PayPal HTF?

So it seems that someone got my PayPal password. I'm asking for your guys' advice because I'm actually pretty stumped on how it was stolen. I'd never fall for a phishing site or email and even If I would, I simply haven't gotten any phishing emails so I've ruled that out. The only thing I know is, I bought something with "Buy It Now" on ebay last night around 11pm. I payed it with PayPal and went to bed. This morning I found that someone had sent themselves a nice amount of money from my PayPal account. The last time I used PayPal before that was a couple weeks ago so I can only assume that this is related to last night's purchase...somehow. I thought maybe I had a trojan or something - which seems unlikely since I use Firefox and I never really download any apps or appZ ;) But I did a full scan with Mcafee and AVG and they found nothing. I NOW have Sunbelt Firewall running and its not detecting any weird outgoing connections. Lastly, my PayPal password was unique and impossible to be guessed and pretty hard to brute-force. I checked if my local DNS had been modified - it doesn't seem to be and I can ping paypal at their real IP.

Any ideas? I'm pretty perplexed! Unless it's that guy with the binoculars across the street....

Hello fetuz, and welcome to AO.

Quote:

---

I found that someone had sent themselves a nice amount of money from my PayPal account.

---

That is called fraud where I come from..... report it to the law enforcement agencies and to paypal.

:)

Quote:

---

Originally Posted by fetuz

So it seems that someone got my PayPal password. The only thing I know is, I bought something with "Buy It Now" on ebay last night around 11pm. I payed it with PayPal and went to bed.

---

So did the "Buy It Now" purchase go thru? I'd be wondering if that really was eBay's site I was on. Phishing can be very deceptive. I got caught a couple of years back. Backed out of a site after entering my user name and password but before submitting them. They caught my details anyway. Next day I was apparently the happy seller of a Bo-Flex machine.

Quote:

---

Originally Posted by fetuz

I thought maybe I had a trojan or something - which seems unlikely since I use Firefox and I never really download any apps or appZ ;) But I did a full scan with Mcafee and AVG and they found nothing. I NOW have Sunbelt Firewall running and its not detecting any weird outgoing connections. Lastly, my PayPal password was unique and impossible to be guessed and pretty hard to brute-force. I checked if my local DNS had been modified - it doesn't seem to be and I can ping paypal at their real IP.

---

You the only one using that computer? You might try one of the online scans too.

Hey guys, thanks for the replies. I used Mcafee's online scanner - it didn't find anything. The Buy It Now purchase went through fine and shows up in my ebay and paypal account. I actually made 2 purchases that night. The time that the fraudulent transfer was made was VERY close to the time that I sent the money for the second auction (which has also gone through fine, with item shipped). None of my other accounts have been compromised, so it seems specific to PayPal. I would think if it was a keylogger, other accts would be screwed.
I'm totally clueless!

I have a dumb question. Are you using wireless?

Yea - I'm on wireless with WPA. I guess if someone cracked my wireless, then used some Windows exploit on me, that could be a possibility. Otherwise, just sniffing traffic? Even through https?

Two things. Even though you're using WPA, your passphrase can still be brute-forced and/or dictionary attacked. Do you have a complex passphrase?

And

Quote:

---

Otherwise, just sniffing traffic? Even through https?

---

Just remember that your HTTPS connection is between your router and the PayPal server. What floats through the air between your computer & your router is only as secure as your passphrase.

I've never done it but, if they get your passphrase, I'm guessing they could hang out & collect your wireless traffic, then decrypt it.

My passphrase is pretty long, brute forcing it would be impressive. Isn't the HTTPS between my browser and the PayPal server? No one on the same network should be able to decrypt my https packets... :err:

Quote:

---

Originally Posted by fetuz

None of my other accounts have been compromised, so it seems specific to PayPal. I would think if it was a keylogger, other accts would be screwed. I'm totally clueless!

---

Would the other acct's be screwed? Any money in the other acct's? Follow the money.

Were both auctions via eBay? I'm under the impression Paypal transaction take place without a vendor/seller being privy to acc't details. Any reason to think a vendor/seller perpetrated this thing?

And are you the only one using that PC? I'd do a search for any recent .exe's or .dll's by datestamp. Go back 2 weeks, maybe a month. Doesn't take long. Compromised PC's usually have new files to reveal.

http://antionline.com/showthread.php?t=271614

Quote:

---

My passphrase is pretty long, brute forcing it would be impressive

---

Does it meet typical complexity requirements? While length is good, mixing in symbols, uppercase/lowercase, & numbers really adds strength. If it's long but, uses standard wording, it can be brute forced.

Quote:

---

Isn't the HTTPS between my browser and the PayPal server?

---

The connection between what you see on your monitor & the path it takes to get there can be confusing when you use wireless.

Computer-->(WPA encrypted traffic)-->wireless router--> Internet

Basically, there's no HTTPS between your computer and your wireless router. The conversation between your wireless card & your wireless router doesn't use the internet. That's what WPA is for. It encrypts traffic between your computer & your wireless router.

Quote:

---

Originally Posted by ShagDevil

Basically, there's no HTTPS between your computer and your wireless router. The conversation between your wireless card & your wireless router doesn't use the internet. That's what WPA is for. It encrypts traffic between your computer & your wireless router.

---

Wouldn't there be https between the computer and Paypal via the router?
The router wouldn't be encrypting and decrypting SSL packets? Https is
all tcp/ip whether it's inside the router or outside, and as such would be
encrypted on either side except at the endpoints, which the router is not.

Yeah, you're right. For whatever reason, I've been thinking of HTTP this entire time. Even if his WPA passphrase is brute-forced, the HTTPS traffic will still be garbled nonsense.

Hmmmmm,

Having worked as an auditor for a number of years in my early career, all I can say is follow the money. If money is taken out of an account it has to go somewhere, and that is what law enforcement and paypal are for ;)

I will reiterate previous requests for information regarding physical security of the PC and the router. Also, are you sharing a connection over a network or is this a stand alone set up entirely under your physical control.

Sometimes it is beneficial to start with the answer and work back to the question? If I know where the money went, it might give me an idea of who did it, and that could lead me to how?

Confirmed:


The HTTPS session exists between the computer and the HTTPS server via the router. The HTTPS traffic is simply encapsulated inside the WPA traffic.

Anyone else feel uneasy?

Like if someone rips me off I call the police........... unless I already have a pretty good idea, and the answer is too close to home?

I would start looking for physical devices, a divorce lawyer, and a residential school somewhere in the desert :lildevil::xbones:

;)

nihil is quite right. You mustn't approach this purely as a hack, it's actual crime. Immediately inform paypal and authorities. A good computer crime division will send expert forensic team to analyze your equipment, as well as follow the money trail.
An extremely common error of hackers is that they will transfer money to their accounts, or purchase somenthing very traceable (passing through customs, or having DHL tracking). I bet that PayPal will also do everything they can to help you in order to keep their good name.
I would appreciate it if you keep us posted on the results

Thanks for the replies!

First thing I did was contact PayPal. They are going through their normal process. It should take 10 days and I should get my money back.

At this point I'm just trying to figure out how it happened so it doesn't happen again.

So, I'm the only one that uses this computer besides my girlfriend who checks her gmail. I'm connected to a wireless router with WPA, the router is connected to a cable modem, I'm the only one on the network. No one else knew my PayPal password and I didn't use that same password for another account.

I'm 99% sure I don't have a keylogger, unless it's the most stealthy, unknown one that exists or it deleted itself (which I've never heard of). That pretty much leaves:

- Network sniffing: Unlikely because of WPA and HTTPS
- Phishing: Unlikely
- XSS on Ebay Auction: If this is even possible, doesn't look like it happened
- Bruceforced: Pretty unlikely considering the password

Hmmmm,

Self-deleting keyloggers do exist.

All I can suggest is:

1. Get A-squared, update it and run it in safe mode with all scanning options "on".

http://www.emsisoft.com/en/software/free/

2. Get a file recovery tool such as UndeletePLUS and run that. Look for files around the date of the incident.

Quote:

---

Originally Posted by nihil

Hmmmm,

Self-deleting keyloggers do exist.

All I can suggest is:

1. Get A-squared, update it and run it in safe mode with all scanning options "on".

http://www.emsisoft.com/en/software/free/

2. Get a file recovery tool such as UndeletePLUS and run that. Look for files around the date of the incident.

---

Re: #1. Nothing came up here
Re: #2. This didn't show much at all. I had a BSOD today which dumped my ram and probably wiped out a lot of "undeletable" files.

One thing I noticed is that I have 2 emails: One is confirmation that I won the auction (which I did with Buy It Now), the other one is confirming one of the fraudulent transfers (there were more than 1). What's weird is that both have the same exact time (1:19AM). I didn't actually pay until 1:22 though.

How about something like this?
http://www.falle-internet.de/de/html/pr_exme_engl.php

Yes, XSS or some other drive by would seem the most likely candidate, and I would suspect the page on which you made the "buy now" purchase, or one you visited prior to that. I am guessing that the other one took longer to confirm?

Assuming that the times are correct, or at least from the same source then it can be explained.

It would still require something to be loaded onto your machine, I would have thought?

A possible scenario might be:

1. You log onto e-bay and start looking at stuff.
2. You visit a contaminated page and malware is loaded onto your machine.
3. You decide on a "buy now transaction"
4. You open your pay pal account and authenticate yourself. That gets your pay pal details and password to the fraudster.
5. The fraudster now has to move quickly or there is a good chance that you will spend the money before his transaction goes through. Possibly a bot does that?

I am not sure why the transaction was split, as I don't know enough about the internal workings of paypal. Were they both for the same amount? A common reason is to avoid some sort of internal control threshold, although if the amounts are the same it could be just a badly programmed bot? Were the two fraudulent transactions at the same time?

The main problem with fraud from the criminal's viewpoint is converting the transactions into cash or goods whilst avoiding detection. This is when most of them get caught.

Whatever was on your computer would uninstall itself as it is a potential evidence trail back to the fraudster? It might have loaded itself directly into RAM as I have read of recent malware that can do this.