to provide them the flexibility they need to complete their transactions in a timely manner so they can offer excellent payments experiences to their customers."

The company did not say if it plans to cap the rate or otherwise reduce the potential impact of the fraud. Defrauded customers do have the option of seeking reimbursements from PayPal, which like many banks shells out for fraudulent transactions in the name of consumer confidence.

Customers would be alerted to the scam if they opted for email verification and further bothered to open them as the payment details were contained in the body of the messages.

Last month, former NASA hacker turned white hat Razvan Cernaianu, aka Tinkode, reported a flaw to PayPal's bug bounty team which he said allowed fraudsters to double their money.

The payment giant brushed off the report but did not say how it could prevent one off instances of the scam which involved the funneling of cash to a mule account prior to a dispute claim being lodged. ®

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.