cabennett85/gittest — Issue #672: Secure Paypal transactions
Author: cabennett85
Created: 2012-03-02 00:06:44+00:00
State: open

Hey guys,

Following up on that hack on our payments pages, here's what the guy did:
1) He intercepted the form data that we send to Paypal and changed the amount paid from $34.75 to $0.01 (on our side, I already take the precaution not to display the amount info in the payment form and fill it via ajax just before form submission - obviously this doesn't do anything to prevent the guy from taking the data after it leaves EP)
2) Paid the $0.01 on Paypal so a successful IPN was sent back to us (but with paid amount = $0.01 instead of $34.75)
3) He tried 4 times to copy/change the contents of the IPN and was successful on the 4th try (he basically changed the value he paid $0.01 back to $34.75 so that from our side it looks like he paid $34.75 to Paypal)

Note that this applies only to Paypal right now (I manually charge/confirm every Google checkout transaction since they don't offer IPN and Amazon has an encrypted signature required for each transaction which makes the form unchangeable).

I found some of Paypal's 'additional' security measures that allows encryption of their payment buttons, but I'm not sure if we work with public certificates, etc? Here's the link:
https://cms.paypal.com/us/cgi-bin/?cmd=_render-content&content_ID=developer/e_howto_html_encryptedwebpayments#id08A3I0P017Q

Neilio - can you take a look and we can discuss this more? Thanks!