Paypal CSRF

Hacking PayPal Accounts With CSRF

December 4, 2014 by 17 Comments

The computer security industry has made many positive changes since the early days of computing. One thing that seems to be catching on with bigger tech companies is bug bounty programs. PayPal offers such a program and [Yasser] decided to throw his hat in the ring and see if he could find any juicy vulnerabilities. His curiosity paid off big time.

Paypal is a huge player in the payment processing world, but that doesn’t mean they aren’t without their flaws. Sometimes the bigger the target, the more difficult it is to find problems. [Yasser] wanted to experiment with a cross-site request forgery attack. This type of attack typically requires the attacker to trick the victim into clicking a malicious link. The link would then impersonate the victim and make requests on the victim’s behalf. This is only made possible if the victim is logged into the target website.

PayPal has protection mechanisms in place to prevent this kind of thing, but [Yasser] found a loophole. When a user logs in to make a request, PayPal gives them an authentication token. This token is supposed to be valid for one user and one request only. Through experimentation, [Yasser] discovered a way to obtain a sort of “skeleton key” auth token. The attacker can attempt to initiate a payment transfer without first logging in to any PayPal account. Once the transfer is attempted, PayPal will request the user to authenticate. This process produces an auth token that apparently works for multiple requests from any user. It renders the authentication token almost entirely ineffective.

Once the attacker has a “universal auth token”, he can trick the victim into visiting a malicious web page. If the user is logged into their PayPal account at the time, the attacker’s webpage can use the universal auth token to trick the victim’s computer into making many different PayPal requests. Examples include adding email addresses to the account, changing the answers to security questions, and more. All of this can be done simply by tricking the user into clicking on a single link. Pretty scary.

[Yasser] was responsible with his disclosure, of course. He reported the bug to PayPal and reports that it was fixed promptly. It’s always great to see big companies like PayPal promoting responsible disclosure and rewarding it rather than calling the lawyers. Be sure to catch a video demonstration of the hack below. Continue reading “Hacking PayPal Accounts With CSRF” →

[Amazing Science’s] Simple Electric Train

December 4, 2014 by 106 Comments

Making an electromagnet is as simple as wrapping some wire around a nail and taping the wire to both ends of a battery. When you’re done, you can pick up some paper clips – it demonstrates the concept well, but it could use some more oomph. [Amazing Science] has done just that, making an “electric train” (YouTube link). All that’s needed is some coiled copper wire, a battery and magnets thin enough to fit through the coils. The magnets snap onto both ends of the battery. Put the battery inside the coil and watch the fun! The electromagnetic force generated by the current moving through the coil pushes against the magnets attached to the battery, pushing the battery along the way.

[Amazing Science] plays with the setup a bit. Connect both ends of the coil together and the battery will travel in a loop until it’s drained. Add a small hill, or even another battery/magnet set to the mix, and watch them go! We may even make a version of this ourselves to take with us to family gatherings this holiday season – it’s simple, fun, and can teach the young ‘uns about science while we swig some egg nog.

[via Reddit]

Continue reading “[Amazing Science’s] Simple Electric Train” →

Flash Memory Endurance Testing

December 4, 2014 by 21 Comments

[Gene] has a project that writes a lot of settings to a PIC microcontroller’s Flash memory. Flash has limited read/erase cycles, and although the obvious problem can be mitigated with error correction codes, it’s a good idea to figure out how Flash fails before picking a certain ECC. This now became a problem of banging on PICs until they puked, and mapping out the failure pattern of the Flash memory in these chips.

The chip on the chopping block for this experiment was a PIC32MX150, with 128K of NOR Flash and 3K of extra Flash for a bootloader. There’s hardware support for erasing all the Flash, erasing one page, programming one row, and programming one word. Because [Gene] expected one bit to work after it had failed and vice versa, the testing protocol used RAM buffers to compare the last state and new state for each bit tested in the Flash. 2K of RAM was tested at a time, with a total of 16K of Flash testable. The code basically cycles through a loop that erases all the pages (should set all bits to ‘1’), read the pages to check if all bits were ‘1’, writes ‘0’ to all pages, and reads pages to check if all bits were ‘0’. The output of the test was a 4.6 GB text file that looked something like this:
Continue reading “Flash Memory Endurance Testing” →

Cutting Glass With CNC

December 4, 2014 by 33 Comments

Breaking a pane of glass in half is easy – just score it, break it, and after practicing a few times, you’ll eventually get it right. What about cuts that are impossible with a normal glass cutter, like radiused corners and holes? For that, you’ll need CNC. Yes, you can cut glass on a CNC machine. All you need is a diamond burr or glass drilling bit, high speeds, low feeds, and lots and lots of coolant.

Cutting glass on a CNC machine doesn’t require any spectacularly specialist equipment. [Peter] is using an $800 Chinese mini CNC engraver for this project, but that’s not the only tool that was required. A fixture for holding a glass plate was also needed, but [Peter] quickly fabricated one out of acrylic.

Cutting glass with a CNC is something we’ve seen before. [Ben Krasnow] has been using diamond burrs, high speeds, low feeds, and lots of coolant to cut mirrors so expensive you don’t even want to guess.

While [Peter] isn’t getting the perfect finish [Ben] got a few years ago, he’s still milling holes and slots in glass. He’s wondering if it could be possible to mill an aspheric lens using this technique and a special spherical burr, something that would be very interesting to see, and could be a pretty good way to rough out telescope blanks.

Serial Camera, Courtesy Of The STM32F4

December 4, 2014 by 47 Comments

Look around for a small, embedded camera module, and you’ll find your options are rather limited. You have the serial JPEG cameras, but they’re rather expensive and only have VGA resolution. A Raspi, webcam, and power supply is a false economy. GoPros are great, but you’re still looking at some Benjamins used.

The guys at GHI Electronics are taking a different tack. They’re using image sensors you would normally find in cellphones and webcams, adding a powerful ARM processor, and are still able to sell it for about $50. It’s called the ALCAM, and they’ve stumbled upon a need that hasn’t been met by any manufacturer until now.

On board the ALCAM is an OV3640 3-Megapixel image sensor. On the back of the board is a STM32F4 and a microSD card slot. The board can be set up for time-lapse videos, stop motion animation, or all the usual serial board camera functions, including getting images over a serial connection.

The ALCAM operates either connected to a PC though a 3.3V serial adapter cable, through a standalone mode with pins connected to a button or sensor, to the SPI bus on a microcontroller, or a serial to Bluetooth or WiFi bridge. Images can be saved to the uSD card, or sent down the serial stream.

It’s a pretty cool board, and if you’re thinking it looks familiar, you’re right: there’s a similar DSI camera/STM32F4 board that was an entry to The Hackaday Prize. Either way, just what we need to get better cameras cheaper into projects.

Penguin Binoculars

Happy Meal Hack Produces A Google Cardboard Test

December 3, 2014 by 27 Comments

Ever since Google Cardboard came out, [Julian Jackson] had been meaning to give it a shot. Affordable virtual reality? Who wouldn’t! But, he never got around to it — until one day he was sitting in McDonald’s with his son, explaining to him how the latest Happy Meal toy worked — it was a pair of penguin binoculars.

Fast forward past Thanksgiving and Black Friday and [Julian’s] son had completely forgotten about the McDonald’s toy in all the excitement, so [Julian] asked if he could have it. His son was mildly confused, but curious also, so he let his dad take his toy.

After attempting to dismantle it with a screw driver to get at the lenses, [Julian] carefully calculated the best place to simply break it without damaging them. With the precision of a heart surgeon he swung back his trusty hammer…  Continue reading “Happy Meal Hack Produces A Google Cardboard Test” →

Philly Fixers Guild Will Teach You How To Fish

December 3, 2014 by 16 Comments

One crisp Saturday afternoon a couple of weeks ago, the Philly Fixers Guild held its second Repair Fair. Not second annual, mind you; the first fair was held in September. People came from miles around, hauling with them basement and attic treasures that needed, well, fixing. [Fran] is one of the Guild’s volunteer fixers, and she shot some video of the event which is waiting for you after the break.

The Philly Fixers Guild aims to promote sustainability in the surrounding community by teaching interested parties to repair their possessions that might otherwise end up in a landfill. The fairs are not meant to be a drop-off repair site—attendees are expected to stay and learn about what’s wrong with their item and how it can or can’t be fixed.

The Guild is open to volunteers who are interested in teaching people how to fish, as it were. Expertise is not limited to electronics repair; guild members are just as interested in teaching people how to sew a replacement button on their winter coat or building that thing they bought at IKEA.

Nowhere near Pennsylvania? Several groups like the Philly Fixers Guild have already been established in a few larger US cities. If you’re not near any of those either (and we can sympathize), you could do worse than to start your own. If you’re part of a ‘space, creating such a guild would be a good way to spread the word about it and the gospel of DIY.

In the video, [Fran] discusses an Atari 2600’s control problem with its owner. She re-seats the 6532 RIOT chip and explains that this may or may not have solved the problem. If not, [Fran] is confident that new old stock chips are available out there on the hinterwebs. There might still be some landfill carts on ebay if the owner gets it up and running. [Fran] also fixes the controls on a Peavey amp and gets some Pink Floyd to issue forth from a previously non-functioning Zenith portable AM/FM radio that’s old enough to have a snap cover.

Continue reading “Philly Fixers Guild Will Teach You How To Fish” →