PayPal pays $10,000 to discoverer of massive security flaw (+video)

Written by James Delahunty @ 07 Dec 2014 7:57 User comments (4)

An Egyptian security researcher has scooped the top payout for security bugs from PayPal for discovering a massive security flaw that exposed the accounts of over 150 million users.

Yasser Ali was able to get around PayPal's CSRF Prevention System and capture an authentication token that could be used to effect a customer's PayPal account. You could add, remove or confirm e-mail addresses, add fully privileged users to a business account, change security questions, billing info, shipping info, payment methods and so on.

He disclosed the bug to PayPal and received the firms top award incentive for bug hunters, pocketing $10,000 for his work.

He also detailed how he beat PayPal's security systems on his blog, and provided this proof of concept video.

Via: Spohos (Naked Security)

Tags: PayPal

<Beware offers of free PSN and Steam codes >Jolla Tablet reaches stretch goal of $1.5 million and adds 128GB microSDHC support

4 user comments

18.12.2014 08:49

Dragon3000

Send private message to this user

Junior Member

bloody hell! just shut the internet down for good already!

28.12.2014 14:30

evelyn.tam

Send private message to this user

Newbie

Hi James, Evelyn here with PayPal. Any chance you can share your email address?

38.12.2014 14:46

hearme0

Send private message to this user

Senior Member

Thank God for no-life losers that hack this crap morning, noon and night. To have honestly caught this, you'd have to eat, breathe, see, and think ones and zeros and likely don't have much of a life outside of the keyboard and mouse.

I am grateful though.

49.12.2014 14:48

alotanor

Send private message to this user

Newbie

they should've added another '0' onto that amount.

Comments have been disabled for this article.

	Shorts feed cleans up: YouTube cuts visibility for channels recycling others' videos (02 Oct 2026 2:15) With the update, algorithms will increasingly favor original content while simultaneously reducing the visibility of videos that have been copied or re-uploaded from other creators without adding their own value.
	Firefox 157: major visual redesign - some love it, some hate it (01 Oct 2026 2:06) Firefox FX 157 was released at the end of September 2026 and completely revamped the open-source browser's appearance compared to before.
	Windows 11 26H2 released - Start menu changes, improved search, Task Manager changes, .. (30 Sep 2026 12:48) Microsoft released Windows 11 version 26H2, bringing light updates and deeper AI integration. This update is the first more lightly installing annual Windows update.
	Meta VR Glasses revealed - very light, tons of 3D content coming up (24 Sep 2026 3:23) Meta introduced new pair of VR glasses that combine entertainment, work, and AI. According to Meta, lightweight glasses offer an unobtrusive virtual reality experience with cutting-edge technology and an intuitive user interface.
	Samsung smart refrigerators received a software update - stopped working, food spoiled (24 Sep 2026 3:17) According to Korean media sources, a software update for Samsung's smart refrigerators has failed miserably. After the update, the refrigerators stopped working completely, and several consumers report that their food has spoiled. 1 user comment

PayPal pays $10,000 to discoverer of massive security flaw (+video)

4 user comments

Latest news

Reviews

News archive

Subscribe

Sections:

Follow us:

	Ecovacs X11 Omnicyclone review: No more buying dust bags In our long-term review of Ecovacs Deebot X11 Omnicyclone we go through robot vacuum's cleaning capabilities, but also focus on its obstacle avoidance skills - and obviously investigate its bagless dustbin invention.
	Roomba Plus 505 Combo review - Surprisingly good and relatively affordable robot vacuum In our review, we go through the pros and cons of the obstacle-avoiding, mopping Roomba 505 Combo+ robot vacuum. During a long test period, the robot's cleaning performance was pleasing, but it was far from perfect.
	Review: Roborock Saros Z70 - robot vacuum with an arm In out in-depth review of Roborock Saros Z70 we put the robot vacuum through a 3 month test period, where we observed its work in normal home. The sci-fi -like arm of Z70 was a little bit disappointing, due its limited functionality.