Online auction and sales company eBay has been successfully infiltrated by cyber-thieves which has potentially compromised credentials belonging to users.
Credentials may have been stolen when users clicked on some listing links which automatically redirected to a spoof site which was designed to steal credentials. This site had been designed to look like the online marketplace’s welcome page.
eBay was made aware of this but it took them over 12 hours to remove the listing from their website. It is yet known how many users had clicked on this link and entered account details within this time period.
Dr Steven Murdoch who is from University College London’s Information Security Research Group believes that the response time from eBay’s security team wasn’t good enough in this instance but that they are normally pretty competent when it comes to security.
Murdoch stated, “eBay is a large company and it should have a 24/7 response team to deal with this – and this case is unambiguously bad. The websites the user is being redirected to are almost certainly compromised by the attacker to hide his or her traces.”
Murdoch added, “eBay is pretty competent, but obviously it has been caught out here. Cross-site scripting is well within the top 10 vulnerabilities that website owners should be concerned about.”
Paul Kerr who is an IT worker from Alloa in Clackmannanshire discovered the threat and believes that other users will not have realised the danger that they were in.
Kerr stated, “You can bet your bottom dollar that somebody’s going to click on that and be redirected to a third-party site and they’re going to enter their details and be compromised. You can bet your bottom dollar that somebody’s going to click on that and be redirected to a third-party site and they’re going to enter their details and be compromised.”
An eBay spokesperson claimed that the eBay network hadn’t been infiltrated but that it was a case of abuse by a user.
The spokesperson stated, “The eBay corporate network has not been compromised. This appears to be a case of abuse by a user who placed malicious links within a few product listings on eBay.co.uk. We take the safety of our marketplace very seriously and remove listings that are in violation of our policy on third-party links.”
It is very important that users remain aware when online and only enter confidential details such as passwords when 100% sure that the website is legitimate and secure. It is also important that different passwords are used for each online account to ensure that if a password is compromised, it cannot be used to access several different accounts.
