Key Takeaways
- Tus kws tshawb fawb txog kev nyab xeeb tau qhia tias PayPal qhov kev them nyiaj ib-nias li cas tuaj yeem raug tsim txom los nyiag nyiaj, nrog rau ib zaug.
- Tus kws tshawb fawb tau lees tias qhov muaj qhov tsis zoo tau pom thawj zaug thaum Lub Kaum Hli 2021 thiab tseem tsis tau kho kom txog rau hnub no.
- Cov kws tshaj lij kev nyab xeeb qhuas qhov tshiab ntawm kev tawm tsam tab sis tseem tsis ntseeg txog nws qhov kev siv tiag tiag.
Tig PayPal qhov yooj yim them nyiaj rau ntawm nws lub taub hau, nyem ib zaug yog txhua yam uas tus neeg tawm tsam xav tau kom tshem koj tus lej PayPal.
Tus kws tshawb fawb txog kev nyab xeeb tau pom qhov nws tau hais tias yog qhov tsis muaj qhov tsis txaus ntseeg hauv PayPal uas tuaj yeem tso cai rau cov neeg tawm tsam kom npliag tus neeg raug tsim txom tus account PayPal tom qab ntxias lawv mus rau nyem qhov tsis zoo txuas, hauv dab tsi yog technically hu ua clickjacking. nres.
"Qhov kev pheej hmoo ntawm PayPal clickjack yog qhov tshwj xeeb hauv qhov uas feem ntau nyiag tus nias yog kauj ruam ib rau ib qho kev tawm tsam lwm yam," Brad Hong, vCISO, Horizon3ai, hais rau Lifewire hauv email. "Tab sis hauv qhov piv txwv no, nrog rau ib qho nyem, [qhov kev tawm tsam pab] tso cai rau tus nqi them nyiaj los ntawm tus neeg tawm tsam."
Hijacking Clicks
Stephanie Benoit-Kurtz, Tus Thawj Coj Kws Qhia Ntawv rau Tsev Kawm Qib Siab ntawm Cov Ntaub Ntawv Txheej Txheem thiab Tshuab ntawm University of Phoenix, ntxiv tias clickjacking tawm tsam cov neeg raug tsim txom kom ua tiav kev lag luam uas txuas ntxiv pib ua haujlwm sib txawv.
"Los ntawm kev nyem, malware raug teeb tsa, cov neeg ua phem tsis zoo tuaj yeem sau npe nkag, passwords, thiab lwm yam khoom ntawm lub tshuab hauv zos thiab rub tawm ransomware," Benoit-Kurtz hais rau Lifewire dhau email."Tshaj qhov tso nyiaj ntawm cov cuab yeej ntawm tus kheej lub cuab yeej, qhov tsis zoo no tseem tso cai rau cov neeg ua phem nyiag nyiaj los ntawm PayPal account."
Hong piv rau clickjacking tawm tsam rau lub tsev kawm ntawv tshiab txoj hauv kev ntawm cov uas tsis tuaj yeem kaw cov popups ntawm cov vev xaib streaming. Tab sis tsis txhob zais X kom kaw, lawv zais tag nrho cov khoom kom ua raws li cov vev xaib raug cai.
"Qhov kev tawm tsam dag ntxias cov neeg siv xav tias lawv tau nyem ib yam thaum qhov tseeb nws yog ib yam txawv kiag li," piav qhia Hong. "Los ntawm muab cov txheej txheem opaque nyob rau sab saum toj ntawm thaj chaw nyem ntawm nplooj ntawv web, cov neeg siv pom lawv tus kheej mus rau txhua qhov chaw uas yog tus tswv los ntawm tus neeg tawm tsam, yam tsis tau paub."
Tom qab perusing los ntawm cov lus qhia txog kev tawm tsam, Hong tau hais tias nws ua haujlwm los ntawm kev siv tsis raug cai PayPal token, uas yog lub khoos phis tawj uas tso cai rau txoj kev them nyiaj tsis siv neeg ntawm PayPal Express Checkout.
Kev tawm tsam ua haujlwm los ntawm kev tso qhov txuas zais hauv qhov hu ua iframe nrog nws qhov opacity teeb ntawm xoom nyob rau sab saum toj ntawm kev tshaj tawm rau cov khoom raug cai ntawm qhov chaw raug cai.
"Cov txheej txheem zais cia coj koj mus rau qhov yuav zoo li cov nplooj ntawv khoom tiag tiag, tab sis hloov, nws tau kuaj xyuas seb koj puas tau nkag mus rau hauv PayPal, thiab yog tias muaj, nws muaj peev xwm thim nyiaj ncaj qha los ntawm [koj.] PayPal account, " shared Hong.
Kev tawm tsam dag ntxias cov neeg siv xav tias lawv tau nyem ib yam thaum qhov tseeb nws yog ib yam txawv kiag li.
Nws ntxiv qhov kev rho tawm ib-nias yog qhov tshwj xeeb, thiab qhov zoo sib xws clickjacking bank frauds feem ntau koom nrog ntau lub clicks los ntxias cov neeg raug tsim txom kom lees paub qhov kev xa ncaj qha los ntawm lawv lub txhab nyiaj lub vev xaib.
Kev mob siab ntau dhau?
Chris Goettl, VP ntawm Kev Tswj Khoom Muag ntawm Ivanti, hais tias yooj yim yog ib yam dab tsi uas cov neeg tawm tsam ib txwm saib kom zoo dua.
"Ib-nias them nyiaj siv cov kev pabcuam zoo li PayPal yog qhov yooj yim uas tib neeg tau siv los siv thiab yuav zoo li tsis pom qee yam tawm me ntsis hauv qhov kev paub yog tias tus neeg tawm tsam nthuav tawm qhov tsis zoo txuas, "Goettl hais rau Lifewire ntawm email.
Txhawm rau cawm peb kom tsis txhob poob rau qhov ua kom yuam kev no, Benoit-Kurtz tau tawm tswv yim ua raws li kev nkag siab zoo thiab tsis txhob nyem qhov txuas hauv txhua hom popups lossis cov vev xaib uas peb tsis tau mus rau, nrog rau hauv cov lus, thiab email, uas peb tsis tau pib.
"Ntxim qab kawg, qhov muaj qhov tsis zoo no tau tshaj tawm rov qab rau lub Kaum Hli 2021 thiab, txog niaj hnub no, tseem yog qhov tsis paub txog qhov tsis zoo," taw qhia Benoit-Kurtz.
Peb tau xa email rau PayPal kom nug lawv cov kev xav ntawm tus kws tshawb fawb qhov kev tshawb pom tab sis tsis tau txais cov lus teb.
Goettl, txawm li cas los xij, tau piav qhia tias txawm hais tias qhov tsis zoo yuav tseem tsis raug kho, nws tsis yooj yim rau kev siv. Rau kev ua kom yuam kev ua haujlwm, cov neeg tawm tsam yuav tsum tau nkag mus rau hauv lub vev xaib raug cai uas lees txais cov nyiaj them los ntawm PayPal thiab tom qab ntawd ntxig cov ntsiab lus tsis zoo rau tib neeg nyem.
"Qhov no yuav pom nyob rau lub sijhawm luv luv, yog li nws yuav yog kev siv zog rau qhov nce qis ua ntej qhov kev tawm tsam yuav raug tshawb pom," xav Goettl.
