Bug discovered allowing cyber-criminals to steal eBay passwords

A researcher naming him or herself 'MLT' has reportedly discovered what he/she described as “a fairly basic”, but effective flaw in eBay’s website, which has potentially exposed its customers to an advanced phishing attack. The flaw allows cyber-criminals to host a fake login page (phishing page) linked to eBay’s own website, which then allows the perpetrator to steal users’ confidential passwords and harvest their data. It does this by automatically exporting the details that the user has entered into the spoof site during their attempts at signing in. The flaw lies in the URL destination and a bug called a cross-site scripting (XSS) vulnerability, which allows the attacker to insert malicious code into the legitimate website. URL links could be embedded with malicious emails and sent to the unsuspecting user, who could in turn find their own accounts hacked and used to scam other users. The vulnerability was reported to the company in December 2015, and reportedly patched this month.

A security flaw found on eBay's website put millions of its customers at risk of having their confidential login details stolen.

The phishing attack potentially enabled hackers to set up fake login pages tied to the ebay.com domain, which could dupe users into giving away their username and password, according to an independent security researcher known as MLT, who told eBay last month about the flaw.

MLT said the vulnerability, which he described as "fairly basic" for those with the technical know-how, presented a huge risk to millions of eBay users.

URL links could be embedded within malicious emails to unknowing customers, who could then find their accounts hacked and used to scam other users.

The researcher shared a blog post exposing the flaw on Monday to demonstrate how easy it would be for a hacker to exploit unwitting customers.

The source of the flaw lies in the URL destination, and a common web bug, known as a cross-site scripting (XSS) vulnerability, which allows an attacker to insert malicious code into a legitimate website.

MLT demonstrated setting up a fake eBay login page, which looks just like the real thing, and is anchored to the master domain (ebay.com).

After setting up the fake page, MLT typed in his username and password on the spoof site and attempted to sign in. It gave him an error message. However, the spoof page had also automatically exported the details he had entered as plaintext to a location he had previously specified.

MLT submitted his finds to eBay on 11 December 2015. He said in his post that he did not get a follow-up from the company, until it began receiving media enquires.

eBay has confirmed to IT Pro that it has patched this specific vulnerability as of 11 January 2016. As to why it took so long, the company put it down to "miscommunication" with the researcher.

An eBay spokesman told IT Pro: "As a company, we're committed to providing a safe and secure marketplace for our millions of customers around the world.

"We take reported security issues very seriously, and work quickly to evaluate them within the context of our entire security infrastructure. We're aware of this particular issue, which involves fraudsters attempting to phish customers using malicious code in very limited use cases. This type of scheme is extremely rare on our platform.

"We're continuously adapting our security systems as we become aware of new forms of malicious code, as well as taking the necessary steps to prevent such phishing attempts. We maintain a responsible disclosure program for eBay where we partner with researchers to address these issues."

This article was originally published on 12 January 2016 at 13:18. It was updated later that day at 16:10 to include eBay's comment.