eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Online payment company PayPal reported that it has fixed a Web site glitch through which the operators of a phishing scheme had been attempting to steal personal data of the companys customers.
According to officials for the eBay subsidiary, PayPal updated coding on its Web site to block a vulnerability that phishers based in South Korea had been exploiting in an effort to rip off its members.
The sophisticated threat attempted to lure unsuspecting users to a URL hosted on PayPals legitimate Web site that had been altered by cyber-criminals using a so-called cross-site scripting attack.
Using such attacks, criminals seek out vulnerabilities in legitimate Web pages and add their own code in order to append their own content to the sites or redirect users to other fraudulent sites.
The schemes can also steal information stored as so-called Web browser cookies, which often contain user names, passwords and other sensitive data.
Upon visiting the PayPal page in question, users were presented with a message secretly injected onto the site telling them that their accounts had been locked due to unauthorized access and asking them to wait while they were redirected to an account “resolution center.”
After a short delay, users were redirected to an external server that presented them with an entirely fake PayPal URL and member log-in interface.
Those who logged into the fake site effectively passed their account information onto the fraudsters, who also presented any visitors with a second totally illegitimate page asking individuals to relax the user control settings of their PayPal accounts and share even more personal information, including their social security numbers, credit card numbers and ATM pin numbers.
PayPal representatives said that in addition to blocking the vulnerability, the company is working with the Korean Internet service provider hosting the criminal site, and reported that the firm is cooperating with its investigation.
The eBay company said it was impossible to estimate just how many people had visited the altered Web page, but indicated that the firm has not received a large number of inquiries from concerned members.
The payment company is encouraging any customers concerned that they may have accessed the fraud sites to change their PayPal log-in passwords.
For any customers whose information is stolen and misused, PayPal said it is also offering to reimburse the full amount of any related losses.
The company said it has added the phishing URL to its security toolbar, preventing users of the browser-borne application from accessing the site altogether.
According to researchers at security specialist Netcraft, the altered Web site used SSL (secure sockets layer) encryption to cloak information being transmitted to and from the site, and the page even featured a validation certificate meant to confirm its authenticity as a legitimate PayPal site.
While some researchers have heralded a slowdown in the sheer volume of phishing attacks being launched against users, many experts believe that, like computer viruses, the attacks are merely becoming more focused on specific sets of victims, such as PayPal customers.
The attacks are also becoming increasingly sophisticated, with more schemes involving cross-site scripting and other more technologically advanced techniques.
It appears that criminals are also making a healthy living off of their efforts.
Japanese law enforcement officials recently arrested a group of eight individuals allegedly responsible for using fake Yahoo Auctions schemes to rip off as many as 700 different people to the tune of roughly $900,000.