Slashdot Mirror
Severe and Unpatched eBay Vulnerability Allows Attackers To Distribute Malware
An anonymous reader writes: Check Point researchers have discovered a severe vulnerability in eBay's online sales platform, which allows criminals to distribute malware and do phishing campaigns. This vulnerability allows attackers to bypass eBay's code validation and control the vulnerable code remotely, to execute malicious Javascript code on targeted eBay users.
Well isn't that lovely...in addition to being the eBay of Thieves, now they can infect your PC as well.
It's like an extra service, I'm only surprised they aren't charging for it.
Just cruising through this digital world at 33 1/3 rpm...
As far as I'm concerned, any and all JavaScript code is a form of malware. I don't want any of it running on my computers, ever.
Modern app appers know that only apps can app apps, and you're a LUDDITE if you don't app apps apped in AppScript!
Apps!
eBay has been open to JavaScript exploits for well over a decade. When I first realized this, I tried to make a fuss about it, but was met with uniform yawns and dismissal; the post or two that I made about it on eBay's discussion forums was summarily deleted.
If they had been trying to allow a limited subset of JS code in listings, I still would've been alarmed, because I would bet against their ability to define a safe subset, never mind successfully blocking anything else. But it looked to me at the time like they weren't doing any blocking at all. I don't remember exactly what I did in my test listing; it might have been triggering one of their buttons (like Buy It Now) from a button in my description, or it might have been attaching a new action to one of their existing buttons. It looked like I could also have (say) rewritten the price field, so that it looked like you'd be paying one amount but actually get charged a higher amount. I didn't even start trying to generate overlays that look like eBay controls but actually did my bidding, but it looked like the opportunities were practically unlimited. I didn't push hard, and I deleted the listing before anyone else could view it, because I was doing a fair amount of business there at the time, and I didn't want to be the messenger that got shot.
I just can't imagine what they're thinking by letting people embed arbitrary JS in listings. I'm stunned that there hasn't been a catastrophic exploit in all this time. I've assumed that I was simply overlooking some critical piece that they've implemented to guarantee security, but this story doesn't exactly instill confidence.
EBay itself is a severe and unpatched vulnerability. Where else can you get flawless 6 ct diamond rings for just $4
But Elon Musk has a spaceship
As far as I'm concerned, any and all JavaScript code is a form of malware. I don't want any of it running on my computers, ever.
And yet, here you are, posting on Slashdot... JavaScript runs deep and wide... Good luck avoiding it.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Ye olde HTML form still exists and works.
I've done business with eBay's IT org for years, and I do business with various other enterprise IT shops.
eBay's group is among the worst. Basically clueless, all the time.
This is no surprise.
But the 7 external sites which all want to run javascript ... I don't let a single one of them do it.
Javascript is best treated as malware. But you pick and choose who you let run it.
You sure as hell don't let any old website run any old script, and call 3rd party scripts -- because that would be idiotic.
And, shockingly, that's how most of the people who make web pages expect it to work ... those ad and analytic companies and the other parasites in pages? Well, they can all fuck off and die.
Lost at C:>. Found at C.
I hadn't realized modern malware could execute in peoples brains without first going through a computer. Seriously though, how does the code get onto the mobile device without the user first downloading and installing the malware.
Let me start by saying... Can we be less american-centric? I bet statistics show most users here are not american.
As for UX: Just look at your competitors and do the same as them. People expect certain modes of interaction.
This is like, UX haphazardly developed by "bits and bytes" geeks, and I myself am one of those old school bit logic and assembly lovers, but I'm not going to pretend I can do a decent GUI (let alone that I would enjoy it).
Showing raw ID codes for users? ID codes for posts? What. You call this web design?
I mean I stare at IDs in databases all day long, but normal users shouldn't see the guts of a system.
What other website / forum has such a limited number of votes?
The zoo system. Do people actually use that? It's strange and unwieldy.
Preview? Why? Can we just edit our posts like everyone else has been doing for the past 15 years, in forums, social networks, whatever?
Why do we have to have a privileged few random people moderating? In other places, everyone can vote, or "Like", or "+1" a post.