PayPal fixes serious account hijacking bug in manager

PayPal Fixes Serious Account Hijacking Bug in Manager 
by Chris Brook
 
PayPal patched a hole in its Manager portal this week that could have made it easy for an attacker to hijack an admin’s account, change their password and steal their personal information — not to mention their savings. Manager is a feature of the service that allows users to manage their Payflow account, the company’s name for the gateway that merchants use to take payments from customers. Mark Litchfield, an IT consultant who discovered the hack posted a detailed explanation of it on his pen testing site, Securatary, late Wednesday. 
“PayPal had gone to considerable lengths (more so than others) to ensure the security of this portal”, Litchfield wrote. Not far enough apparently. Litchfield claims he started by capturing a request with the web app security tester Burp Suite and was able to use its built-in username dictionary to look for a login. After he concluded enumeration, a process that retrieves a list of legitimate merchant logins, Litchfield was able to glean more than half off the information he needed to fill in PayPal’s Manager Login screen. Having secured the partner name and the merchant log-in, Litchfield didn’t need an email address, he just needed the password, something he could reset without even having to answer a security question.
 
Full Article