Security Researcher Hijacks PayPal Accounts via Flash File

A security researcher has discovered a flaw in the PayPal website so he could take over users' accounts. The vulnerability was in the page to generate invoices. The page allows users to upload different types of files. PayPal turned out only to check the extension of the uploaded files, not the content, so the researcher discovered.

This allowed him to a Flash file with full read on www.paypal.com upload. Then, to take account of a user, the user must visit a Web site of the researcher. The researcher can then execute arbitrary commands with the PayPal account, such as the transfer of money and steal data.

The researcher reported the problem with us that rewards bug reports through a special program. However, eight days after he was told that another researcher had already reported the problem and, therefore, no compensation was paid. "I know that researchers sometimes find the same bugs, but I think that PayPal better to deal with this double bug reports," said the disappointed researcher.

Microsoft - Beware of Payment Report Malware

Microsoft has warned Windows users to a malicious spam attack that attempts to infect recipients with malware. In the mail, with the subject "Payment Report - importan", it is stated that the recipient of the email received an amount of $ 35,000.

More details would be in the included zip find attached. The zip appendix contains a .scr file with a PDF icon. Because Windows default file extension does not display, users would have thought that it is a PDF document. Depending on the set display of folders, Windows will still show that it is a screensaver.

If the attachment is opened the computer becomes the Upatre downloader infected. This downloader can then again download other malicious software. According to Microsoft, the malware would be seen especially in consumer and business computers in North America.

Virustotal Report:

MD5: 5a0e6a8f6d3afd811a109df2e1ee727b