HUGE security breach! Please help!

  • Resolved directino

    (@directino)


    5 months, 2 weeks ago

    We got a signal from a client that made an order and did not receive a confirmation. There was no incoming payment in the our PayPal account or in the Woocommerce order menu. So when we did the same step by step with Dutch IP (same as the client) there was an iDEAL payment option in the PayPal plugin menu for the Netherlands that redirected to this domain r3.girogate.de. Then a payment would be send to a german bank account with our sites name that we do NOT own.

    The scam is commented here – https://www.reddit.com/r/Netherlands/comments/134nqd4/phishing_dutch_bank_scam_via_stripe_ideal_payment/

    I returned the PayPal plugin version to the previous one (2.7.1) and now the problem seems fixed. But I would like more solid solution. Is my site compromised? Is your plugin compromised? What would you suggest? Thank you!

Viewing 4 replies - 1 through 4 (of 4 total)
  • Thread Starter directino

    (@directino)

    Just updated to 2.8.0 again and the problem seems solved for now. But still someone managed to hack the plugin…

    Plugin Support Krystian from Syde

    (@inpsydekrystian)

    Hello @directino

    But still someone managed to hack the plugin…

    I would avoid bold statements about the security gaps until they are actually confirmed by legitimate source.

    Just for you to know, the plugin does not handle iDEAL payments directly. Instead, it displays all the APM gateway (inc. iDEAL) in an iframe, with the content hosted and totally controled on PayPal’s side. If there were any security gaps, they would be directly on PayPal’s side, not on the plugin’s side. If you’re unsure about the legitimacy of this payment method, it’s best to report your concerns directly to PayPal.

    We got a signal from a client that made an order and did not receive a confirmation. There was no incoming payment in the our PayPal account or in the Woocommerce order menu.

    If no order was created in WooCommerce and the payment wasn’t captured, it may be due to improperly registered or received webhooks or the buyer not completing the checkout process correctly. If the plugin doesn’t capture the payment within three hours, PayPal typically issues an automatic refund. It should appear in the buyer’s account within a few days, as SEPA transactions usually take a day to process.

    Alternatively, any alternative payment method can be disabled, e.g. via the Disable Alternative Payment Methods setting in the Standard Payments tab.

    this domain r3.girogate.de. Then a payment would be send to a german bank account with our sites name that we do NOT own.


    r3.girogate.de is a subdomain of girogate.de (source: https://securitytrails.com/list/apex_domain/girogate.de)

    API endpoint URL: https://api.girogate.de is legitimate output from iDEAL/Bancontact (source: https://developerhub.ppro.com/simple-api/docs/bancontact-wip)

    Just updated to 2.8.0 again and the problem seems solved for now. But still someone managed to hack the plugin…

    Could you provide the steps to reproduce the issue in the previous version, which doesn’tt occur in the latest version?

    Looking forward to hearing from you.

    Kind regards,
    Krystian

    Thread Starter directino

    (@directino)

    Thank you for the thorough investigation! My hosting provider also confirmed the site does not seem compromised. Also I found people with the same problem and same German IBAN getting an automatic refund in a few days so it seems like a legit payment source and like some Paypal/iDEAL issue. Also changing versions of the plugin did not remove iDEAL (I though it did but it was loading from the browser cash). So I removed iDEAL from the plugin settings and hope it should be fine now. Sorry for the panic!

    Plugin Support Krystian from Syde

    (@inpsydekrystian)

    Hello @directino

    Also changing versions of the plugin did not remove iDEAL (I though it did but it was loading from the browser cash).?

    iDEAL is available in both versions of the plugin, but its appearance depends on PayPal and several factors that determine if a user is eligible for this payment method.

    I’m happy we resolved this issue, so I’ll mark this thread as resolved.

    Feel free to reach out if you have any more questions.

    Kind regards,
    Krystian

Viewing 4 replies - 1 through 4 (of 4 total)
  • You must be logged in to reply to this topic.