Loophole in PayPal is a "license to print money" for hackers



A former hacker once convicted for hacking into NASA and the Pentagon claims to have found a way to reliably double your money by exploiting a loophole in PayPal's system.

Razvan Cernaianu, who goes by the nickname TinKode, claims scammers need to open three PayPal accounts in order to pull off the scam. One is a legitimate buyer, another is a disposable seller and the third is a mule. The latter accounts need to be linked to virtual credit cards.

"You transfer the money to the second account with the pretext of buying a phone. From the second account you again transfer the money to the third account as a gift. After 24 hours, you use the chargeback function from the first account to get the money back with the excuse that the phone did not arrive on time," Cernaianu explained on his blog

"As the second account is only a virtual one, it will not have real money from which Paypal can extract. Therefore you are left with $500 restored by PayPal, and $500 in your third account."

Cernaianu said he reported the loophole to PayPal's bug bounty team, who have claimed that the problem results from an issue with its Protection Policy.

"While the abuse described here is possible in our system, repeated abusive behavior by the same and/or linked account(s) is addressed," PayPal reportedly told Cernaianu.

However, the company has not issued a response on what it has done to prevent one-off abuses of this kind.

The Romanian hacker, who also goes by the online alias "sysgh0st", brought down websites belonging to the Royal Navy, the Pentagon and NASA using advanced SQL Injection techniques to plant malicious code in the website's source code, before being arrested in 2012 and forced to pay $120,000 (£70,744) in damages.

Whether or not this loophole could be used to extort thousands of pounds out of PayPal is dubious, considering their considerable investment in anti-fraud technology. However, it just goes to show that there are loopholes in even the most advanced and secure systems.




More

The Birth Of Gigabit LTE: Your Next Phone Could Be Supercharged!

This week Qualcomm announced their X16 Modem which is intended to provide Gigabit wireless speeds likely making us wish we all had unlimited data plans again. This layers on top of their Mu-MIMO effort which is already showing up in some phones providing near Gigabit speeds over Wi-Fi. To give you a sense of the speed boost this is 10x the speed of the first LTE (4G) devices and 500x the speed of the first 3G devices and about 2x the speed of the fastest modems in market today. But what does this mean in terms of what you can do? Now be aware that this generally won’t show up in phones until...

Cognizant computing smartphones  

Smarter, fast communications, and high-resolution—can it get any better?

How To Market Yourself Online

Up to 93% of hiring managers review a candidate’s social profile before making a decision on whether to offer a role, and this number is only likely to increase.