Slashdot Mirror
eBay Scrambles to Fix Phishing Bug
Paul Laudanski writes "c|net is reporting that eBay is scrambling to fix a software glitch which opens doors to phishing attacks via one of its own valid URLs. "The flaw may have already allowed individuals to use one of eBay's URLs to trick unsuspecting parties into visiting malicious sites, the company representative said.""
In other news, ex-hacker warns that social engineering (aka end-user profound dumbness) is the most serious security flaw of computer systems.
I lost 100$ because of I thought it was ebay.
This is not the first time this has happend to a huge company, in the summer of 2002 amazon had a similarly large security hole. Can consumers trust large companies anymore? I think so, but you are always taking your chances with security. Sometimes companies become so large that things get easily overlooked.
Want to learn about anything sexual? Check out the sex wiki:
Can anyone enlighten me as to the benefit of phishing for EBay accounts? Assuming the ultimate goal is profit, what can the attacker really do with one, as long as the EBay account information isn't the same as the Paypal?
It should be a text-only medium, period. No attachments, no graphics, no opportunity to get someone to click before they think.
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
It is Free Documentation, under the GNU FDL.
It's at GoingWare's Bag of Programming Tricks.
Request your free CD of my piano music.
http://cgi4.ebay.com/ws/eBayISAPI.dll?MfcISAPIComm and=RedirectToDomain&DomainUrl=http://siag.nu/
That's a link to ebay.com which redirects to siag.nu. And it doesn't look like a glitch, it looks like it's on purpose.
It's a pheature.
Slashdot Scrambles to Fix Dupes
Maybe they changed their stance.
Not to long ago, I had a co-worker defrauded. Yeah, he wasn't a bright one and really should have consulted me when even the slightest bit of doubt surfaced.
Long story short, it didn't take place on eBay, but originated through a compromised users account. In the end, eBay was fairly useless for help because they had the option to not deal with it.
If they were serious about working hard to stop this activity they could be a bit more pro-active.
Now, I'm not damning them completely, not so long ago I had someone disappear after a transacation. It took a few weeks to get my money back, but in the end the issue was resolved.
They really need to abandon email entirely and just eliminate the elements they can't control. At the very least leave external notifications off by default.
Otherwise, an alright service, but plagued with problems any high profile commerce sight would suffer.
"You should always go to other people's funerals; otherwise, they won't come to yours." -- Yogi Berra
for a perported ebay site wanting me to logon & etc...
i never use fleabay (ebay) so it was deleted unopened since i figure since i dont use ebay it had to be a "spam scam"...
[ Buy at Powell's City of Books]
Request your free CD of my piano music.
Outlook (like many mail clients,) displays HTML by default, which makes it easier to hide redirects.
I have my email client at home (Kmail) set to Text instead of HTML. It makes it easier to spot redirects and such, so phishing schemes are more obvious.
I don't use Outlook, so I don't know if it can be set to Text view for incoming messages. It would be very helpful for someone to post the steps needed to set Outlook for text view.
Finally I tried abuse@ebay, that sent back an automated reply and in that reply, I found the email spoof@ebay.com
I doubt if I'm the only person who found that scam, but I am glad that they seem to be taking action.
The grass is only greener, if you don't take care of your own lawn.
Not just for ebay...but for everyone. Allow users to download the GPG key from inside their account and sign all the legit email.
I realize that this somewhat complicates things for Grandma and Aunt Agnes, but the general public is going to HAVE to learn to deal with it in an effective way. GPG is an effective way...and PGP Freeware for Windows/Outlook is pretty idiot proof.
I believe ebay has know about this for a while but sat on it for some unknown reason: SURBL List gave first warning. Took them almost a month, not bad.
Annoyingly, my ISP (Speakeasy) has stopped allowing its customers to forward phishing emails to spoof@ebay.com.
They are doing content filtering on outgoing mail, which is something I really wish they wouldn't do. I have no idea what aspect of the message triggers the filter, but any attempt to forward an HTML phishing mail without converting it to plaintext first (and losing the href fields that would allow eBay to shut down the phishing sites) yields "Server Response: '554 message permanently rejected, you may have a virus (#5.3.0)'."
All attempts to communicate my displeasure to Speakeasy's support department have met with the usual language barrier (I speak English, they speak Moronese). I simply could not find a way to convince them that I wasn't having trouble sending email in the general case. If anybody from Speakeasy is reading this, it would be nice if they got the clue bat after whoever implemented this filter. Customers need to be able to opt out of all content filters, both incoming and outgoing.
Dahlmann tightly grips the knife, which he may have no idea how to use, and steps out into the plain.
At what point does enabling fraud get to the point of legal liability?
500GB of disk, 5TB of transfer, $5.95/mo
The link in the scam email eventually redirects to this IP address in France, *after* ebay verifies your login. Incidentally, the one I received came through a server in Korea.
http://62.193.217.91/eBayISAPI.php
Page two asks for your credit card, which answers the questions about the benefits of ebay phishing.
The links are irrelevant. The fact that it is under GNU FDL doesn't make it anymore relevant. And to put it in your sig so you can spam for a book store with your referrer id later on... desparate.
See here.
Request your free CD of my piano music.
Bookmark all the financial sites you use, and whenever you receive emails with such "friendly" links, use your bookmark instead, to log in to the site. If it was important, you will see it on the next page there.
I never click on the links even when I know they are legit (to avoid forming a habit).
I posted the book because I felt it would be genuinely useful to the people reading this story.
If you're such a hero, why don't you log in under your real name, like I do.
Request your free CD of my piano music.
Page two:
http://62.193.217.91/eBayISAPI2.php
Go at it.
I tried to email both companies but they don't make it easy to report these security problems.
they suck and i won't be using PayPal or ebay anymore
c|net : The problem [...] could be exploited by criminals to create an actual eBay link that redirects customers to a malicious site, the representative said.
Heise: The emails, pretending to come from eBay, circulate on the net since February 12th. eBay was informed about it, however did not react so far.
Lars T.
To the guy who modded me down from perfect to terrible Karma - Apple haters still suck
I get around 3-5 of these e-mails (from "ebay") a day. They tell me that there is a problem with my billing account or something like that. They want me to go and "change" my credit card number. But the best part about it is that I have never ever shopped at ebay.
~Alan
Maybe an expensive lawsuit, and I expect only a lawsuit, will eBay and their partner-in-crime, PayPal, start paying attention to security.
Request your free CD of my piano music.
Request your free CD of my piano music.
You are taking things a bit too personally. What happened, did you just recommend your company to "enrich the user experience" by sending friendly multimedia messages to your customer base and are now afraid it wouldn't bode too well if your boss sees this ?
One way to try and scam some money out of people is to pretend to sell something on eBay, and never deliver. SOP is for the buyer to pay beofre the seller ships the item, so it can work.
Now the thing is, if your reputation sucks, nobody will do that for bigger ticket items. Some scammers pump their rating up by buying lots of small things, but peopel look for that now. So, if you manage to get a password for an account that has a long, real history on eBay, you can use it to scam people. They look at the feedback, see a reputable person, and get duped.
I received one of these over a week ago. It caught my eye more than the other phishing attempts because, after looking at the html, it did indeed send me to *.ebay.com. However deep in the url was a redirect to an IP address. They are using some mechanism within ebay itself to redirect traffic to other sites.
So this exploit has been in use for a long time (relatively speaking) for the vulnerability to still be unpatched.
Dan East
Better known as 318230.
Is that ebay don't care. I've forwarded various emails like this to abuse, webmaster and postmaster and received completely unhelpful automated replies. I've been to the customer service pages on the site and emailed them... To receive completely unhelpful automated replies. Long story short - they don't care, I don't trust them.
I get them too. I do, however, use eBay, but the Belgian site, so anything that doesn't come from ebay.be is fake. In addition, as all my legitimate eBay emails come in French, it's very easy to spot a phish.
These phishers really need to get their acts together and start supporting international users. There's a whole untapped market out there!
If your comment title says 'Re: Foo', I'm not likely to read it.
I got one of those url redirector trojans like 1.5 months ago. How is that scrambling if its just in the news right now? :)
Seems that they're only 'scrambling' now there is media attention.
"Physics is to math as sex is to masturbation." -R. Feynman
I recently [and despite my best thoughts on the matter] signed up for PayPal.
...
I get dozens of "paypal" emails a day. Occasionally some ARE legit.
I *NEVER* click on ANY links in emails for things like paypal/gmail/etc. [And yes, I'm smart enough to actually hover on the link to see the url or just see the source].
You want to goto ebay? simple type
"http://www.ebay.com"
In your browser location bar... wanna login to paypal type
"https://www.paypal.com"
If you get a "notice" from "paypal" just login and see your account first hand...
In otherwords don't be stupid and just randomly enter your password in sites asking for "updates"...
That and the quality of phishes are very low. I'd say a good majority don't use SSL [though they put SSL padlocks on the page] and quite a few have HTML errors [like missing images or malformed layouts].
Tom
Someday, I'll have a real sig.
The slashdot effect is going to dissapear.
Just noones actually RTFA.
Thanx, i'm here all week.
WTF am I doing replying to an AC at 5 A.M on a Friday night?
haha
Im very sad for ebay users who might be effected by this but seriously i am OVER joy'd with this news to hear that Ebay are actually getting up off their fat asses and doing something.
I Predict A Riot
Not on Firefox, and at any rate, even on IE I don't think they can do more than just "add a bookmark". If I bookmarked my sites I know where they sit in the list, and are probably in a category like "Financials" or something. JS-added bookmarks probably sit at the end of the list so it would be quite obvious.
I'd do that rather than risk misspelling/not remembering the URL which might happen if I have to type it less often.
After contacting Customer Support I was
informed that it was legit. !!!!
I tried numerous times to point this out but
Customer service with ebay can sometimes be a
struggle. I take it they assume everybody is
an idiot.
Even Ebay Phishes. Go figure.
eBay left a forum Admin tool accessible to the Web, and several, if not hundreds of users's personal information such as their address, phone number, and Board violations were accessible to people with the correct URL to view this information.
Saskboy's blog is good. 9 out of 10 dentists agree.
HELLO??!! This HAS ALWAYS BEEN KNOWN ON THE SOAPBOX FORUM ON EBAY EVER SINCE NOVEMBER OF 2004. THE ONLY DIFFERENCE IS EBAY HASN'T BROADCAST/ACKNOWLEDEGED IT PUBLICLY UNTIL NOW.
THANX FOR NOTHING EBAY!! I'M GLAD I ALREADY WARNED MY OWN PEOPLE!!
* weedshare.com 50% to artists, webjay.org iuma.com CDBaby.com Epitonic.com ampcast.com
Below is a copy of what I sent them. The fraudulent email appears before my comment. (For some reason, it was reformatted to all lower-case.)
_________________________________
email header:
from aw-confirm@ebay.com sun jan 30 14:42:29 2005
email body:
<html>
<body>
dear ebay community member,<br><br>
<!--uee-->
it has come to our attention that your ebay billing information records
are out of date.<br>
that requires you to update the billing information if you could please
take 5-10 minutes out of your online experience and update your<br>
billing records, you will not run into any future problems with ebay's
online service.<br>
however, failure to update your records will result in soon account
termination. once you have updated your account records, your ebay<br>
session will not be interrupted and will continue as normal. failure to
update will result in cancellation of service, terms of service<br>
(tos) violations or future billing problems.<br><br>
to update and login to your ebay account, click on the linki sapicommand=3dredirecttodomain&domainurl=3dhttp%3a %2f%2f%32%31%31%2e%32%33%33%2e%33%38%2e%37%3a jbaqqzehaaemwzlhhlwxs2albxvshqahqrfhgtdrferhcurstp aisnrqahqrfhgtdrferhcurstpaisnrpaisnrqahqrfhgtdrfe rhcuqrfqzehaaemwzlhhlwxh">http://cgi4.ebay.com/ws/ </a><br>
below:<br><br>
<!--xr-->
<a href=3d"http://cgi4.ebay.com/ws/ebayisapi.dll?mfc
2%2fupdatecenter%2flogin%2f%3fmfcisapisession%3da
<br>
thank you for using ebay!<br><br>
**this is no-reply message. please do not reply to this email, as you
will receive no response**
<!--i36-->
</body>
</html>
------=_nextpart_000_0068_01c44e5d.dbc9229e--
message: if i'm interpreting the url in the message correctly, it looks
like you have a vulnerable redirector running somewhere. if so, you'll
probably want to fix that.
the above appears to be redirecting to the ip address 211.233.38.72,
which 'whois' says is in korea.
schwab
--_----------=_9502205623000--
------=_nextparttm-000-25ddf14b-7467-4642-9e0d-8 cafc918baf3--
Editor, A1-AAA AmeriCaptions
for those of us who have no karma!!!!!!
I forwarded the email to ebay and got an automated response giving some advice. The advice was neither acurate nor as good as it could be.
The said they would never request a user password in an email. That is probably right, but is does not address emails linking to web sites. EBay's web site does ask for a password, and so do the bogus sites.
It also gave the advice to always open a new browser, and type http://ebay.com/ in the url field. This is not bad, but by failing to tell why, you can be sure that a large fraction of the users will not understand the importance and meaning of this advice. They will click on email links and believe they have arrived at the same site the advice would take them, and continue from there.
There is a link at the bottom of the eBay home page titled "Security center". At the bottom of that page there is a link "Deterring identity theft", and that page repeats more or less the advices in the message I got. It says prominently "Never reply to emails that ask for personal information." It says nowhere "Never click a link in an email," which would be far more appropriate. They don't mention fraudulent web sites with a word on that page.
I think eBay is doing a very lousy effort to educate their users. Likely some marketing people have told them that if they place warnings prominently on the first page, more people will get the message that eBay trading is dangerous than the occasional reports in the press about people who has been victimized. It seems to me that eBay gives zero wheight to the suffering of the victims and all importance to their profit.
Regards.
There is no substitute for common sense. Especially, no body of rules will do.