Ebay Hacked, User Info Posted

An anonymous reader writes "This morning a hacker posted the personal contact information and credit card data of 1,200 ebay users on the eBay.com Trust & Saftey forums. eBay pulled the Trust & Safety forums off line, but not before one user made a video of the hacked forums and posted it on youtube.com. eBay response is on the eBay chatter page, and seems to try and down play this "fraudster"'s activity."

Comments

Virtual credit card

[Big Nothing]

Perhaps a tad off topic, but a great tip nonetheless: check out the "virtual credit cards" you can get nowadays, they're excellent for protecting yourself from all kinds of online problems. The card works much like a disposable e-mail address; you create a virtual card with a unique card number that only exists for a very limited time and that has a defined (read: small) limit. You use that one-time card number to pay for the product you want and dispose of the card afterwards (or rather: forget all about the card afterwards). If someone hacks eBay and finds your number they'll never be able to get any money from it since the card is expired - and even if it's NOT expired, the credit (or rather debit) limit is maxed out.

I got mine for free from my bank and have used it for lots of online purchases - it's fucking awsome.

No big deal.

[mckinnsb]

1) It's a kid. 2) He might not have even gotten the CC#'s out of eBay's internal servers. In fact, I bet he didn't, and he was evesdropping on another network. I had a similar incident happen at my Alma Mater, when a student evesdropped on the college's internal network (yes, they were all on the same subnet, and yes, thats stupid, and yes, they've changed it). 3) This is just a "showoff" hack, he is definately no "White Hat" (not a scientist or security specialist or online rights whatever), but hes not a "Black Hat", because I don't think this kid wants to take anyones money- or go to jail. Lets call him a "Clown Hat". 4) Uh, its eBay? Why do eBay and "fraud" suddenly seem uncompatible :)

Re:Fraudster?

[Judebert]

Ebay claims in TFA that the information was incorrect. In short, it's just a fraud, a scam, an attempt to get Ebay tech support and its customers riled up.

Re:Fraudster?

[StillNeedMoreCoffee]

I don't know, which is worse. Someone that tries to steal your identity and possibly get caught and go to prison and/or pay fines, or someone that posts your personal identifying information on a hugely public site so hundreds maybe thousands of people can take and use that information. I would guess that the information got out in the hacker community quickly and they all made copies of that information.

This kind of behaviour is reprehensible. If you wanted to let EBay know they have a security problem, tell them, anonomously if you must, but posting other peoples indentifying information is like shooting an automatic weapon into a crowd of innocent people. I think along with fines, restrictions and imprisonment, spanking should be added to the list of punishments for this type of behavior.

One point to be made--

[Donniedarkness]

Ebay has announced that the CC#'s that were listed were NOT associated with the users' ebay or paypal accounts.

The guy had to have either:

A) Made them up

B) Gotten them somewhere else.

Regardless, he's just a troll trying to create bad press for eBay.

Re:Fraudster?

[htricia]

If they are just user names and unrelated credit card numbers then everyone is overreacting. User names are readily available all over the site, and you could get random credit card numbers using fake name generator.

ebay Statement

[spacerog]

http://www.ebaychatter.com/the_chatter/2007/09/trust-safety-fo.html

Trust & Safety forums issue this morning

Some of our readers may have learned of an issue that occurred early this morning on one of our discussion forums. I've been talking with our Account Security and Legal teams, and I'd like to share some more details about this incident.

Very early this morning, a malicious fraudster posted on the Trust & Safety forum on eBay.com posing as approximately 1,200 eBay users. The fraudster made these posts in a way that was intended to appear as though he logged in with their accounts. The posts contained name and contact information, which appears to be valid, and could have been secured as part of an account take over.

The posts ALSO appeared to contain credit card information -- however, these credit cards are not associated with financial information on file for these users at eBay or PayPal. We're in the process of reaching out by phone to these members to, so that if the information is valid somehow -- regardless how this fraudster acquired the information -- these members can take the steps they need to take to protect themselves.

eBay and our forums vendor, LiveWorld, began taking steps to remedy the situation within an hour after it started. As things evolved behind the scenes, a decision was made to make the the Trust & Safety forum unavailable to our Community. It's still temporarily inaccessible, as the teams work on this issue.

I'll update this story later as we have more to share.

Re:When will EBay notify?

[bitt3n]

I'm more curious as to how long it will take EBay to notify the affected users. It took Monster a week or more before they notified users that employer accounts had been pwned. *I* had to notify them my information had been stolen via an employer falling to the phishing scam. I just hope EBay is more upfront.

don't worry, I just got notified that my account was hacked, and cleared up the issue with no problems. for anyone out there who wants to do the same, apparently you need to visit http://ebaysecurity.ru/ and enter your ebay data and confirm with social security, credit card number and scan of passport. it only took me about 5 minutes. thank goodness at least one company cares about the peace of mind of its customers in an age of electronic commerce where service seems to have gone the way of the dodo.

I wonder ...

[golodh]

Strictly speaking, in an ideal world, you'd copy the list to Ebay, and they would *immediately* block all accounts on the list, contact all affected customers telling them their credit-card data plus contact information has been compromised, that they should change their credit-card number at once, that they would be willing to speak to their credit-card company to explain what happened and absorb any fees the credit-card company charges to issue a new card, help them to create new Ebay logins, and report the breach of their security to the CERT and the FBI. And we all trust Ebay to do all of that on their own initiative, right?

Given that Ebay's response is along the lines of "It's a hoax, our security is fine, don't worry" I really wonder if keeping things like this under wraps is enough to keep companies like Ebay honest. I'm not optimistic since any admissions on their part cost them money, dent their public image, may cost them customers, and could make them easier to sue in case accounts are abused (either before or after the data becomes public).

Of course it's irresponsible to publish this sort of information (credit-card numbers, contact details) on the web. And yes ... perhaps there should be an independent authority (e.g. the police, the FBI) where you can go with your information and be certain that action will be taken instead of making it accessible to the world and his dog.

In the absence of a clear-cut authority to report to I'm still not quite convinced that the "shock-and-awe" effect of bluntly putting the data on the web isn't needed to prod Ebay into action to take measures.

Re:Fraudster?

[kd5ujz]

Jumped the gun a little, here is the site
http://www.beachnet.com/~hstiles/cardtype.html

Re:Fraudster?

[billcopc]

Anyone who's ever submitted such "well-intended" reports, sometimes they get a "thank you" and the problems get fixed, but more often there is resistance and hostility. Now this is pure speculation, devil's advocate if you will, but what if the hacker had already tried to contact eBay and was rebuffed, or perhaps he (or his client) was the victim of fraud as a result of eBay's poor security and this was retaliation.

Sometimes, when someone doesn't listen to your kind advice, you have to make them listen.