QuoteA security research firm has discovered several security problems with PayPal’s iPhone app, warning that hackers can use man-in-the-middle attacks to steal sensitive user data.
QuoteAccording to an audit of the app by Chicago-based viaForensics, the vulnerability stems from the app’s failure to confirm the authenticity of PayPal’s website when communicating over the Internet.
Without that confirmation, a hacker could electronically step between a user and PayPal, pretend to be the PayPal website and gather usernames and passwords. The hacker would need to be in the same physical location as the user or have gained access to the same Wi-Fi network.
In practice, that could mean setting up a Wi-Fi hotspot in a location, such as a train station, and waiting for someone to use the network for a PayPal transaction on their iPhone app. It would be a fishing expedition, but the equipment and software needed is commonly available.