Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by Globz | Hacker News Reader

Full thread

Globz·

10K for this kind of vuln is very cheap on their part.

This is serious when you consider that they are moving millions of transactions every day...

CSRF valid for ALL users, ouch!

View on HN

Their bounty program[1] states:

> We may pay beyond the range at times when bugs are found to have significant risk.

If they don't consider this a significant risk, I'm not sure what is.

[1] https://www.paypal.com/webapps/mpp/security/reporting-securi...

Perhaps it is so they don't give staff incentive to leak a vulnerability. If they offer 100k it may be more tempting for a staff member to tell a friend of a friend, and share the prize. It would be stupid of course, but possible.

Then just allow staff to also claim the prize? Seriously, given the risks and the money rewards, it's a bargain.

It may encourage sloppy coding, because the worse the code, the more potential for your teammates to win a prize.

However a separate salaried 'cracking' team in another city, with bonuses for exploits found might work.

If it's any consolation, 10k USD is about 14x the median monthly salary in Egypt.

http://sites.miis.edu/educationinegypt/files/2013/05/CIEsala...

So what? The value of the vulnerability to PayPal does not change whether the finder is in Egypt or Norway. PayPal should pay based on its perceived value, and not the finders.

Consider what the finder could have sold the exploit for, and the damage it could have caused.

I think given that you could effectively steal from any account for which you knew the email was worth significantly more than 10k.

> you could effectively steal from any account for which you knew the email

If you succeed in CSRF attack him, that is.

Reply on news.ycombinator.com