RSSSerious PayPal Flaw Disclosed
By Ed Oswald | Published June 16, 2006, 12:44 PM
A security flaw within the PayPal Web site is posing a serious threat to its users, security firm Netcraft said Friday. The credit card numbers and personal information of those duped by attackers is at risk through a cross-site scripting attack.
A fraudster tricks the user into divulging information by asking them to visit an actual PayPal URL. Since this is hosted by the company, it would appear as if information is encrypted through the company's own SSL certificates. However, through cross-site scripting, some of the information on the accessed page has been modified.
The faked page claims that the user's account has been disabled due to "third-party access," much like the current PayPal scams. But this one is very different, as the page that says this appears to be an actual PayPal page.
The user would then be redirected to a external server, but could be caught off guard and continue to enter personal information.
"The paypal.com domain name and SSL certificate he saw previously are likely to make him realize he has visited the genuine PayPal web site - why would he expect PayPal to redirect him to a fraudulent web site?" Netcraft's Paul Mutton said.
A user would then disclose their username and password, and be asked to enter further information to verify their identity. According to Netcraft, the page also asks for a social security number, credit card number, expiration date, card verification number and ATM PIN.
Netcraft said that its anti-phishing toolbar has been updated to block access to the external server the user is directed to, which resides in Korea. As of press time, PayPal had not publicly acknowledged or commented on the flaw.
This is almost as bad as a scam I saw where they mispelled the companys name like 100 times.
Score: 0
Just FYI, the PayPal guys claim the problem is resolved... http://www.tgdaily.com/2...06/19/paypal_fixes_flaw/
Score: 0
Why do these PayPal and other email/Internet scams go on and on? Surely law enforecement technology should be able to trace, hunt down, and imprison FOREVER these scumbag preditors!
I sure wish some very public trials would take place, with a lot of media publicity, and that very, very harsh "hard time" would be levied out to the offenders. Might send a deterent message!
Score: 0
if jailtime doesn't deter people from spamming, i don't think doing time will do much to combat scamming either.
Score: 0
I get about 5 emails a week saying my PayPal account has been disabled due to third party access.
It's crazy
Score: 0
ok how stupid is this this pay pal scam has been out since the begining of this year and they are dealing with it now
i am saying how stupid must you be to fall for such a thing i mean pay pal even disclose in fine print tho saying that at any moment they will not ask for any personal or account information via e-mail
plus this num nut prolly got one but always deleted it till one day he said hmmm might as well check it out
stupid ppl today i bet every one around the world even the ethiopians must have gotten this email and said nope sorry bulk mail report spam
get smart ppl dont get screwed over via internet
Score: 0
Wasted_elmo,
I'm a little confused as to the term you use "stupid". "Stupid ppl today"... "even the ethiopians got the e-mail"? So who is stupid, stupid? Easy really... Stop-Think-Talk not the other way round!
Score: 0
YOU know, I got sent one of these stupid scams in the e-mail. Anyone with an ounce of COMMON SENSE, (a sense that apparently no one has anymore); would see right through it.
Score: 0
LOL@losers falling for suckerscams!
Score: 0
Experienced users wouldd not fall for this.
People should realise that just because pc's are easy to use in that a kid can use them, they are a powerfull and potentially dangerious tool and if you dont know what ur doing then caution should be used.
Nobody pisses about with Gas, or tampers with the electric's of a house or lift the hood of the car and mess without decent knowledge. They dont give there card and pin to a stranger to get money, but show them a site and they will fall hand over fist to give there details in the hope of saving £/$ 2 on a ringtone or mp3. They happlessly click on any old link and fall for the obvious sucker punches, but if someone knocks to the door and offers to sell a bargain or save them money show the correct amount of doubt and reluctance to jump in head first like on the net.
The general public are poon's and if they didnt ultimatly cost me money why should i care. But they do .... Id let them be out of pocket and to hell with them, then the net would be a better place to be.
Score: 0
Korea needs the money!!!!
Score: 0
I am not looking for Gbuy, but competition is good. Ebay and Paypal are charging too much for their service. It's like 10% combine for low priced item, and 5% for high priced item. Basically, if your item has a low profit margin, half if not all of it will goes to Ebay.
Score: 0
Haha!
If you use Paypal still you deserve this. :)
Score: 0
Its better than some dumb a** sending a check/money order. Oh that's good security!
Score: 0
A followup to this story:
I have received a few e-mails saying that PayPal has already discussed this issue. Please note this is COMPLETELY different from the e-mail spoofs, which yes PayPal has addressed. While this may start from the spoof, this actually will use the ACTUAL PayPal website and not a faked site. Thus, it poses a serious security risk.
For more information, see the Netcraft link provided in the story.
Score: 0
IT IS NOT. The policy, on PayPal's website, security info, CLEARLY addresses *SPOOF* email's of this type.
*Fake links. The text in a link may attempt to look valid, then send you to a spoof address. Always check where a link is going before you click. Move your mouse over it and look at the URL in your browser or email status bar. If the link looks suspicious, don't click on it. And be aware that a fake link may even have the word "PayPal" in it.* - What part of -fake links- is misinterpreted.
*Learn more ways to spot spoof
Read PayPal's 10 ways to recognize fake (spoof) emails now.
Questions PayPal will never ask you in an email
To help you better identify fake emails, we follow strict rules. We will never ask for the following personal information in emails:
Credit and debit card numbers
Bank account numbers
Driver's License numbers
Email addresses
Passwords
Your full name
Ways to fight spoof
Report it. Forward the entire email - including the header information - or the site's URL to spoof@paypal.com We investigate every spoof reported. Please note that the automatic response you get from us may not address you by name.
Use Account Guard on the eBay toolbar. If you use Internet Explorer, download the eBay toolbar. Account Guard helps ensure you are on PayPal or eBay. Download the eBay toolbar now
Use the SafetyBar. Email security provider Cloudmark has engineered a toolbar for Microsoft Outlook you can use to report spoof emails. Should you receive a spoof, click the SafetyBar's "Block Fraud" button to automatically report it to us. Download the Cloudmark SafetyBar now* - from PayPal Site
You act like this is new, WE have been receiving these emails for a while now. Its new to *YOU*, not to US. I even forwarded Paypal an email of this type 2 months ago, which evidently you didn't even go that far to try and even contact PayPal directly, and PayPal even notes that they addressed this issue on their security info page.
READ THE ARTICLE. IT CLEARLY explains *ALL* the details in this article. This is NOT a new flaw, PayPal has ALREADY previously addressed it. IT's the SAME THING.
Score: 0
LMAO
You *do* realize you're telling the guy who wrote the article to read it, right?
...just 'sayin.
Score: 0
uhh....the part where you realize that it's not a *fake* link, but a *real* link, just that during your visit it redirects you to a non-paypal site.
but i agree. you should always manually type in a link instead of clicking on them for this sort of thing.
Score: 0
Wow is this timing or what? Google announces a new payment service, and NOW PayPal has a flaw..
Still, if you are prompted for ANY password information, it should raise a red flag, and you should NOT continue. NO LEGITIMATE website would NEED your password, they already have it. They may prompt you to confirm it, but you would then have to sucessfully login, and then reset it by answering some security question..
Vigilant. Its the new perception.
*As of press time, PayPal had not publicly acknowledged or commented on the flaw.*
This is TOTAL BS, it's even prominently displayed on the PayPal webpage as to fradulent emails.
Score: 0
only the dumb pay for their mistakes when it comes to phishing. the rest of us dont have to worry about it.
Score: 0
I concur.
Score: 0
I disagree, PayPal has ALWAYS been flawed. People like me have been scammed out of some serious money (like over $1700!) by falling between cracks in PayPal's so-called User Agreement.
www.nopaypal.com is a pretty good place to find out more information like this that doesn't hit the press and that a lot of PayPal users probably don't know... It's very sad that this company even exists.
PayPal should be embarrassed by some of the things I've read or found out...
Score: 0