Help & FAQs    Search BCF    Members    Groups    Events Calendar
Resend my activation email : Register : Log in 
BCF: Bike Chat Forums


eBay account hijack vulnerability

 Reply to topic
Bike Chat Forums Index -> Found on the 'Net
View previous topic : View next topic  
Author Message

ScaredyCat
World Chat Champion



Joined: 19 May 2012
Karma :
PostPosted: 13:37 - 28 Dec 2013    Post subject: eBay account hijack vulnerability Reply with quote
Quote:
EBay is vulnerable to a hack that would allow an attacker to hijack an account and make unauthorized purchases from the victim’s account that would be difficult to disprove.

The vulnerability was discovered and reported to eBay in August, and despite three separate communications from the online auction and marketplace that the code in question was repaired, the site remains susceptible to exploit.



Quote:
“I’ve given up asking eBay. The intention now is to raise awareness with as many people as possible,” Moore said via email. “The addition of one-click payments via Paypal mean it’s now more urgent than ever, as attackers can use linked Paypal accounts to purchase goods, even without knowing the user’s Paypal username or password. With the initial exploit being carried out by the affected user’s PC, it’d be difficult to disprove they weren’t responsible for any action which followed.”



https://threatpost.com/ebay-vulnerable-to-account-hijacking-via-xsrf/103311

More detail here

https://ramblingrant.co.uk/2013/09/16/ebay-security-expose-2/
____________________
Honda CBF125 ➝ NC700X
Honda CBF125 ↳ Speed Triple
 Back to top
View user's profile Send private message You must be logged in to rate posts

doggone
World Chat Champion



Joined: 20 May 2004
Karma :
PostPosted: 15:03 - 28 Dec 2013    Post subject: Reply with quote
Wouldn't the need to have things sent to a different address make it rather obvious the real account holder did not buy?

Also they would need to hack Paypal password too unless you had that quicker checkout thing (I haven't enabled)
 Back to top
View user's profile Send private message You must be logged in to rate posts

ScaredyCat
World Chat Champion



Joined: 19 May 2012
Karma :
PostPosted: 11:10 - 29 Dec 2013    Post subject: Reply with quote
doggone wrote:
Wouldn't the need to have things sent to a different address make it rather obvious the real account holder did not buy?

Also they would need to hack Paypal password too unless you had that quicker checkout thing (I haven't enabled)


It depends on what they're using your account for I suppose. If they want to use it fro fraudulent selling then there's no risk for them at all and they need nothing else.

Although both you and I don't link paypal to their ebay account but a hell of a lot of people do - some have paypal linked to their bank account or cash card. Even if you did eventually get your money back, could you afford 30 days with an empty account ?
____________________
Honda CBF125 ➝ NC700X
Honda CBF125 ↳ Speed Triple
 Back to top
View user's profile Send private message You must be logged in to rate posts

Rogerborg
nimbA



Joined: 26 Oct 2010
Karma :
PostPosted: 12:35 - 29 Dec 2013    Post subject: Reply with quote
tl;dr version - if you're logged in to eBay with an open tab and viewing an item and have 1-click integration with PayPal turned on and browse to a theoretical exploit on some dodgy site with another tab in the same browser, a paedophile could buy the thing you're looking at and have it sent to their address.

https://www.letsjapan.org/Graphics/somebody-think-of-children.jpg
____________________
Biking is 1/20th as dangerous as horse riding.
GONE: HN125-8, LF-250B, GPz 305, GPZ 500S, Burgman 400 // RIDING: F650GS (800 twin), Royal Enfield Bullet Electra 500 AVL, Ninja 250R because racebike
 Back to top
View user's profile Send private message You must be logged in to rate posts

-Matt-
World Chat Champion



Joined: 28 Apr 2013
Karma :
PostPosted: 18:32 - 29 Dec 2013    Post subject: Reply with quote
doggone wrote:
Also they would need to hack Paypal password too unless you had that quicker checkout thing (I haven't enabled)
I enabled that quicker checkout thing a few weeks ago after avoiding it at first. It still asks me for a paypal password each time, but now in a pop-up window in the final ebay page as opposed to opening up a seperate Paypal window and login etc.

So it does seem just as secure - just a bit less hassle with new windows and more confirmation buttons Thumbs Up
 Back to top
View user's profile Send private message You must be logged in to rate posts
Old Thread Alert!

The last post was made 12 years, 227 days ago. Instead of replying here, would creating a new thread be more useful?
  Display posts from previous:   
This page may contain affiliate links, which means we may earn a small commission if a visitor clicks through and makes a purchase. By clicking on an affiliate link, you accept that third-party cookies will be set.

Post new topic   Reply to topic    Bike Chat Forums Index -> Found on the 'Net All times are GMT + 1 Hour
Page 1 of 1

 
 You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum

Read the Terms of Use! - Powered by phpBB © phpBB Group
 
Debug Mode: ON - Server: birks (www) - Page Generation Time: 0.09 Sec - Server Load: 1.76 - MySQL Queries: 14 - Page Size: 46.64 Kb