Paypal Android App Remote Code Execution

>It was recently discovered that applications do not even need to have a Javascript Interface in their code to be vulnerable to this attack. This is because a Javascript Interface is implemented core webview code in Android versions before 4.2. Meaning that every single application that loads a webview over cleartext is vulnerable to this attack.

Maybe its because I haven't properly had coffee yet or because I've never used WebView in android but I'm having trouble parsing this. From the small code snippet they provided it shows them enabling javascript and adding an interface. Is this just a general comment for other apps that are working on HTTP or broken HTTPS or does it relate to this exploit?

public void onReceivedSslError(WebView paramWebView, SslErrorHandler paramSslErrorHandler, SslError paramSslError) { paramSslErrorHandler.proceed(); } }

Wow, good job PayPal.

Ignoring invalid certificates is a never a good thing to do.

> 25/02/2014 Paypal claim no risk to Paypal brand

That does not sound good.

Someone unknown added a phone number and a new mobile pin to my paypal account recently. I called paypal support and they walked me through changing the pin. Few minutes later, the pin was changed once again by the unknown person. I call paypal again and they walk me through a similar process again. Finally it stopped but it left me feeling very vulnerable especially because I'd enabled two factory auth and it did little to prevent it.

Weird enough no funds from my account disappeared. Not sure if me acting so far(within minutes of compromise) had to do with it.

I'm guessing an engineer added the 'proceed' call during development because the dev servers had invalid certs, and they forgot to change it back before committing.

I wonder what happened inside PayPal that cause the Android app to be treated differently or whatever it is?

What kind of code can be executed through the Javascript interface? They seem to claim it's not specific to Paypal's implementation and these seem fairly common. I was under the impression they only expose various methods and variables. How can they be exploited?