Hacker News Reader

Comment by rasengan | Hacker News Reader

PCI DSS requirements specify that companies have 30 days to refute or remediate externally reported issues [1]. If they don’t respond or fix some of these issues, then PayPal will no longer be compliant and all credit card companies will be forced to stop working with them unless they wish to set precedence that PCI-DSS compliance is no longer required to be followed.

According to this image [2], they did not respond or refute within 30 days.

If PayPal’s PCI-DSS compliance certification isn’t revoked then PCI-DSS is a farce.

[1] https://www.itgovernance.co.uk/blog/a-guide-to-the-pci-dsss-...

[2] https://cybernews.com/wp-content/uploads/2020/02/paypal-2fa-...

View on HN

> PCI DSS requirements specify that companies have 30 days to refute or remediate externally reported issues [1]. If they don’t respond or fix some of these issues, then PayPal will no longer be compliant and all credit card companies will be forced to stop working with them unless they wish to set precedence that PCI-DSS compliance is no longer required to be followed.

Quote from your source:

> If your scan fails, you must schedule a rescan within 30 days to prove that the critical, high-risk or medium-risk vulnerabilities have been patched.

Scan in this sentence refers to "a PCI DSS external scan".

The list of approved vendors that can conduct PCI DSS external scans can be found here: https://www.pcisecuritystandards.org/assessors_and_solutions...

Please find cybernews' certificate number there and quote it for us, I have looked and can't find it.

I would guess that, contrary to your implication, they are not an approved scanning vendor. If this is the case then it really does not speak to the characteristics of PCI-DSS and your comment just seems wrong.

And even if they were an approved scanning vendor, from what little I know about PCI-DSS, these scans are part of larger process - so even if they were an approved scanning vendor the scan failure would still have had to be part of the larger process for this 30 day limit to apply.

I could go on and on about how much I hate PayPal and random other things, but just because I don't like something does not quite justify making false claims about it.

HackerOne states they are a PCI-DSS auditor approved organization [1].

[1] https://www.hackerone.com/product/challenge

Yeah but someone reporting a vulnerability to HackerOne is not the same as HackerOne reporting it. Otherwise you could just spam HackerOne with reports and remove someone’s compliance.

> HackerOne states they are a PCI-DSS auditor approved organization

Not anywhere on the page you linked. And a "PCI-DSS auditor approved organization" is not a "PCI-DSS approved scanning vendor" which if they were you could just quote the certificate number instead of link to HackerOne.

----

EDIT: I guess you are referring to this:

> Meet penetration testing requirements for PCI DSS and SOC2 Type II compliance certifications with our auditor-approved penetration testing methodology and Security Assessment Report.

This in no way is the same as claiming "we are a PCI-DSS auditor approved organization". Which again, would be irrelevant if it was the case.

----

Further, if you read the article, it is clear the "We" does not refer to "HackerOne".

> When we pushed the HackerOne staff for clarification on these issues, they removed points from our Reputation scores, relegating our profiles to a suspicious, spammy level.

As far as I can tell "We" refers to cybernews.com

And again even if cybernews was a PCI-DSS approved scanning vendor it would still have to qualify as an official external scan within the PCI-DSS framework.

> Not anywhere on the page you linked.

Read the page carefully - it specifically states they are an auditor approved org.

Quote from page: “Meet penetration testing requirements for PCI DSS and SOC2 Type II compliance certifications with our auditor-approved penetration testing methodology and Security Assessment Report.[1].”

Secondly, PayPal works with HackerOne officially [2] and within the CVSS standards as they clearly state on their HackerOne page, which is complying with PCI DSS.

[1] https://www.hackerone.com/product/challenge

[2] https://hackerone.com/paypal

Edit: Archived incase:

http://archive.is/CvZqg

http://archive.is/GGDs2

What is their certificate number?

> If PayPal’s PCI-DSS compliance certification isn’t revoked then PCI-DSS is a farce.

This comment chain has convinced me that PCI-DSS is a farce.

Pretty much. All it really proves is that an org meets a bare minimum of security standards. As noted elsewhere in the thread, it's used more for marketing and to serve as a "hey look at us we're self-regulating within industry!" than anything else.

I'm not sure that you being convinced by someone who doesn't even understand that it was not hackerone that found the vulnerabilities says much about PCI-DSS

Even if HackerOne were a company that is licensed to do PCI DSS scans, they were not contracted by PayPal to do it. A PCI DSS scanning company cannot just do independent audits for PCI compliance unless solicited by the target. The auditing process you are referencing is not related at all to reports by unsolicited scanners.

> Read the page carefully

Emphasis mine.

"...satisfy the requirements for external penetration testing for audited PCI DSS and SOC2 Type II certifications."

"Final Report Delivered. Ready for Auditors."

Sorry, but you don't understand what you are looking at.

All of HackerOne's information that you cite is about them being PCI-DSS-compliant or having undergone a SOC2 Type 2 audit. Nothing you link to identifies them as a PCI-DSS auditing company. They are not.

And the "scans" the PCI-DSS standards refers to are standard pen-test and external vulnerability scans, usually conducted by an accounting company who will certify the scan results. They are for known vulnerabilities, things like the version of Apache you are on, etc. None of the reports sent via HackerOne would qualify as a "scan" under PCI-DSS.

> All of HackerOne's information that you cite is about them being PCI-DSS-compliant or having undergone a SOC2 Type 2 audit. Nothing you link to identifies them as a PCI-DSS auditing company. They are not.

Please read the page again. They specifically say you can achieve compliance certification with HackerOne.

We read the page, and even if your claim holds, it is still irrelevant because whatever you quoted is not the same as being a PCI-DSS approved scanning vendor. And even if it was, HackerOne did not perform any scans.

HackerOne offering PCI-DSS approved auditor approved challenges gets you nowhere towards the claims you made in your first comment.

To review:

1. HackerOne would have to be a PCI DSS Approved Scanning Vendor - they are not AFAICT, neither is the CyberNews research team that did the scan AFAICT.

2. HackerOne would have to have conducted the scan - they did not. The CyberNews research team did.

3. The scan that HackerOne did would have to qualify as a PCI-DSS external scan - which ... do you get the part that HackerOne did not do the scan here or not? And nowhere did the CyberNews research team claim they performed a PCI-DSS external scan.

Please at least try to make an argument for your claims

“SATISFY COMPLIANCE CERTIFICATION REQUIREMENTS

Meet pentest requirements for PCI DSS, SOC2 Type II, and HITRUST compliance certifications.” [1]

[1] https://www.hackerone.com/product/pentest

Can you remind me again why hackerone is relevant here? Who claimed where that they performed a PCI DSS external scan that failed?

You achieve that compliance by paying HackerOne, as a company, to perform a compliance scan. This does not mean any swinging dick that reports a vulnerability through HackerOne is causing PayPal to fall out of compliance. These scans are planned well in advance and are part of a normal audit cycle. (edit: typo)

On top of that, there's not really any legal issues for being non-compliant, as has been pointed out elsewhere in this thread.

As someone who deals with PCI-DSS compliance in fintech land on a daily basis this thread is showing me there are a lot of people who like to crow on about stuff they don't know a thing about.

Indeed. However, it's refreshing to see a HN thread that's defending vendor snakeoil instead of assuming all infosec is vendor snakeoil.

You must be new here.

The page only says that they do external security scans that other companies who do the actual certification recognize as valid scans. They certify no one themselves.

Further, that has absolutely nothing to do with anyone reporting vulnerabilities through HackerOne. That is not a scan by the definition of PCI-DSS, the SOC2 trust services criteria, or any other security framework you care to name.

Just give it up. You're wrong.

> I would guess that, contrary to your implication, they are not an approved scanning vendor. If this is the case then it really does not speak to the characteristics of PCI-DSS and your comment just seems wrong.

Actually this makes a pretty good case for this regulation being a joke. They clearly aren’t up to the responsibility of being a payment processor and are leaning on the law to sustain their business rather than simply demonstrating aptitude directly.

Why does the regulatory body get to approve who and what can scan implementations of their security scheme? It seems like the ideal auditor and scanning software, in PCI DSS's eyes, would be the one that just barely checks the boxes for minimum security requirements. Poking too hard at their security scheme would reveal how lackluster it is but they still need someone to poke at it to prove compliance. Being able to ignore anyone or anything that isn't on the approved list seems like willful negligence.

> Why does the regulatory body get to approve who and what can scan implementations of their security scheme?

Because it's a scanner for PCI-DSS compliance, not a scan for security issues.

They do not fear that unapproved scanners will be more strict than approved scanners, they fear they will be less strict.

Because when you make the rules you get to make the rules?

It works better this way around than the other way around - which would be that PayPal gets to pick who audits them with no oversight. You can imagine how thorough that audit would be, and how many times it would find any problems.

> Actually this makes a pretty good case for this regulation being a joke.

PCI-DSS is not government regulation, but an industry created and enforced standard. Compliance is not mandated by federal law and only a couple of states have laws that reference it. For example, Nevada requires compliance while Washington doesn't require compliance but does remove liability for breaches for compliant businesses.

I meant it in a looser sense (like “constraint” I guess), but it just reinforces the reputation that PCI-DSS is a checklist you can buy, not meaningful itself.

It's not a regulation. It's a contractual obligation between the merchant and the PCI counsel (which is made up by VISA/Mastercard/the backing banks/etc). It was put in place to avoid regulation.

Then perhaps regulation is necessary if this is their level of scrutiny?

Yeah, but in this political climate, we probably can't get regulation passed that isn't written by the companies it regulates.

That will never happen under any circumstance.

regulation: noun. a rule or directive made and maintained by an authority.

Regulations can be self-imposed on an industry, it does not have to be something the government imposes. Calling PCI-DSS a regulation is still accurate despite many people conflating the term "regulation" solely with government action. In this case, the authority creating the regulations is the PCI Security Standards Council who have their power because the big players in the industry give it to them.

PCI-DSS is a joke, just look at all the zero days that have gone on before today, Comodo the CA hacked, DigiNotar to name a few, the recent zero day in Windows hilighted by none other than the NSA back in Jan. The public have ADHD attention spans, so who cares as long as the money keeps rolling in hey? Do you think your politicians, law enforcement, big businesses or Banksters give a toss? Criminals rule the world and its been going on for thousands of years with people believing in things like Religion and Royalty!

They "clearly aren't up to the responsibility"? Paypal has one of the larger application security teams in SFBA. You've decided they're not qualified because someone reported a self-XSS and Paypal didn't freak out?

Did you read downthread about the actual "2FA" feature this team "bypassed"?

> Paypal has one of the larger application security teams in SFBA.

It's not the size that matters, but how you use it that counts.

Sorry, technically correct is best correct.

Don't look behind the curtain.

Former QSA here....and that external scanning vendor (one in each quarter) and two required Pen Tests per year had not be HackerOne carrying them out. Automatic conflict of interest. HackerOne has a vested interest in a clean scan and making Paypal look good.

Uhm, but weren’t they operating via a bug bounty program? Now they’re supposed to be a registered auditor or whatnot?

> then PCI-DSS is a farce.

Take a wild guess on what you think will happen.

All these regulations are bs. Designed to keep small players out.

To be fair they are probably not designed specifically for that, the issue is big players are much more likely to have more political leverage.

Or is that one much like GDPR? Crazy fines that only big players can afford, in such a case, that was poorly designed.

GDPR only charges big fines to big players.

https://www.gdpreu.org/compliance/fines-and-penalties/

> Up to €10 million, or 2% of the worldwide annual revenue of the prior financial year, whichever is higher

I'm no lawyer, but this doesn't sound like it's just for the bigger players, at the minimum you'd be looking at some fines. At minimum you'd be paying 10 million if you incur that amount of fines. I guess it could be argued the 2% is geared towards hurting the big players.

No lawyer either and I don't know how to parse the legalese of the actual text [0]: "Infringements of the following provisions shall [...] be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:" but reading that as a generic "max(10 million, 2% worldwide annual revenue)" seems unlikely to be correct - especially given all the "up to"s in the sentence.

[0] https://gdpr-info.eu/art-83-gdpr/ Art. 83(4)

At minimum you would be looking at "nothing". Between that and 2%/10 million there are many possibilities. Requiring to answer questions, warnings, requiring some changes etc. And even once it gets to the fine territory, getting things from the max end is not something that would always happen. Out of documented 208 cases (https://www.enforcementtracker.com/), there have been 6 fines that exceeded 10 million and another 4 that exceeded 1 million. Median seems to be around 10 000.

GDPR max fine is (iirc) 4% of revenue. So if you are a small fish you will be paying less then the big fish. Also the fines are for wilful failure to comply, if you accidentally broke GDPR then your first offence is going to be more a slap on the wrist then an instant 4%.

Except it says "whichever" is higher, so if they decided to fine you 10 million or 2% of revenue, and your 2% is much lower than 10 million, guess which one you're paying...

> Up to €10 million, or 2% of the worldwide annual revenue of the prior financial year, whichever is higher

See: https://www.gdpreu.org/compliance/fines-and-penalties/

GDPR breach fines are discretionary rather than mandatory. They must be imposed on a case-by-case basis and should be “effective, proportionate and dissuasive”.

Fining a small mom and pop site 20 mill (20mil/4% is the highest fine depending on the case) is not proportionate, not effective because I would like to see them actually collect on that and I would say such a fine to a mom and pop would be dissuasive of doing business at all which is not that the ICO in the U.K. would want. Speaking of the ICO, their big fine (fucking auto correct) to BA for shockingly bad security earned them a 1.5% fine instead of the max 4% because they worked with the ICO (but the ICO still found they failing in a duty of care to protect data) and have been pushing the fine down the road ever since it was issued, atm the earliest ICO will actually fine BA is next month and it’s been almost a year since they filed their "intent to fine".

So while they can throw around heavy fines. It’s not like they run every mom and pop site out of the country.

>I would say such a fine to a mom and pop would be dissuasive of doing business at all

Welcome to the EU. They've pulled these stunts before. When they introduced changes to digital VAT collection the lawmakers "forgot" that VAT has exemption thresholds. This effectively barred some small and micro businesses from selling their digital services/goods to other EU countries, because the business would not have been exempt from VAT afterwards. It took the lawmakers years to implement a minimum VAT threshold.

>It’s not like they run every mom and pop site out of the country.

Of course they won't, because people want to do business. There will always be more businesses that get started. The question is whether there will be fewer businesses started because of the regulation. So far analysis after GDPR points to yes.

If you want to get a feel for how GDPR fines vary, https://www.enforcementtracker.com/ keeps a list.

They key part there is "if they decide to fine you...".

The max(€10m, 2%) and max(€20m, 4%) are the most that supervisory authorities may issue as fines.

But supervisory authorities have a legal duty to issue fines that are proportional which means than unless you breach the GDPR in a wilful and egregious manner you're unlikely to be fined that much (and if you are you can appeal the fine to a court who would reduce it to a proportional amount).

But since we're talking about small sites and small businesses, how many of these will actually be able to afford to go to court to argue this? In every system mistakes are made and corruption exists. Why word it in a way that seems to increase the likelihood of both?

When would it ever be proportional to charge a small business more than 2% if they can never charge a large business more than 2%? Are small businesses, as a general rule, somehow more capable of causing damage than larger businesses?

Is the law as written somehow vulnerable to some legal hack where all my revenue goes through Company A but all my data goes through Company B, so that Company B has a small global revenue despite being extremely profitable to the controllers of the companies?

>Is the law as written somehow vulnerable to some legal hack where all my revenue goes through Company A but all my data goes through Company B, so that Company B has a small global revenue despite being extremely profitable to the controllers of the companies?

No. Who the data controllers are is a matter of fact, not assignment.

To quote the Court of Justice of the European Union in the Fashion ID case (C‑40/17) at paragraph 68:

"[A] natural or legal person who exerts influence over the processing of personal data, for his own purposes, and who participates, as a result, in the determination of the purposes and means of that processing, may be regarded as a controller".

Furthermore, as per that case, multiple data controllers may exist for some processing activities.

So both Company A and Company B may be considered to be Data Controllers and thus both liable.

_Up to_. It's subject to various considerations (Article 83):

> (1) Each supervisory authority shall ensure that the imposition of administrative fines [shall] be effective, proportionate and dissuasive.

> (2) [...] When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:

> the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;

> the intentional or negligent character of the infringement;

> any action taken by the controller or processor to mitigate the damage suffered by data subjects;

> the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32;

> any relevant previous infringements by the controller or processor [and other specified criteria]

> (8) The exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process.

They can't just arbitrarily decide to fine you the maximum.

They were created for sincere reasons, and with best intentions. In the real world best intentions always conflict with the motivations of individual players.

It just isn't reasonable that PayPal would be cut off. That was always a toothless threat, at least for larger players.

As an aside, PayPal is a marvel to me because it is effectively lost in time. Using their tools and interface is like stepping back to 1995, and it seems -- from an outsider perspective -- that it must be some duct-taped quagmire that is barely holding on.

> They were created for sincere reasons, and with best intentions.

No? They were created by the industry to avoid actually being regulated and are a way to shift liability.

That doesn't mean they aren't also beneficial, but that's more a side effect than the intention.

Yes?

If we want to be cynical, of course there was a self-serving reason they created the standards -- because fraud, especially "internet" fraud, was on a massive upswing and it threatened this enormous new market of credit card spending. There is no question it's in their self-interest to improve the general condition of transactions.

> If we want to be cynical, of course there was a self-serving reason they created the standards

It's not cynical, it is literally the reason PCI exists.

> Five different programs had been started by card companies... The intentions of each were roughly similar: to create an additional level of protection for card issuers

- https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec...

Protection from fraud. Fraud costs the credit card industry money. It makes people less likely to trust/use them, which then costs them business.

You said -

"avoid actually being regulated and are a way to shift liability"

This is like saying a store put razors in a locked case to avoid being regulated. Or they simply don't want their stuff stolen?

I was being facetious when I said if we want to be cynical, because of course everything any business does is in their own self-interest. Of course it is -- that goes without saying, unless one is just trying to be glum.

> Or they simply don't want their stuff stolen?

Equating credit card fraud to physical theft is silly. The intermediaries of the credit card industry earn revenue by charging fees to process transactions. When fraud occurs, they're only liable if they were some how responsible. PCI allows the network to shift liability to the periphery and to allow the central network to deny taking responsibility for systemic problems with the infrastructure.

To use your razors analogy, PCI is like Gillette shipping razors lose in a box to CVS and telling the store that it is liable if anyone gets cut or the razors get stolen AND Gillette can fine them if anyone gets cut or razors get stolen. But that's not how it works, in the real world razors come with safety covers in tamper evident sealed plastic clam shells.

"Equating credit card fraud to physical theft is silly. "

In both cases someone is out money. It isn't a difficult step.

Fraud costs the credit card industry. It costs issuers (they shoulder 60% of the direct cost), merchants, and it costs the future of the industry because it is a nuisance for end-users.

They make a standard of best practices to reduce fraud. Following those best practices is good for every single participant, outside of criminals. Reducing fraud wholesale is the goal, obviously.

Spinning this in a nefarious fashion is not helpful to anyone, and does nothing but muddies the waters.

No one is denying fraud has a cost or that there's benefit to mitigating it. Mitigation comes at a cost and so there is a cost/benefit analysis performed by stake holders to determine the scope of mitigation employed.

PCI identifies recommended mitigations and imposes penalties for failures, but it doesn't ensure or validate compliance. It simply shifts liability from one stakeholder to another.

No one is spinning this as nefarious, but rather information that should be taken into consideration.

I guess you're not at all familiar with the self report nature of PCI audits.

The purpose of PCI is to shift liability

How is this the top comment on the thread? Do people really believe that failing to respond to a self-XSS report on HackerOne to the satisfaction of the reporter would cause someone to lose their PCI certification?

> failing to respond to a self-XSS report

This really downplays the report or shows a complete lack of understanding.

Getting access to someone's Paypal account which could potentially mean all their credit cards and banks is definitely an issue that needs to be addressed. This in itself should not be reason to lose PCI certification.

However, as the article further indicates [1], failure to respond (or even closing the issue without resolving) is a completely different story.

[1] https://cybernews.com/security/we-found-6-critical-paypal-vu...

It's not at all clear to me what you're saying here. Are you making a case that the whole report all put together is impactful? Or are you actually trying to argue that self-XSS is a critical security vulnerability?

The former; the author's report (short of seeing what was intentionally left out for proper disclosure reason) is credible, and Paypal's failure to respond/remediate the issue is improper.

Getting access in this way to users' financial accounts is absolutely a vulnerability.

They are getting access to the accounts of people who do not have 2FA enabled and whose credentials have been stolen. Every bounty program I've ever paid attention to would close that report. Risk-based anti-ATO systems are heuristic.

> They are getting access to the accounts of people who do not have 2FA enabled and whose credentials have been stolen.

Ok, first, and foremost, don't you think it's a problem if there are stolen accounts? Wouldn't it make sense to visit the .onion site that the author refers to in the article and lock access to all accounts found there?

> Risk-based anti-ATO systems are heuristic.

This is Paypal practicing DID, which is great. What's not great is that the 2FA defense system could be defeated.

> Every bounty program I've ever paid attention to would close that report.

Getting access to a user's financial account and being able to move their money is something I would take serious 100/100 times. I hope you're not paying attention to bounty programs in the financial sector.

no shit PCI-DSS is a farce

it's just there to make people that don't know anything about technology feel better

It's certainly very effective at providing said people with a false sense of security. It's also another buzzword they can utilize to waste people's time during meetings.

exactly, it is simply marketing (/ politics) really

It's just like ISO-9001.

PCI-DSS does not have Bug Bounty requirements. That's referring to ASV scans which have to be run quarterly by a specific list of vendors and then there's a dispute/remediation process.

Their response is dogshit but not for this reason.

My suspicion is that Paypal is now "too big to fail" and will suffer very little consequences if none at all.

"If PayPal’s PCI-DSS compliance certification isn’t revoked then PCI-DSS is a farce."

PCI Compliance is total bullshit and everybody knows it.[1]

[1] https://www.rsync.net/resources/regulatory/pci.html

There is no doubt that the PCI-DSS is a farce.

Are there other cases where PCI-DSS compliance requirements are selectively enforced?

From this article [1], I get the feeling that PCI-DSS has always been selectively enforced.

[1] https://www.anitian.com/the-failure-of-the-pci-dss/

Reply on news.ycombinator.com