![Security Security](http://a.fsdn.com/sd/topics/security_64.png)
![The Internet The Internet](http://a.fsdn.com/sd/topics/internet_64.png)
Hacker May Be Exposing eBay Back Door 73
pacopico writes "A hacker specializing in eBay cracks has once again managed to masquerade as a company official on the site's message boards, according to The Register. A company spokesman denies that 'Vladuz's' repeated assaults on eBay point to a larger problem with the site's security. Of course, eBay two days ago claimed to have found a way to block Vladuz altogether, only to see him pop up again. The hacker himself made comments indicating that the company's email servers are connected somehow to the financial information eBay hosts."
FUD (Score:5, Interesting)
$100 says this guy has a huge short on ebay stock.
Re: (Score:2)
Re:FUD (Score:5, Funny)
Re: (Score:2, Insightful)
Has he? How do you know he's not a disgruntled ex-employee, who would have knowledge of their network legitimately? How do you know he's not in cahoots with an ex-employee? Why make persistent efforts to expose this unproven "flaw" in a public manner unless the intention were to harm eBay's image and/or their stock position?
This sort of information would be worth a lot of money on the black mark [pcpro.co.uk]
Re: (Score:1)
hell, if he's in cahoots with someone, would it have to be an ex-employee?
Re: (Score:1)
It's pretty simple actually. I'll give you a hint: The key word is "people".
Re: (Score:2)
Well, cause it's funny.
Or so his name gets in the news.
mainly the latter.
Re: (Score:2)
Given what has happened to other people who have found [zdnet.co.uk] or disclosed vulnerabilities [csoonline.com], that is probably more of a risk than attacking the site.
This has been discussed [slashdot.org] on Slashdot before [slashdot.org].
Re:FUD (Score:5, Insightful)
In practice, nothing forces a change faster than an obvious break-in that discomfits the boss's secretary: the second fastest is something that affects the stock price. Even something that is being actively used for break-ins is often ignored due to recalcitrant developers and users who cannot be troubled to use secure practices, or to invest in keeping their software upgraded. The worst of them are those who think "we're inside a firewall, we trust the people we work with!". Then they sneak in a laptop from home and expect it to just work.
Re: (Score:2)
More critical thinking suggests he has already plundered the information, did so long ago and has been refreshing his copy frequently, finally made enough on the black market selling it in small chunks rather than risk letting someone know what he had and get ratted for bounty or someone else trying to buy their way out of being prosecuted for something else and perhaps is already enjoying life in abu dabi?
H
Re: (Score:2)
Re: (Score:1)
I think what really matters here is whether there's a two way communication or one way communication. I would assume that ebay would follow proper design and security patterns, and just allow for the transaction servers to notify the email servers about state changes, so that they can send the appropriate message. The question is whether you can access more than just email if you break into the email servers, which would imply that there is some kind of access from the email servers to the transaction serve
Time for a new plan.... (Score:5, Interesting)
Re:Time for a new plan.... (Score:5, Insightful)
Breaking in. Taunting someone and then getting paid to fix things? Bad precendece I would think.
That might not be possible. (Score:1, Insightful)
According to Netcraft [netcraft.com], eBay appears to heavily use Microsoft software for their main North American operations. If that list is correct, it seems that most of their sites run on Windows 2000 or Windows Server 2003, using IIS 5.0.
If these exploits are due to problems within Windows or IIS, it's basically outside of eBay's control as to whether or not such things get fixed. But we also have to question the competency of developers who would choose to base any signi
Idiots and their web sites... (Score:2, Informative)
Right, because Apache magically prevents you from misconfiguring your servers and writing bad code?
Both IIS 5.0 and IIS 6.0 can be easily secured, IIS 6.0 is simply more secure "as installed". I ran one of the biggest hacker targets on the Net on IIS, and every single moron who announced giddily that "we are so owned, we are so stupid" walked away with their head hung low. Web site sec
Re: (Score:2, Insightful)
Neither compare to the security of Apache. One of the main problems with IIS is that updates are so slow in coming after a vulnerability is discovered. And since you don't have the source code, you can't deal with the problem yourself. With Apache, patches are usually available within hours, sometimes even minutes, of a vulnerability being located. And you do have the source code, so you can immediately fix any prob
You're full of it... (Score:2, Informative)
But both of them can be secured properly.
There are MILLIONS of IIS servers running sensitive information.
You saying otherwise is FUD every bit as disgusting as anything Microsoft produces.
Everyone needs to work together to bust the fud.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
If you're talking about the website code and not the server code, it won't do a damn thing to help you if there's a buffer overflow in the server itself.
Choice of OS has surprisingly little to do with it.
Until somebody finds an exploit in your server code, and then it can make all the difference in the world.
BTW, do you think that hackers who are after e.g. financial information are going to do something so silly as to announce that you were
ridiculous (Score:1, Interesting)
Re: (Score:1, Offtopic)
Perhaps it's because I only buy and don't sell?
Re: (Score:1)
Re: (Score:1)
Block him from gaining Customer Service (a.k.a. "admin") rights to the system, not block him from being a customer. RTFA.
Re: (Score:2)
Jack: Hey, Ravi. What have we got?
Ravi: Brute-force login.
The interesting thing is he's coming in through Hong Kong,
Korea and Malaysia, but he's trying sequential account
numbers. He's hacking all over!
Jack: Move over for me.
Let's try a rule change on him,
see what he does. Put in an IPS signature
that black-holes the pattern. See if that slows him down.
Ravi: That'd slow me down!
Maybe Not (Score:5, Insightful)
Your choice in Operating System does little to mitigate bad coding. eBay has never been known for their technical wizardry and coding sophistication. It wouldn't surprise me if their back doors were wide open. (If you knew where to look.) For example, instead of having secure B2B messaging channels between different offices and departments, they might use machine formatted Internet Email that gets decoded by machine on the other side. Which would mean that a lot of "financial information" could be travelling over "their email system".
10:1 says the guy is an employee who lost his gruntles.
Re: (Score:3, Informative)
Any firm that allows an EXTERNAL user to login to the company LAN or email server w/o a very secure two factor authentication (such as a RS
Don't blame bad coding for bad architecture. (Score:1)
Re:Don't blame bad coding for bad architecture. (Score:4, Informative)
http://www.theregister.co.uk/2005/07/13/ebay_sun_
and
http://sun.ebay.com/odcs/custom.htm?template=popu
So, yeah I'l agree with you - its probably bad architecure that's at fault.
Re: (Score:3, Interesting)
Go to ebay.com's main page. Check out some of the links like "register" or "pay". See that "eBayISAPI.dll" in the cgi URL?
They use Microsoft too, unless someone with a bizarre sense of humor has a file named eBayISAPI.dll on Solaris...
Re: (Score:2, Informative)
The VAST majority of ebay is Windows. Solaris is only used for Oracle on the very back end.
Re: (Score:2)
Thanks for the inside info.
Re: (Score:1)
Re: (Score:2)
Re: (Score:3, Informative)
Read this [nyud.net] which is a presentation from one of eBay's technical architects. It outlines the evolution of the technology and the challenges they face, as well as the huge volume of data!
Re: (Score:1)
Re: (Score:2)
Eastern Europe has a lot of experienced computer haxors.
He claims he's Romanian & the FBI is looking in Romania.
Romania (pop ~22 million) is one of the top 10 biggest hubs for online crime.
The only other small country in the top 10 is North Korea.
They're up there with China, Russia & U.S.A.
(USA #1 woo!)
Not an auction site... (Score:5, Insightful)
...eBay is just a venue for people to exchange items, such as malicious code into an unexpecting user's browser.
When will they learn to do something simple like disallow META tags in item descriptions to stop redirects to sites with malicious code, rather than to hide such things and disavow any responsibility.
Re: (Score:1)
And you ask me why I clicked? I wanted to see what the hell they had to sell!
Re: (Score:2)
A lot of pages where users can put their own data and are allowed to 'style' it, gets abused and if not abused, is contesting for worst designed webpage of the year. This is so for bays, tubes, spaces and I'm kinda getting sick of it. If you want to display some data the tags mentioned above should be enough, if not, then you can put in a link to your own website so that it's clear it comes from another source.
Re: (Score:2)
Where is your mind at? (Score:4, Funny)
Sounds like the author has an anal fixation to me!
Not the place to talk about exposed backdoors (Score:5, Funny)
Re: (Score:2)
In other news, Boston was shut down for the second time in a month due to LED billboards...
Err: "Notice how we fit together?"
Ignignokt: "Except this time I'm doing it as wide as I can!"
Boston Mayor: "How can you treat this with kid gloves?"
Berdovsky and Stevens: "That's a goat question, not a hair question."
I can solve this for EBAY (Score:2, Funny)
ebay is a haven... (Score:3, Interesting)
What a Loser (Score:3, Informative)
Do that many people really get their news from eBay message boards? This guy is getting on account and posting messages. What is his next hack going to be? Use a stolen or fraudulently created account to post a *FAKE* auction? This guy can hardly penetrate systems at will. I think there's a reason he only seems to pop up at certain times. Classify this guy as another moron that needs to find something better to do.
Hopefully this loser will join the ranks of Victor Faur [zdnet.com]. Not so much in notoriety, but in the loss of the right to use a computer or travel internationally.
Their sign-in server needs some work too (Score:2, Interesting)
He is right.. (Score:1)
explanation for ebay credit card fraud? (Score:1, Insightful)
Balkanisation (Score:1)
Wonder why ? (Score:1)