A 17-year-old Australian security researcher has published information describing a shockingly simple way to bypass PayPal's two-factor authentication process for user account credentials. PayPal has often been targeted by criminals and fraudsters, but this particular flaw appears to be a glaring oversight on the part of the company itself and its parent company, eBay Inc.
The teen, Joshua Rogers, had originally discovered the problem in early June and had notified
PayPal of the problem. He has now gone public after having received no satisfactory response from the company since then, with a
blog post and even a
video demonstrating the process.
The flaw arises thanks to a feature of eBay and PayPal that allows accounts on both sites to be linked in order to facilitate incoming and outgoing payments. Anyone with malicious intent could trick
eBay into setting a cookie that flags users as already logged in. This indicates to PayPal that it does not need to put users through a verification process when they visit the site directly.
According to Rogers, an eBay account isn't even necessary once you have a specific URL string which sets the two-factor flag.
Two-factor authentication requires users to provide not only a username and password, but also a second tier of credentials before they are allowed access to a website or online service. The second credential is often in the form of a one-time code generated on the spot and sent to the user's pre-registered mobile phone or another offline physical token. In this way, a person trying to access the service can be determined to both know something and have something that only he or she should know and have.
The flaw only removes the second layer of authentication. Attackers still need to be in possession of the primary password. Common criminal tools such as Trojans and keyloggers are frequently used to amass such credentials, which is why two-factor authentication is often considered a necessity.
This is not the first time PayPal's security has been the subject of scrutiny. The service is a particularly high-profile target for attackers considering it is used to store large amounts of money.