1

Yesterday my housemate was almost scammed by someone on the internet, or so I thought. She was selling some goods on a ebay-like website, and someone contacted her to buy her stuff. She then received a false email from "Paypal" telling her she had received a certain amount of cash (which was not exactly the one she asked, thus she thought something was wrong) from that person.

By error she clicked a link in the mail, allegedly linking to a PayPal payment reference. She said nothing was prompted to her, or downloaded and she exited the opened webpage immediately.

Later that day, she realized her PayPal credentials were not valid anymore, and when she tried to change them by asking new ones, the codes she got on her phone by SMS were not working at all. She had to contact PayPal support directly for help, and now her credentials work once more. She think nothing was stolen from her account in the mean time.

Could possibly the two events be linked ? Could it be that by a simple phishing attempt an attacker managed to retrieve her credentials even though she was not prompted a false PayPal login page ? If yes, how ?

4
  • yes, her credentials were stolen by the fake page
    – schroeder
    Commented Jun 12, 2017 at 12:02
  • 1
    The fake paypal link may launch exploit script without prompting.
    – mootmoot
    Commented Jun 12, 2017 at 12:40
  • I was not sure such methods did exist. So just by clicking the malicious link it was over ? I checked it myself by hovering and the link really seemed legitimate. By that I mean the domain name seems the good one (www.paypal.com, using https by the way). Yet it couldn't be a real link : no payment was made, the reference to a payment must be false.
    – Kaël
    Commented Jun 12, 2017 at 13:03
  • 1
    @schroeder How? If she did not enter them (easy to recall incorrectly, though), I don't see how this could work.
    – Anders
    Commented Jul 9, 2019 at 7:42

3 Answers 3

0

Yes it's possible especially if the housemate was already logged into PayPal or checks "keep me logged in", the attacker may have found a way to hijack the session , run a script to hook the browser , or an exploit is possible as well.

Then the attacker logged in and probably changed your email , and/or password and/or 2 factor number to control your account.

Check your transactions to ensure nothing else was sent or received.

1
  • 2
    Can you change password or authentication method without having to reenter your old password on Paypal? If this was only session hijacking, the attacker don't know the old password.
    – Anders
    Commented Jul 9, 2019 at 7:41
0

If a script changed her password she would have received an email informing her that her password was reset. Failing that her password wouldn't have been reset. She needs to look for a password reset email in her email account to know if that happened. Regardless how it was reset, PayPal generates an email immediately.

-1

I am flabbergasted by the amount of people here that are certain clicking on a simple link was what hijacked the Paypal account without any user action whatsoever.
While of course not impossible, if this was true, it'd suggest the existence of a zero-day-exploit threatening the whole internet as we know it.

What I think is more likely is that she either simply forgot her credentials, or her login was compromised from a different attack - most likely password reuse attack, where she used the same email-password-combination on a different website which got compromised.
The fake Paypal email - assuming it was fake - is a different scam attempt where the scammer will send out a fake payment notice from Paypal, hoping his victim does not double-check the account balance and will send out the goods anyway. Your roommate noticing her login isn't working could very well be a coincidence, especially if she didn't use it for some time and this transaction is what prompted her to check it.

5
  • Please do not provide commentary on other comments/answers in your answer.
    – schroeder
    Commented Jun 28, 2021 at 10:38
  • There have been many social engineering attacks that only required clicking a link in order to steal authentication tokens. As the other answer suggested, if the user was already logged into PayPal, then this is plausible, The link does not have to be a link. It can be a script that executes locally then launches a page to gather more data. This type of multi-staged attack is also common.
    – schroeder
    Commented Jun 28, 2021 at 10:46
  • @schroeder Your link mentions password spraying as the attack vector (same as my answer), as well as basic phishing, not the simple click on a link. Clicking on a link will not steal your credentials or compromise your account, unless there is an exploit worth millions of dollars present in either the browser or Paypal itself. I wonder how you can be so certain this is what caused the alleged breach into her account? The mystery link would've also needed to break the 2FA, know the original password and prevent any notifications from being sent out. Highly unlikely.
    – René Roth
    Commented Jun 28, 2021 at 10:58
  • I was part of the original NCSC investigation. I see that they have modified the information page. The original attack included a "button" that was a javascript element (1.5 MB of embedded code). The script stole and immediately used the authentication token even when 2FA was enabled. Microsoft has since patched the ability to do this. This is likely why the NCSC modified their guidance. But in 2017, when this was originally posted, this was still an issue. So, yes, it is possible to click a link and lose control over your account.
    – schroeder
    Commented Jun 28, 2021 at 11:47
  • That sounds really interesting and like a bad flaw in Microsoft's design! I would be interested in an in-depth writeup on this, archived versions of the NCSC writeup don't turn up more details either. IMO the chance of an exploit like this existing in Paypal are very low, and it would need to be combined with several other exploits to lead to the situation described here, but if true, should lead to a huge bug bounty payout by Paypal.
    – René Roth
    Commented Jun 28, 2021 at 15:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .