The Security Risks of Venmo: A Hacker's Perspective

As I navigated through the Venmo app, I couldn't help but notice the live feed of transactions being made by strangers. It was as if I was eavesdropping on people's financial activities in real-time. But what struck me most was the potential security risks associated with this popular payment platform.

In my previous article, I discussed how an attacker could potentially use Venmo data for blackmail. However, it's not just that. A quick search for specific drug names and slang terms revealed hundreds of transactions on the app. This raises concerns about money being exchanged for non-legal goods.

Furthermore, I discovered a public API endpoint that returned transaction data without any authorization needed. This means that anyone can make a GET request to access the latest 20 transactions made by anyone around the world. As someone who has experience in information security, this vulnerability is quite alarming.

I experimented with making requests for transaction data per minute, per IP address, and was surprised to find that I could do so without any limits. This raises concerns about the potential for spearphishing attacks using Venmo data.

As a graduate student studying information security at the time, I thought I might be able to make some extra cash by exploiting these vulnerabilities. I used my laptop to proxy my phone traffic and watched the network traffic as I navigated through the app. Unfortunately, I didn't find any significant issues that would allow me to exploit the system.

Despite this lack of success, it's important to note that Venmo is owned by PayPal, which has a public bug bounty program. This means that hackers like myself can report security vulnerabilities in its products and receive compensation.

In conclusion, while my attempts to hack into Venmo were unsuccessful, I hope that this article highlights the potential security risks associated with this popular payment platform. It's important for users to be aware of these risks and take steps to protect themselves from potential cyber attacks.

Download venmo plaid