Think I found a security flaw in a payment gateway

S

shauntir

Well-Known Member
Joined
Sep 11, 2013
Messages
457
Reaction score
0
Location
Durban
So, I have reported the issue but wanted to hear what your thoughts are. I won't mention who the payment gateway provider is though for obvious reasons.

Essentially, after authenticating myself on the gateway, I am able to access an invoice/payment from ANY browser. I feel that that is dangerous as the payment session should only exist for the device I am using. Granted, its highly unlinkely someone would be able to randomly generate/guess the url hashes shortly after someone authenticates themselves, I still feel it is insecure.

Furthermore, once authenticated, if I close the browser (normal users would do this), the session is still active and accessible from anywhere. The only way the link with the hash is expired is if I click cancel or I guess once payment is made.

I don't know what the url expiry time is but it's never long enough if I can access it from any browser.

So, security flaw or not?
 
Sounds a bit dodgy. I would contact the payment gateway and at least point out the possible insecurity.
Engage with them. If they aren't a bunch of immature twits they should at least take you seriously.
 
Depends on the amount of randomness in the URL, I'd say.

If the URL looks like

provider.co.za/e07910a06a086c83ba41827aa00b26ed/invoice, then it is likely not *that* bad.

The chances of someone guessing the random string is extremely unlikely, which makes it not much less secure than a request that has the same random string in a cookie.

One downside to including it in the URL, is that it is more likely (even if possibly still quite remote) that someone will copy and paste the URL to someone else.

Another downside is that it will end up in your browser history, as well as in their server logs, which, if it remains valid for any appreciable length of time is not a great result. That would mean that someone with access to the server logs would be able to obtain a list of a large number of payments (i.e all of them in the period).

All of the above presupposes that there is a large amount of randomness in the URL. If there is not, then yes, it is a bigger problem, and the likely impact increases.
 
RoganDawes said:
Depends on the amount of randomness in the URL, I'd say.

If the URL looks like

provider.co.za/e07910a06a086c83ba41827aa00b26ed/invoice, then it is likely not *that* bad.

The chances of someone guessing the random string is extremely unlikely, which makes it not much less secure than a request that has the same random string in a cookie.

One downside to including it in the URL, is that it is more likely (even if possibly still quite remote) that someone will copy and paste the URL to someone else.

Another downside is that it will end up in your browser history, as well as in their server logs, which, if it remains valid for any appreciable length of time is not a great result. That would mean that someone with access to the server logs would be able to obtain a list of a large number of payments (i.e all of them in the period).

All of the above presupposes that there is a large amount of randomness in the URL. If there is not, then yes, it is a bigger problem, and the likely impact increases.
Click to expand...

wat

having ANY chance of "guessing" something is as bad as having it set to 1234. Secure, authenticated session based access is the ONLY thing that should be considered if you're dealing with things like a payment gateway.
 
throwaway420 said:
wat

having ANY chance of "guessing" something is as bad as having it set to 1234. Secure, authenticated session based access is the ONLY thing that should be considered if you're dealing with things like a payment gateway.
Click to expand...

Seriously? You are suggesting that having a 1 in 340282366920938463463374607431768211456 chance of guessing the right URL is just as bad as having a 1 in 10000 chance? I'd love to play poker against you one day :-)

Keep in mind that most session cookies are around 128-bit, and in fact, in many cases, the crypto keys that you are relying on to protect your SSL connection to the site from eavesdropping are also only 128 bit.

Also keep in mind that to brute force the crypto keys, you will need several billion years (and this is an attack that can be carried out offline!). To guess the session key would have to be done online, making requests to the server each time, resulting in several orders of magnitude of difference. That is, the difference between brute forcing an MD5 hash using a GPU at roughly 32 billion per second, vs maybe 1000 per second if the payment gateway is able to stand up to that sort of traffic (and you have sufficient bandwidth, etc to the gateway).

AND that assumes that the gateway operators will not notice you generating 1000's of requests per second against their servers.

Tell me again how bad it is?
 
RoganDawes said:
/snip
Click to expand...

who said anything about brute force? having a file with financial information in a STATIC url (potentially thousands of these files) means that someone who has access to the files' index has unauthenticated, unsecured access to every file. Chance means nothing when you're dealing with a vector that bypasses the need to guess or exploit randomness*. Another example of this being a horrible idea is if the user is stupid enough to bookmark or have the URL of the file seen by someone or something else, which, since your brilliant security relies on "chance" means that person can access that file without having to authenticate themselves

id love to play CTF vs you
 
Quite a bit of debate here which is going all over my head :rolleyes:

The hash is randomly generated and I seem to have counted 24 characters.

DA-LION-619 said:
What info do you get access to via the gateway?
Click to expand...

You have access to your saved payment info. So your name, email, last 4 digits of your credit card, expiry date etc.
 
shauntir said:
Quite a bit of debate here which is going all over my head :rolleyes:

The hash is randomly generated and I seem to have counted 24 characters.



You have access to your saved payment info. So your name, email, last 4 digits of your credit card, expiry date etc.
Click to expand...

Definitely a security flaw, maybe you'll get a reward :D
 
throwaway420 said:
who said anything about brute force?
Click to expand...

How else do you propose to figure out the 24 characters in shauntir's URL, then? Log on to the server?

throwaway420 said:
having a file with financial information in a STATIC url (potentially thousands of these files) means that someone who has access to the files' index has unauthenticated, unsecured access to every file.
Click to expand...

Who said it was a file? It could be an URL that is served by an application that pulls the data from the database. It really doesn't matter one way or the other.

Edit: I'll note that I did also originally point out the risk of someone obtaining access to such an "index" through the server logs. It's unlikely (although not confirmed) that the directory in question was "indexable", since most payment gateways tend not to create static *files* on the filesystem, but rather use dynamic coding in whatever language to obtain the required information from a database.

throwaway420 said:
Chance means nothing when you're dealing with a vector that bypasses the need to guess or exploit randomness*.
Click to expand...

How exactly does it bypass the need to guess or exploit randomness? Perhaps I missed something the in the OP's post, but I don't think he said anything of the sort.

I read it that he was able to copy the URL from one browser to another on the same machine, and still access his payment information.

throwaway420 said:
Another example of this being a horrible idea is if the user is stupid enough to bookmark or have the URL of the file seen by someone or something else, which, since your brilliant security relies on "chance" means that person can access that file without having to authenticate themselves
Click to expand...

Sure, I mentioned the risk of the user doing stupid things with the URL, and having it exposed in his history, etc. Bookmarking is not significantly different from that, in that to expose the URL, one would need access to his computer. And 24 random characters is not the sort of thing that you are going to just "remember" having seen it for a few seconds over someone's shoulder.

I'd think that you would simply read the payment details from the screen, since they'd also be visible if the URL was (most likely), and be much easier to remember. :-)

Argue away, I've been in this business for 15+ years, and am happy to teach people about how it works ;-)
 
Last edited:
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X