Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

History

  • I got an email this afternoon to my gmail from "paypal@e.paypal.com" with mailed-by: na.e.paypal.com and signed-by: e.paypal.com. Gmail did not report it as spam/phishing/suspicious and it went straight to my inbox, so the MX records must check out.
  • The email effectively linked to this url.
  • The URL, when clicked, presents an HTTPS encrypted website bearing PayPal Inc's Class 3 EV certificate from Verisign, which is not easy to obtain.

By all accounts, it appears that the site is a legitimate PayPal property.

But then things start getting extremely suspect:

  • enter image description here

If you click "Continue" on that page, with or without entering any text in the email address field, it works -- it takes you to the "logged-in" site. Indeed, the "Log in" button at the top of the page turns to a "Log out" button. It's basically a smokescreen.

Then, immediately, you are greeted with a pane that displays cross-domain advertisements from other domains to try and get you to buy stuff. What in the world is the point of this website other than to display (possibly malicious / suspicious) third-party ads to get PayPal more money?

This makes absolutely no sense, and it really shakes my trust in PayPal as a company if they're willing to put their Class 3 EV cert on a site with this level of stupid. Also, the "AVAILABLE BY INVITATION ONLY" is completely a lie; you can go there on any computer in the entire world and click "Continue", and you're "in", for all that it's worth (which is, basically, nothing).

My concern is more that they implemented a website with such nonsense security; only sent out "invites" to certain users; and then had the gall to put their EV cert on it as if they endorse this hogwash. Why would a site go through the trouble of having an email "login" screen when what they want to do is to just display advertisements to anyone who's foolish enough to visit the site at all?

share|improve this question
    
I think the point of the website is exactly to display third-party ads to get PayPal more money. They're not an "electronic services vendor", they're a payment provider. They don't make money unless you spend your money somewhere else (...via PayPal...) –  gowenfawr Jan 22 at 22:48
1  
I'd remove the "What in the world is the point of this (...) just stop doing business with them" part, it distracts from the security / legitimacy aspects of the question (that are the focus of this site) and opens the possibility of dismissing your question as just an "old man rant" kind of "HOW COULD THEY!" –  That Brazilian Guy Jan 22 at 22:49
4  
If I click on the Continue button, I get a pop-up "whoops, we couldn't find your email" error. Maybe they fixed that? –  rossnz Jan 22 at 22:53
    
I just made a new In-Private Tab in Firefox (thus, not using any of my main browser's cookies) and still was able to get in without entering a valid email. Not sure why you are seeing something different. Might be the restrictive proxy I'm using for web access, but in that case, the question becomes, why would a restrictive proxy allow you through, unless it's doing client-side validation :P –  allquixotic Jan 22 at 22:59
    
Confirmed that it will indeed take you into page that shows log out button instead of log in. And I don't even have paypal account. It however did first display error but when I clicked on continue again it did take me on that ad page. I did not fill in that email field. –  Sampo Sarrala Jan 22 at 23:03

3 Answers 3

I have been doing further research, the special site has "PayPal, Inc[US]" certificate and the paypal original site has "PayPal, Inc.[US]" certificate (note the dot after Inc).

The certificates contain this (relevant) information:

CN = www.paypal-special.com
OU = Partner Support
O = PayPal, Inc
STREET = 2211 N 1st St
L = San Jose
S = California
PostalCode = 95131-2021
C = US
SERIALNUMBER = 3014267
2.5.4.15 = Private Organization
1.3.6.1.4.1.311.60.2.1.2 = Delaware
1.3.6.1.4.1.311.60.2.1.3 = US

CN = www.paypal.com
OU = PayPal Production
O = PayPal, Inc.
STREET = 2211 N 1st St
L = San Jose
S = California
PostalCode = 95131-2021
C = US
SERIALNUMBER = 3014267
2.5.4.15 = Private Organization
1.3.6.1.4.1.311.60.2.1.2 = Delaware
1.3.6.1.4.1.311.60.2.1.3 = US

There is something strange here as well, both certificates have the same serial number.

But, this certificate is quite expensive for two years (3 000 dollars) so I suppose the page is legit but a bit abandoned and they have not put enough effort in it.

Also, about the domain information, we can find the following data (which is consistant with the certificate information):

Domain Name: paypal-special.com
Registry Domain ID: 
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2013-12-23T04:01:12-0800
Creation Date: 2013-10-23T16:12:23-0700
Registrar Registration Expiration Date: 2015-10-23T16:12:24-0700
Registrar: MarkMonitor, Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email: 
Registrar Abuse Contact Phone: +1.2083895740
Domain Status: clientUpdateProhibited
Domain Status: clientTransferProhibited
Domain Status: clientDeleteProhibited
Registry Registrant ID: 
Registrant Name: Host Master
Registrant Organization: PayPal Inc.
Registrant Street: 2065 Hamilton Avenue, 
Registrant City: San Jose
Registrant State/Province: CA
Registrant Postal Code: 95125
Registrant Country: US
Registrant Phone: +1.4083767400
Registrant Phone Ext: 
Registrant Fax: 
Registrant Fax Ext: 
Registrant Email: 
Registry Admin ID: 
Admin Name: Domain Administrator
Admin Organization: eBay Inc.
Admin Street: 2145 Hamilton Avenue
Admin City: San Jose
Admin State/Province: CA
Admin Postal Code: 95125
Admin Country: US
Admin Phone: +1.4083767400
Admin Phone Ext: 
Admin Fax: +1.4083767514
Admin Fax Ext: 
Admin Email: 
Registry Tech ID: 
Tech Name: Host Master
Tech Organization: PayPal Inc.
Tech Street: 2211 North First Street
Tech City: San Jose
Tech State/Province: CA
Tech Postal Code: 95131
Tech Country: US
Tech Phone: +1.4083767400
Tech Phone Ext: 
Tech Fax: 
Tech Fax Ext: 
Tech Email: 
share|improve this answer
1  
Is it normal for two different EV certificates (for two different domains on .com) to have the same serial number but a different OU and O? How would this be possible? Maybe they have some kind of special agreement with Verisign only available to the largest of corporations (PayPal certainly qualifies as large)? –  allquixotic Jan 23 at 14:00
    
The serial of the certificate is a chain that you can select, it is used usually to identify them inside an organization or to automate processes. The serial is not automatically generated and it has nothing to do with the CA. –  kiBytes Jan 23 at 14:09
    
I very much doubt that PayPal will be paying the full $3000 off-the-shelf price for that certificate. They'll get discounts because they buy lots, and discounts because they have a lot more clout to negotiate. And even if they did, I wouldn't assume PayPal think $3000 is a significant amount of money. –  me_and Jan 30 at 9:53
    
Of course it is not, my point is that this certificate is expensive enough to prevent an unknown malicious user from buying it, and that is a clue more that leads me to think that the site belongs to paypal. –  kiBytes Jan 30 at 12:07

I often hear talk of "security theatre" – things that companies and organizations do to make people feel more secure without actually making them be more secure. The "security" on this site sounds a lot like that.

Unlike aeroplanes, however, this site doesn't actually need to be secure. It doesn't collect your PayPal password, it doesn't handle payments. All it does is provide advertising links and (presumably) set a few referrer cookies. It's not even on the regular PayPal domain.

The "security" here is simply because people expect to have a secure connection to PayPal. It's marketing, not actual security. PayPal haven't invested the money in making it actually secure because there's no reason to do so.

(Of course, the marketing may well have failed here because the "security" was too obviously theatre once you look below the surface, but that's still a marketing failure rather than a security failure.)

See also xkcd on the CIA website being hacked in 2011 – it's not concerning because the server that got hacked is simply not a server that needed to be particularly secure.

share|improve this answer

I got yeasterday e-mail from paypal@e.paypal and because I thought it maybe is not from PayPal I forwarded it to spoof@paypal.com. They answered me: "Hello Anne Palokangas, Thanks for forwarding that suspicious-looking email. You're right - it was a phishing attempt, and we're working on stopping the fraud. By reporting the problem, you've made a difference! Identity thieves try to trick you into revealing your password or other personal information through phishing emails and fake websites. To learn more about online safety, click "Security Center" on any PayPal webpage. Every email counts. When you forward suspicious-looking emails to spoof@paypal.com, you help keep yourself and others safe from identity theft."

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.