Forgot your password?
typodupeerror
Security

Trivial Bypass of PayPal Two-Factor Authentication On Mobile Devices 47

chicksdaddy (814965) writes "According to DUO, PayPal's mobile app doesn't yet support Security Key and displays an error message to users with the feature enabled when they try to log in to their PayPal account from a mobile device, terminating their session automatically. However, researchers at DUO noticed that the PayPal iOS application would briefly display a user's account information and transaction history prior to displaying that error message and logging them out. ... The DUO researchers investigated: intercepting and analyzing the Web transaction between the PayPal mobile application and PayPal's back end servers and scrutinizing how sessions for two-factor-enabled accounts versus non-two-factor-enabled accounts were handled. They discovered that the API uses the OAuth technology for user authentication and authorization, but that PayPal only enforces the two-factor requirement on the client — not on the server." The attack worked simply by intercepting a server response and toggling a flag (2fa_enabled) from true to false. After being alerted, PayPal added a workaround to limit the scope of the hole. Update: 06/26 00:42 GMT by T : (Get the story straight from the source: Here's the original report from DUO.)
Science

Biological Computer Created at Stanford 89

sciencehabit writes "For the first time, synthetic biologists have created a genetic device that mimics one of the widgets on which all of modern electronics is based, the three-terminal transistor. Like standard electronic transistors, the new biological transistor is expected to work in many different biological circuit designs. This should make it easier for scientists to program cells to do everything from monitor pollutants and the progression of disease to turning on the output of medicines and biofuels."
Bitcoin

Large Bitcoin Ponzi Scheme Collapses With a Loss of $5.6 Million 327

New submitter beltsbear writes "Despite the many people calling it out as a Ponzi scheme from the beginning, Pirateat40 was able to collect millions of dollars worth of Bitcoins from thousands of Bitcoin users. At almost every stage Pirateat40 copied the path of the EVE Online Ponzi scheme except on a much larger scale with a far more liquid take. Now, it has shut down, and investors are wondering where their digital currency went. Quoting: 'He claimed that BS&T was sitting on 500,000 BTC on the day of the shutdown, worth more than $5.6 million USD at today's price of $11.38. "Once my process is released you'll understand more of how coins move around," he told members of the Bitcoin community last week. Pirateat40 initially promised to refund his investors' Bitcoin deposits plus interest within a week, effectively admitting that he did not have the Bitcoins on hand. The fund normally paid out on Mondays, but last Monday and today have passed so far without refunds. BS&T investors are complaining loudly and so-called "pass-through" funds that invested with BS&T are shutting down. As of this writing, BS&T says there is "no ETA on payments."'"

Comment Re:$30 mil per movie title! (Score 1) 199

Taking this a step further, it will cost a total of 2.16 BILLION (30 Mil * 72) dollars for all 72 Dreamworks Films http://en.wikipedia.org/wiki/DreamWorks . Dividing that total cost by the 25 million subscribers arrives at a net cost of $86.40 per subcriber. This year they will only make 9.60 per subscriber, not including operating expenses.

Slashdot Top Deals

I never cheated an honest man, only rascals. They wanted something for nothing. I gave them nothing for something. -- Joseph "Yellow Kid" Weil

Working...