Slashdot Mirror
Severe and Unpatched eBay Vulnerability Allows Attackers To Distribute Malware
An anonymous reader writes: Check Point researchers have discovered a severe vulnerability in eBay's online sales platform, which allows criminals to distribute malware and do phishing campaigns. This vulnerability allows attackers to bypass eBay's code validation and control the vulnerable code remotely, to execute malicious Javascript code on targeted eBay users.
Well isn't that lovely...in addition to being the eBay of Thieves, now they can infect your PC as well.
It's like an extra service, I'm only surprised they aren't charging for it.
Just cruising through this digital world at 33 1/3 rpm...
As far as I'm concerned, any and all JavaScript code is a form of malware. I don't want any of it running on my computers, ever.
eBay has been open to JavaScript exploits for well over a decade. When I first realized this, I tried to make a fuss about it, but was met with uniform yawns and dismissal; the post or two that I made about it on eBay's discussion forums was summarily deleted.
If they had been trying to allow a limited subset of JS code in listings, I still would've been alarmed, because I would bet against their ability to define a safe subset, never mind successfully blocking anything else. But it looked to me at the time like they weren't doing any blocking at all. I don't remember exactly what I did in my test listing; it might have been triggering one of their buttons (like Buy It Now) from a button in my description, or it might have been attaching a new action to one of their existing buttons. It looked like I could also have (say) rewritten the price field, so that it looked like you'd be paying one amount but actually get charged a higher amount. I didn't even start trying to generate overlays that look like eBay controls but actually did my bidding, but it looked like the opportunities were practically unlimited. I didn't push hard, and I deleted the listing before anyone else could view it, because I was doing a fair amount of business there at the time, and I didn't want to be the messenger that got shot.
I just can't imagine what they're thinking by letting people embed arbitrary JS in listings. I'm stunned that there hasn't been a catastrophic exploit in all this time. I've assumed that I was simply overlooking some critical piece that they've implemented to guarantee security, but this story doesn't exactly instill confidence.
EBay itself is a severe and unpatched vulnerability. Where else can you get flawless 6 ct diamond rings for just $4
As far as I'm concerned, any and all JavaScript code is a form of malware. I don't want any of it running on my computers, ever.
And yet, here you are, posting on Slashdot... JavaScript runs deep and wide... Good luck avoiding it.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Really? Wana go for a ride AC? Just remember it's NOT human rated yet..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Ye olde HTML form still exists and works.
But the 7 external sites which all want to run javascript ... I don't let a single one of them do it.
Javascript is best treated as malware. But you pick and choose who you let run it.
You sure as hell don't let any old website run any old script, and call 3rd party scripts -- because that would be idiotic.
And, shockingly, that's how most of the people who make web pages expect it to work ... those ad and analytic companies and the other parasites in pages? Well, they can all fuck off and die.
Lost at C:>. Found at C.
I hadn't realized modern malware could execute in peoples brains without first going through a computer. Seriously though, how does the code get onto the mobile device without the user first downloading and installing the malware.