RSSeBay Redirect Becomes Phishing Tool
By David Worthington | Published March 3, 2005, 4:52 PM
Online auctioneer eBay, a prime target for phishing schemes, has been used as an unwitting accomplice. A flaw in eBay's server configuration paves the way for spoofing attacks when a specially crafted URL (Example), which is a valid eBay link, is used to redirect users to a malicious Web site.
eBay was made aware of the issue several days ago, but has not yet corrected the problem, which can be used to exploit the trust relationship between eBay and its users.
Phishing is the designation given to a class of socially engineered attacks -- generally carried out via e-mail -- that steal consumers' passwords, credit card numbers and other personally identifiable information.
According to examples viewed by BetaNews, the eBay redirect has been used by phishers to make fake Web pages including login forms, defacements, false press releases and other sham Web sites.
"It certainly adds some credibility to phishing e-mails. But scammers have used other types of URL re-direction for a long time," noted Brian McWilliams, author of Spam Kings.
"At the moment, I guess it would be wise to tell the user to look at the URL before and after they click. Just to be extra sure," commented Internet security expert Jeremiah Grossman. "The problem is the redirect landed the user on an 'IP addressed' page. Is the average user really expected to make a good decision here? I believe phishing is a problem that needs a solution well beyond people looking at URLs. It's obviously not working."
In response to inquiries, an eBay spokesperson told BetaNews, "We are aware of it and we have a fix rolling out in the next few days."
"The fact that it is eBay increases the risk of someone taking advantage of the issue," said Grossman.
Recently, the technology industry teamed up with law enforcement to crack down on phishing by establishing the Digital PhishNet program, which opens a direct line of communication so that cyber criminals can be quickly identified and detained.
Software and Internet companies have responded by adding anti-phishing features into e-mail clients and security software. There are also industry organizations that are devoted to routing out phishers, such as the Anti-Phishing Working Group.
Nate Mook contributed to this report.
The link to http://www.betanews.com/...entify_Theft/1102553012 is broken because of this typo:
<a hef="...
<a href"...
Update: this typo is already fixed ;)
Score: 0
While this is bad you'll still end up at the fake domain so it is not like you're still on ebay.com
Score: 0
I get a post that looks like it from safehabor (not the first time)I have a feeling it's bogus so I look at the path in the "source code" not what the screen says. This is it:
http://211.153.20.121/secure/saw-cgi/DllUpdate/
signin/ws2/ISAPIDll/eBayISAPIdllSignIn
_favoritenavid.uproduct.ppco_partnerId2ru.
http_my.ebay.com_80_Fws2FeBayISAPI.dll3
FMyeBay26ssPageName3Dh253Ah253
Amebay_253AUS1ruparams_pageType1883.pa2.
bshowgif.a1pUserId.errmsg_UsingSSL_0uname
.siteid0.html"target="_self">http://cgi1.ebay.com/
aw-cgi/ebayISAPI.dll?UPdate
A mouth full and it almost looks real cause it mentions ebay a number of times (the path that is)
I'm still suspicious so I run a who is on the IP numbers in the path (Now why would ebay use an IP number unless they were hiding something. There is a time and a place but this wasn't on of them.
WHOIS results for 211.153.20.121
Generated by www.DNSstuff.com
Country: CHINA
Looking up 211.153.20.121 at whois.apnic.net.
% [whois.apnic.net node-1]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html
inetnum: 211.153.0.0 - 211.153.255.255
netname: BJENET
descr: ±±¾©½ÌÓýÐÅÏ¢Íø·þÎñÖÐÐÄÓÐÏÞÔðÈι«Ë¾
descr: Beijing Educational Information Network Service Center Co., Ltd.
country: CN
admin-c: HM66-AP
tech-c: KF31-AP
mnt-by: MAINT-CNNIC-AP
mnt-lower: MAINT-BJENET-CNNIC-AP
changed: ****@cnnic.cn 20040402
status: ALLOCATED PORTABLE
source: APNIC
person: huang minghui
address: ±±¾©ÊÐÇ°ÃÅÎ÷´ó½Ö109ºÅ No. 109, Qianmenxidajie, Beijing, PRC
country: CN
phone: +86-010-66074288
fax-no: +86-010-66074926
e-mail: ***@bjedu.gov.cn
nic-hdl: HM66-AP
mnt-by: MAINT-CNNIC-AP
changed: ****@cnnic.net.cn 20000815
source: APNIC
person: KANG FENG
address: ±±¾©ÊÐÇ°ÃÅÎ÷´ó½Ö109ºÅ No. 109, Qianmenxidajie, Beijing, PRC
country: CN
phone: +86-010-66074288
fax-no: +86-010-66074926
e-mail: **@BJEDU.GOV.CN
nic-hdl: KF31-AP
mnt-by: MAINT-CNNIC-AP
changed: **@bjedu.gov.cn 20010424
source: APNIC
Sounds like a valid ebay address right NOT... Anyways if you do follow it normally you get to what looks like a real ebay screen which asks for your ebay name and password... I went no further but I'd assume sooner or later they would want your paypal account info...
Happy trails
Barry
Score: 0
Here's my alert message to ebay:
Here is the spoof post with header: the actual path "to the spoof site and a trace as to who it is...
Barry Weiser
Return-Path:
Received: from fltr01.dmz.ftsm.vlnx.net (fltr01.dmz.ftsm.vlnx.net [208.189.209.16])
by ns3.weiser.net (8.11.6/8.11.6) with ESMTP id j1OGjao26123
for ; Thu, 24 Feb 2005 11:45:36 -0500
Received: (from root@localhost)
by fltr01.dmz.ftsm.vlnx.net (8.11.6/8.11.6) id j1OFvXA22367;
Thu, 24 Feb 2005 09:57:33 -0600
Date: Thu, 24 Feb 2005 09:57:33 -0600
Message-Id:
To: nyacc@weiser.com
Subject: TKO Notice: ***Urgent Safeharbor Department Notice***
From: "aw-confirm@eBay.com"
Content-Type: text/html
X-UIDL: >`L"!Z:V!!]_^"!f9C!!
X-Antivirus: avast! (VPS 0508-2, 02/23/2005), Inbound message
X-Antivirus-Status: Clean
eBay Suspension Need Help?
Dear valued eBay member,
We regret to inform you that your eBay account has been suspended due to concerns we have for the safety and integrity of the eBay community.
Per the User Agreement, Section 9, we may immediately issue a warning, temporarily suspend, indefinitely suspend or terminate your membership and refuse to provide our services to you if we believe that your actions may cause financial loss or legal liability for you, our users or us. We may also take these actions if we are unable to verify or authenticate any information you provide to us.
Due to the suspension of this account, please be advised you are prohibited from using eBay in any way. This includes the update of your actual account.
If you could please take 5-10 minutes out of your online experience and update your personal records you will not run into any future problems with the online service.
Please update your records by the 28th of February.
Once you have updated your account records your eBay session will not be interrupted and will
continue as normal.
To update your eBay records click on the following link:
http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?UPdate
Regards,
Safeharbor Department
eBay, Inc.
Copyright © 1995-2005 eBay Inc. All Rights Reserved.
Designated trademarks and brands are the property of their respective owners.
Use of this Web site constitutes acceptance of the eBay User Agreement and Privacy Policy.
[]
------------------------------------------------------------------------------------------------------------------------------------
Actual path from message source:
http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?UPdate
------------------------------------------------------------------------------------------------------------------------------------------------
The sites ownership Domain information
WHOIS results for 211.153.20.121
Generated by www.DNSstuff.com
Country: CHINA
Looking up 211.153.20.121 at whois.apnic.net.
% [whois.apnic.net node-1]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html
inetnum: 211.153.0.0 - 211.153.255.255
netname: BJENET
descr: ±±¾©½ÌÓýÐÅÏ¢Íø·þÎñÖÐÐÄÓÐÏÞÔðÈι«Ë¾
descr: Beijing Educational Information Network Service Center Co., Ltd.
country: CN
admin-c: HM66-AP
tech-c: KF31-AP
mnt-by: MAINT-CNNIC-AP
mnt-lower: MAINT-BJENET-CNNIC-AP
changed: ****@cnnic.cn 20040402
status: ALLOCATED PORTABLE
source: APNIC
person: huang minghui
address: ±±¾©ÊÐÇ°ÃÅÎ÷´ó½Ö109ºÅ No. 109, Qianmenxidajie, Beijing, PRC
country: CN
phone: +86-010-66074288
fax-no: +86-010-66074926
e-mail: ***@bjedu.gov.cn
nic-hdl: HM66-AP
mnt-by: MAINT-CNNIC-AP
changed: ****@cnnic.net.cn 20000815
source: APNIC
person: KANG FENG
address: ±±¾©ÊÐÇ°ÃÅÎ÷´ó½Ö109ºÅ No. 109, Qianmenxidajie, Beijing, PRC
country: CN
phone: +86-010-66074288
fax-no: +86-010-66074926
e-mail: **@BJEDU.GOV.CN
nic-hdl: KF31-AP
mnt-by: MAINT-CNNIC-AP
changed: **@bjedu.gov.cn 20010424
source: APNIC
¤º°`°º¤ø Web Hosting, Site Development and Design °º¤øø¤º°
Weiser Communications
45 East 33rd St. NYC 10016 212/725-1101http://www.weiser.com
Score: 0
Responding to BarryW's comments about an eBay phishing link which connects to a China (PRC) address:
We have gone so far as to filter (dev/null) all email coming from, or containing links to, sites in China (PRC). Where possible/practical, we also use our firewall to block browser access to China URLs.
As I suspect many of you know, that country takes virtually no action against spammers and others Net scam operators.
¤§ TBear §¤
Score: 0
Yup thanks, I know about China and Rumania and plenty other places the Spammer's make a living with them... My annoyance is that ebay wonder how much ebay is pursuing the matter I got a "final notice" same place 2 days later. They must have some pull...
Barry
Score: 0
As I've learned, the hard way I might add, eBay is disgracefully aware and non-reactive to scams, rip-offs, or other less than legal actions. I was taken in by a scammer selling a laptop computer. He had a valid account, I was guaranteed by safe harbor and square trade that the deal was legit, and the account was also legit. WHat I found out afterward was that all the accounts were hacked, and none of it was legal. In the end, I was out almost $2,000. I contacted ebay, told them what happened, (this time over the phone), described everything, and even had the third party mediation get involved. I was summarily told by eBay personnel that there was nothing they could do since the accounts were hacked. Now, here's the capper... the SAME guy or group, hacked other accounts and were trying the same scam. WHen eBay was told of this activity, they flatly told me that they were not going to do a single thing about it, even though they knew it was a SCAM. With that information, I would think that maybe eBay is on it!!! I even had to contact the FBI and fill out all those online scam forms etc.
This has never been resolved, eBay won't act, and I never got my $200 or whatever that they promise in failed deals. the FBI seems not to care either.
Beware on eBay... even with legit deals, and don't be surprised if you get screwed and they don't help you in any way.
I'm glad this has been identified. Now it doesn't sound so much like the rantings of a ticked off customer, since it's more widespread.
eBay if you're listening, I can't wait for the day when a class action suit is filed against you. I may call a lawyer and start one myself.
Score: 0
No, looking at the final page you arrive at after clicking the link won't work either, with an email I recently got. The URL started https://signin.ebay.com/ - this was in my browser, and in the email source. But it was a phishing attempt. I posted the email to spam-r yesterday.
Lord: I'd like details. I want to know why it wasn't resolvable through SquareTrade. URL with details?
Score: 0