eBay's security problems: Vladuz and account hijackings via redirect page on eBay

[BellisimaJ.]

Does this mean Paypal is also vulnerable?

According to The Auction Guild, yes.

Boucher, considering what happened (as you described in your last post), I think you should change both passwords. That may or may not help, but it's worth the effort, IMO.

[Boucher]

[quote author=BellisimaJ. link=topic=7538.msg45594#msg45594 date=1172891861]

Does this mean Paypal is also vulnerable?

According to The Auction Guild, yes.

Boucher, considering what happened (as you described in your last post), I think you should change both passwords. That may or may not help, but it's worth the effort, IMO.
[/quote]

I believe I'm okay. Just signed in and there's no suspicious activity. Also, the auction page where the question was posted had the seller's response:

Q: Hello, My name is Ace Schmidt. I just saw this item of yours and I remember seeing the same item two days ago, take a look: http://(edited out similar redirect as the one in the OP)

A: I just copy and pasted where you told me to look and my antivirus program told me it was a phishing website, so I didn't open it. Someone obviously must have copied and pasted my pictures in order to get people's email addresses. I've seen it before on ebay. They make a fake auction and when you bid or ask a question about the item they get a hold of your email address to send you spam. They obviously took my picture because it would attract people to click on it. It definately wasn't another auction posted by me.

I remember reading what the seller posted and NOT clicking the link. I don't know how it slipped past me but I never even noticed the redirect.

[mandy]

eBay fixed one redirect security hole - the sign-on page.

A week or more after it was brought to its attention, eBay has plugged a hole in its sign-on page that was being exploited by phishers.

The vulnerability was noteworthy because it led users to eBay's official login page first, unlike most phishing attacks, which direct victims to a spoofed URL. Once a user entered a valid user name and password on the eBay site, however, the exploit redirected the person to a third-party site of an attacker's choosing...

full article: http://www.theregister.co.uk/2007/03/02/...n-on_hole/

[mandy]

The latest Vladuz news:

A software tool created by a Romanian hacker who gained notoriety for his recent antics on eBay remains online. The eBayCaptcha Populator is an add-on for Mozilla's Firefox browser designed to defeat eBay's captcha security device and was posted by "Vladuz" on the Mozilla site. Captchas require a human to read a graphic and type it in to the computer, thereby defeating automated programs that attempt to hijack accounts using dictionary attacks. Vladuz' tool claims to get around eBay's captcha defense.

Whether Vladuz' program was designed to work - or was possibly created as a device to defraud those who would use it - isn't known. But what may be perplexing is why Mozilla would find it an acceptable tool to leave on its site...

full article: http://www.auctionbytes.com/cab/abn/y07/m03/i06/s03

[mandy]

eWeek has an eArticle on eScams on eBay:

The auction behemoth is being skewered by Vladuz, the Romanian impaler, and the e-villagers are whispering that he's sucking customer and service rep account lifeblood directly from eBay's internal databases. Is he that spookily talented, or is he just another, albeit talented and lucky, phisher who also stumbled on an e-mail with internal accounts?

The eBay villagers are whispering that he can creep through eBay's internal databases and suck the lifeblood of customer accounts—log-ins and passwords—right out of their pulsing, 222 million-plus customer heart. He's putting up bogus listings as fast as eBay can take them down, and that proves he's walked through a security hole as big as a barn door...

full article: http://www.eweek.com/article2/0,1895,2100808,00.asp

TheRegister has another article:

More than two months after breaching eBay's employee servers, a hacker who calls himself Vladuz remains at large, despite the best efforts of the online auctioneer's security team and officials with law enforcement agencies in the US and eastern Europe.

So far, little public information is known for sure about Vladuz, who on at least two occasions has logged into eBay forums as an official customer service representative and then mocked the company's security. But the net is covered with bread crumbs left by a hacker who goes by that name, brazenly advertises cracking software and talks up his programming prowess. "This scam is perfect in many ways," he wrote on one site about a file he said steals eBay passwords...

full article: http://www.theregister.co.uk/2007/03/08/who_is_vladuz/

[mandy]

Auctionbytes article on Vladuz:

Call it the equivalent of neighborhood teens strewing toilet paper on your trees on Halloween, but the nuisance stunts of a Romanian hacker who calls himself Vladuz has quite clearly confounded eBay's attempts to stop him from making his presence known on the online auction site. Confident of his ability to breach eBay's security, Vladuz posted early this morning in eBay Germany's forums, displaying Pinkliner status.

In a year that eBay has dedicated to creating a safer buying experience, Vladuz has gained attention by flagrantly posting on the boards as an eBay forum moderator, or "Pink." How deep Vladuz' access to the site runs is open to speculation...

full article: http://www.auctionbytes.com/cab/abn/y07/m03/i14/s02

[mandy]

The latest:

For at least the third time in as many months, a malicious hacker has gained unauthorized access to parts of eBay's network despite the best efforts of the company's security team to fortify its system against the embarrassing breaches...

eBay spokeswoman Nichola Sharpe said company security employees are taking measures to put a stop to Vladuz's intrusions. "We are in the process of putting lots of behind-the-scenes things in place to stop him," she said. "We're as confident as we can be" that the measures will work. Sharpe said members of the security team know exactly how the perpetrator is breaching the network. She declined to describe that method or to elaborate of the fixes being implemented...

full article: http://www.securityfocus.com/news/11449