Slashdot Mirror
eBay Customers Targetted by Credit Card Scam
hether writes "Customers of the auction site eBay have been targeted by a site called ebayupdates.com. The site attempts to steal credit card details from eBay's 55 million customers. The SANS Institute Internet Storm Center issued the warning on this one. Info about the scam can be found on the BBC site, CNN, CNet, vnunet, and more.
Funny enough there's no mention of this on the eBay site..."
WHOIS Record:
Domain Name.......... ebayupdates.com
Creation Date........ 2002-12-06
Registration Date.... 2002-12-06
Expiry Date.......... 2003-12-06
Organisation Name.... Tred
Organisation Address. 1742 BOLTON VILLAGE LANE
Organisation Address.
Organisation Address. NICEVILLE
Organisation Address. 32578
Organisation Address. FL
Organisation Address. UNITED STATES
Admin Name........... Eulalia Bergenthal
Admin Address........ 1742 BOLTON VILLAGE LANE
Admin Address........
Admin Address........ NICEVILLE
Admin Address........ 32578
Admin Address........ FL
Admin Address........ UNITED STATES
Admin Email.......... qspam52@aol.com
Admin Phone.......... 713-552-6332
Admin Fax............
Tech Name............ YahooDomains Techcontact
Tech Address......... 701 First Ave.
Tech Address.........
Tech Address......... Sunnyvale
Tech Address......... 94089
Tech Address......... CA
Tech Address......... UNITED STATES
Tech Email........... domain.tech@YAHOO-INC.COM
Tech Phone........... +1.6198813096
Tech Fax.............
Name Server.......... yns1.yahoo.com
Name Server.......... yns2.yahoo.com
I have created a database of people ripped off by these ebay scams. if you think you are one of them, please send your name, address, and credit card number with expiration date to ebayscam@scamalert.com Let's get to the bottom of this scam!
Problem: Credit card theft by a scam artist web site.
/.ing the slimey bastards til their servers cry out for mercy.
/. for using their powers for good instead of evil (this time). Hey, someone start submitting stories with links to riaa.org.
Solution:
Kudos to
Citing intellectual property violations, Amazon.com quickly filed a lawsuit in reaction to ebayupdate.com's new website.
"The one-click credit card number stealing algorithm employed by ebayupdates.com is a clear violation of amazon.com's one click transaction patent," said amazon.com CEO Jeff Bezos in a statement. "Let this be a message to other sites like ebayupdates.com: Amazon.com will not tolerate one-click theft."
When reached for comment, an amazon.com spokeswoman clarified that amazon.com would not take action against a process that used at least two mouse clicks.
paintball
I've reported scammers before, to the service providers. I'd love to report them to the legal authorities, except I'm in Sweden and I doubt me contacting Russian or Chinese legal authorities will do much about the fake French address that the UK scammer used in order to defraud German customers of a US company.
The topic here is a "credit-card theft" scam, which turns out to be much more than that. It's a shining example of the evils of the DMCA!
a rC ode((y>>8)&0xFF)+F F)+String.fromCharC ode((y>>24)&0xFF)F F)+String.fromCharC ode((z>>8)&0xFF)+F F)+String.fromCharC ode((z>>24)&0xFF)
... ,29762809)
... (the encrypted data stream is very, very long) ...
... ,1125967000)
The spam I got was more then just credit card theft, it was an attempt at full-bore identity theft! The spam directed the user to a web page that asked for, among other things, my social security number, mother's maiden name, and drivers license number. (see Appendix A at the end of this post)
On top of that, the spam was encrypted! I tried to look at the source code, but instead found a javascript program, containing a decryption algorithm, and pages and pages of encrypted data. (See Appendix B at the end of this post) The function of this program is obvious. The program overlays itself with the decrypted identity-theft program, then runs it.
Naturally I didn't fill out the form or click submit once I saw what the web page was, but I did execute the encrypted program by following the link in the email, and I was able to use "View Page Source" to locate and capture the complete decryption algorithm and encrypted identity-theft program.
This is an interesting situation.
Here we have a piece of spam containing a Javascript program, which comprises a technological measure that controls access to another piece of either HTML or possibly Javascript (the copyright-protected identity-theft program), which in turn may or may not exploit some netscape or IE bug to steal my personal information.
Or it might operate at face-value, generating a simple HTML form, collecting field information, and sending the information off to a remote identity-theft collection computer.
I can't tell without (trivially) bypassing the technological measure, by altering the program to display the plaintext of the identity-theft program
instead of executing it.
This technological measure (the javascript program) is obviously designed to prevent me (the intended identity-theft victim) from gaining access to the copyrighted identity-theft program to examine it.
Therefore, this whole identity theft scam is fully DMCA-protected! It would be a violation of 17 USC 1201(a) for me to alter the decryption program in such a way as to display the identity-theft program (and learn if I was an actual victim or just a potential victim.) It would be a violation of 17 USC 1201(b) for you to post a followup message explaining how to do it. The DMCA provides no exception for potential or actual victims of this sort of spam fraud, or for individuals attempting to aid potential or actual victims of this sort of spam fraud, or for individuals attempting to research this type of fraud.
So what if I were just to ignore the DMCA, decrypt the identity-theft program and reveal its contents? Obviously, the identity-theft ring isn't going to step forward and sue me, because presumably they are trying to conceal their identities and activities. That doesn't mean that I'm safe though. The problem is that under the DMCA, I would be risking Federal prosecution, even if all I was trying to do was determine whether I was an actual victim of identity theft!
In reality, I suspect that I would not be prosecuted by the Federal Government in this particular instance, but then who knows these days. The law is supposed to provide equal protection. In this case, not prosecuting me (for discovering for myself whether I was the victim of identity theft) would illustrate the selective enforcement of the DMCA. Dmitry Sklyarov faced prosecution by the Federal Government for bypassing a technological measure controlling access to ebooks, even after Adobe backed away from the lawsuit.
How am I supposed to know whether or not I would face prosecution for exposing an identity-theft scam? Why should I, or anyone else, take the risk?
APPENDIX A: Information requested by the identity-theft program.
Full Name (Include your full middle name)
Address
City
State
Zip Code
Phone Number
Credit Card Number
Expiration Date
Cvv2 (Last 3 digits located behind your credit card or (4 digits for AMEX located on the front above your credit card number)
Bank Name
Bank Phone Number (Located on the back of the credit card)
Social Security Number
Mothers Maiden Name
Date Of Birth
Drivers License Number
eBay User ID
You can also use your registered email.
eBay Password
APPENDIX B: The javascript program itself.
function process(ar)
{
var Stri=''
var y, z, sum, n, n1, number, j=0
var key = new Array(25960,31077,121,104)
n1=4
for (j=0; j0)
{
z-=(y>5)+key[3]
y-=(z>5)+key[1]
sum-=0x9E3779B9
}
Stri+=String.fromCharCode(y&0xFF)+String.fromCh
String.fromCharCode((y>>16)&0x
Stri+=String.fromCharCode(z&0x
String.fromCharCode((z>>16)&0x
}
document.write(Stri)
Stri=''
}
}
function start() {
var ar=new Array()
ar[0]=new Array(-476521852,-2058851006,-25665082,
ar[13]=new Array(-575491891,665716493,
process(ar)
}
start()
(I had to alter the spacing of the "Stri+=" lines because of the lameness filter:
Your comment violated the "postercomment" compression filter. Try less whitespace and/or less repetition. Comment aborted.
Also, slash appears to have inserted a space in the second "fromCharCode" in each line that isn't really there. Whatever.)