Latin America's Stripe competitor (Mercado Pago) API Security Hole(ombulabs.com)
ombulabs.com
Latin America's Stripe competitor (Mercado Pago) API Security Hole
http://www.ombulabs.com/blog/security/mercado-pago-security-vulnerability.html?utm_source=twitter
5 comments
It's amazing given how big they are in Latin America how this went by unnoticed.
Yes. I wish they were more like Github or Stripe about disclosing this sort of information.
Does Stripe operate in Latin America? How can they be competitors?
They don't, as you can see here: https://support.stripe.com/questions/what-countries-does-str...
So you're right, Mercado Pago and Stripe are not in direct competition, just in the same business.
So you're right, Mercado Pago and Stripe are not in direct competition, just in the same business.
They both operate in Mexico, so at least they compete in one country of Latin America.
Yeah, they don't operate in Latin America. Mercado Pago is Latin America's answer to Stripe, or PayPal, as I think they exist before Stripe came into scene.
Mercado Pago is 11 years old and part of the 16 year old Mercado Libre, which is like eBay and the number 1 Latin American ecommerce site.
Yeah, Mercado Pago has been around more than Stripe, but they are still rookies when it comes to their platform's security.
See Stripe's Security section: https://stripe.com/help/security
I'm still trying to find Mercado Pago's Security section and security vulnerability protocol (e.g. Who do I contact when I find the next security hole?)
See Stripe's Security section: https://stripe.com/help/security
I'm still trying to find Mercado Pago's Security section and security vulnerability protocol (e.g. Who do I contact when I find the next security hole?)
Just because they're not doing it like Stripe doesn't mean they're rookies, they also did $7.1 billion in transactions last year. Most companies have pretty obscure/lacklustre security outreach, it's something that's getting a lot more emphasis these days than it used to.
Just because they did $7.1 billion in transactions last year, it doesn't mean they're not rookies.
Most of the big IT companies in this side of the world follow the ideology of "we don't care about doing things correctly, we only care about getting the stuff done" and succeed because of the traction they generate due to the lack of serious competition.
Recently Amazon joined the e-commerce arena in Mexico, but my expectations are that Mercado Libre will follow the footsteps of Ask.com, Source Forge, etc. instead of improving, they have been arbitrarily doing UX anti patterns in the last years in order to protect their income at the expense of the users.
Most of the big IT companies in this side of the world follow the ideology of "we don't care about doing things correctly, we only care about getting the stuff done" and succeed because of the traction they generate due to the lack of serious competition.
Recently Amazon joined the e-commerce arena in Mexico, but my expectations are that Mercado Libre will follow the footsteps of Ask.com, Source Forge, etc. instead of improving, they have been arbitrarily doing UX anti patterns in the last years in order to protect their income at the expense of the users.
Maybe rookies wasn't the right word.
The fact that they allowed such a blatant vulnerability to reach production makes me question their test suite and development process. What else is wrong that we are not seeing?
I expect more transparency and professionalism from a company that processes $7.1 billion in transactions.
The fact that they allowed such a blatant vulnerability to reach production makes me question their test suite and development process. What else is wrong that we are not seeing?
I expect more transparency and professionalism from a company that processes $7.1 billion in transactions.
It's not unreasonable to expect better transparency, that's something that's improving too slowly. We don't even know if this was exploited yet and it's been a couple months and there's always a lot of opacity around hacking incidents.
Security is hard and accidents are easy, dropbox once had a four hour period where they didn't verify passwords!
http://techcrunch.com/2011/06/20/dropbox-security-bug-made-p...
Security is hard and accidents are easy, dropbox once had a four hour period where they didn't verify passwords!
http://techcrunch.com/2011/06/20/dropbox-security-bug-made-p...
That is pretty embarrassing too and even a bigger vulnerability, but Dropbox released a statement about it.
I believe that owning up to your mistake and being transparent about it can only make your customers trust you more. What worries me is that Mercado Pago is huge and they never released a statement about this issue. I hope that they change this policy soon.
I believe that owning up to your mistake and being transparent about it can only make your customers trust you more. What worries me is that Mercado Pago is huge and they never released a statement about this issue. I hope that they change this policy soon.
So what was the glitch?
Using their authentication mechanism, a user should only get an access token with the right combination of client id and client secret.
For at least 7 hours, anyone could get an access token for any client id, without entering the right client secret. With that access token they could see a lot of information for any account.
For at least 7 hours, anyone could get an access token for any client id, without entering the right client secret. With that access token they could see a lot of information for any account.
TL;DR: You could provide a "lalala" secret, or "whatever", and it would provide you with an actual access token for any client ID you passed for Mercado Pago's production server.
eBay is the largest common stocks owner in MercadoLibre
The title should be changed to something like "Latin America's Stripe competitor didn't validate access tokens", almost nobody from outside LATAM will ever know what Mercado Pago is, neither why the discussion of this vulnerability matters.
It's not a bad suggestion, but I'd keep Mercado Pago in the title as well. Mercado Libre/Pago is huge here in Latin America, and I wouldn't have read this post otherwise.
I've updated the post title with your suggestions. Thanks!