***Caution***: Paypal Users - Page 10

dragon · 08-02-2005, 22:46

got one of those emails forwarded it to spoof at paypal dot com and then deleted it

BootBoy · 09-02-2005, 11:09

I got this mail as well, on an address only ever used here.

I can see a pattern!

Padawan · 09-02-2005, 11:19

Hi everyone

Just thought I would mention that I only registered here about 10 minutes ago and I received the paypal spoof email so probably not anything to do with this site IMHO.

Incidentally, I receive upwards of 20 spoof paypal messages PER DAY, along with similar for all sorts of US banks and other institutions I have never heard of let alone got an account with.

Leads me to believe some script kiddie is just emailing to a whole host of randomly generated email addresses in the hope someone will be caught off guard and give them access to their accounts.... and I know a few who have !

ian@huth · 09-02-2005, 11:38

Padawan,

to cableforum. I wouldn't think that any spammer would only target one group of users. There are probably hundreds of methods that have been used to get email addresses so your experience does not mean that they have chosen addresses at random. I would be extremely worried if I got 20 spoof Paypal messages a day and would ditch the addresses that they were coming in on and modify my use of the new ones that take their place

Padawan · 09-02-2005, 11:54

Hi ianathuth

What you say is fair comment and I fully understand that my surfing habits could lead to my email addresses becoming know to spammers, spoofers, etc. However the baffling part for me is that I receive these and other spoof emails on addresses that I have set up but NEVER used either for incoming / outgoing email or registering with any website. Hence that I believe SOME of these emails at least must be sent out at random.

ian@huth · 09-02-2005, 11:57

Quote:

Originally Posted by Padawan

Hi ianathuth

What you say is fair comment and I fully understand that my surfing habits could lead to my email addresses becoming know to spammers, spoofers, etc. However the baffling part for me is that I receive these and other spoof emails on addresses that I have set up but NEVER used either for incoming / outgoing email or registering with any website. Hence that I believe SOME of these emails at least must be sent out at random.

Yes, some are sent out to random addresses but these are usually dictionary attacks on specific domains.

BootBoy · 09-02-2005, 12:13

Quote:

Originally Posted by Padawan

Hi everyone

Just thought I would mention that I only registered here about 10 minutes ago and I received the paypal spoof email so probably not anything to do with this site IMHO.

Incidentally, I receive upwards of 20 spoof paypal messages PER DAY, along with similar for all sorts of US banks and other institutions I have never heard of let alone got an account with.

Leads me to believe some script kiddie is just emailing to a whole host of randomly generated email addresses in the hope someone will be caught off guard and give them access to their accounts.... and I know a few who have !

That message and its variants are being sent out every day by the million.

The point is that myself and several other people used a unique address here, which received that particular mail (probably in the same mailshot).

It's probably not a dictionary attack either. I have my own domain that has at the moment about 20 live address's in total, it's not cost effective to spam a small domain using that method. gmail, hotmail, ntlworld yes. joebloggs.com, no!

dragon · 09-02-2005, 13:41

Quote:

Originally Posted by BootBoy

That message and its variants are being sent out every day by the million.

The point is that myself and several other people used a unique address here, which received that particular mail (probably in the same mailshot).

It's probably not a dictionary attack either. I have my own domain that has at the moment about 20 live address's in total, it's not cost effective to spam a small domain using that method. gmail, hotmail, ntlworld yes. joebloggs.com, no!

you use your domain email here? we allowed to do that when i first registerd on .com i tryed to use mine and they said it had to be an isp address

Mal · 09-02-2005, 14:24

Quote:

Originally Posted by dragon

you use your domain email here? we allowed to do that when i first registerd on .com i tryed to use mine and they said it had to be an isp address

You can use any on this site, but on the .com site it did have to be an isp address...

dragon · 09-02-2005, 14:51

Quote:

Originally Posted by Mal

You can use any on this site, but on the .com site it did have to be an isp address...

ah thanks changed it to my gmail i like to have all my forum notifiers go there as it seaperates it from the rest of my email

better get back on topic...

when we forward these to spoof at paypal dot com do paypal really bother to investigate or are they just saying that

BootBoy · 11-02-2005, 11:07

So, anybody any clue as to how the address's were compromised?

**Paul** · 11-02-2005, 11:37

Quote:

Originally Posted by BootBoy

So, anybody any clue as to how the address's were compromised?

Clues - yes. Certainties - no.

We think it was via the nthellworld domain. A quite old copy of the vB software was still present on the old domain (which we hadn't realised) and this had a number of security holes in it that could have been used to extract addresses, if someone with the right technical knowledge had wanted.

There is no way of ever actually proving this, other than a confession from the people involved, but after three days of investigations, this seemed the most likely route. It doesn't explain why only a selection of addresses appear to have been extracted.

Needless to say, that old software has been removed (and a few other changes made).

BootBoy · 11-02-2005, 14:06

Quote:

Originally Posted by Paul M

Clues - yes. Certainties - no.

We think it was via the nthellworld domain. A quite old copy of the vB software was still present on the old domain (which we hadn't realised) and this had a number of security holes in it that could have been used to extract addresses, if someone with the right technical knowledge had wanted.

There is no way of ever actually proving this, other than a confession from the people involved, but after three days of investigations, this seemed the most likely route. It doesn't explain why only a selection of addresses appear to have been extracted.

Needless to say, that old software has been removed (and a few other changes made).

Oh well, stuff happens I guess.

This serves as an excellent demonstration as to why you should use disposable but traceable address's.

Bifta · 11-02-2005, 16:13

Can I just repeat my earlier question re: the DPA and NTHW Ltd?

gazzae · 11-02-2005, 16:27

I got the email as well