eBay Account Stolen

I'm absolutely stumped as to why it happened, but my eBay account was stolen last weekend. The whole circumstances to it was very wierd. I basically received an alert that the email address on my account was changed and that a new auction had been posted. I logged in to find someone else's email address (something@inbox.com) in my profile and a auction started for a $14,000 Harley Davidson.

Oddly enough, whoever had taken over my account and started this activity didn't bother to change the password, so I was easily able to log in, change my password, and get my account back.

The thing is, I can't figure out how this happened. Consider the following circumstances here:

1) Every computer I use is heavily scanned and guarded against spyware. I always use Spybot, Adaware, Spyware Guard, and Spyware Blaster.
2) AV is up to date and scanning regularly.
3) I have not clicked any links in emails, so I have not fallen prey to any phishing scams.
4) I was using an eight character password mixed with a balance of letters and numbers, and did not give that password out to ANYONE.
5) eBay actually caught the account theft before I had time to report it, so eBay automatically restored my account settings and removed the Harley Davidson auction. How did they know before I did? What alerted them, I wonder?
6) The auction that was posted was in eBay Motors. Oddly enough, I had never ventured into the eBay Motors section of the site until about a week prior. Coincidence?

So I immediately confirmed with eBay that everything was resolved, then reported the identity theft to the FTC and put up a 90-day alert through Experian, Equifax, and TransUnion, so my butt's covered on that front. But the question is, how did this person manage to get around ALL my safeguards and still steal my account? And how could eBay have known it happened without me reporting it?

Quote:

---

But the question is, how did this person manage to get around ALL my safeguards and still steal my account? And how could eBay have known it happened without me reporting it?

---

It was an E-Bay employee who was being dishonest?

That's exactly one possibility I was starting to suspect...Man, that would really suck too!

If i could offer a few recommenations:

Make your password more complex it might be a pain in the butt but if you can memorise your password it most certainly can be cracked by a web based password cracker.

Try to make your password alot longer than your previous password try to make it close to the maximum allowed by ebay and make sure your password is completly random and contains letters and numbers which are lower case and upper case and include special characters such as: @_ and others that might be allowed by ebay.

Also you did not mention if you have notified your bank to get your card's canceled and account number's changed?.

This is important because in the password reset options it asks you for the last four digits of your card number and i think you can see these numbers under your account information when you are logged in to your account also this will stop fraud against your account if this is an inside attack.

Also the account thief could of already sold items using your account then deleted all the items so this will stop any fraudulent charges against your account.

Do you also have a PayPal account?

EDIT: Also i forgot to add that you should use different passwords for every service that you sign up for so if your password does get comprised or becomes known to one party they cant gain access over your other accounts.

Well,

If you have an e-bay account you are a retard, and a paypal account would make that double bubble.

They are both wide open to fraud....................I understand (on the QT) that the British Government will be putting both of them out of business within the next 12 months.

Fraud, drugs, stolen property, social welfare benefits fraud; and those are only the more socially acceptable parts of it..............................go figure........................ :rolleyes:

If someone comes to me with something that they bought on e-bay, I just tell them to £$%^&*& OFF....... I really don't want it anywhere near me.

No offence intended Angelic old chap, but please wise up before you get caught out ;)

Greeting's

One more company which is incompetent enough to have members password's accessible to its employee's.

Plus they have dumb employee's :rolleyes:

Possibly some malicious code in an auction you may have veiwed, what browser do you use? That would also explain how ebay found out about it. Ebay seems to be very slack on the code they let people use in the auctions/descriptions. Just an idea.

Quote:

---

Originally posted here by AngelicKnight
I'm absolutely stumped as to why it happened, but my eBay account was stolen last weekend. The whole circumstances to it was very wierd. I basically received an alert that the email address on my account was changed and that a new auction had been posted. I logged in to find someone else's email address (something@inbox.com) in my profile and a auction started for a $14,000 Harley Davidson.

Oddly enough, whoever had taken over my account and started this activity didn't bother to change the password, so I was easily able to log in, change my password, and get my account back.

The thing is, I can't figure out how this happened. Consider the following circumstances here:

1) Every computer I use is heavily scanned and guarded against spyware. I always use Spybot, Adaware, Spyware Guard, and Spyware Blaster.
2) AV is up to date and scanning regularly.
3) I have not clicked any links in emails, so I have not fallen prey to any phishing scams.
4) I was using an eight character password mixed with a balance of letters and numbers, and did not give that password out to ANYONE.
5) eBay actually caught the account theft before I had time to report it, so eBay automatically restored my account settings and removed the Harley Davidson auction. How did they know before I did? What alerted them, I wonder?
6) The auction that was posted was in eBay Motors. Oddly enough, I had never ventured into the eBay Motors section of the site until about a week prior. Coincidence?

So I immediately confirmed with eBay that everything was resolved, then reported the identity theft to the FTC and put up a 90-day alert through Experian, Equifax, and TransUnion, so my butt's covered on that front. But the question is, how did this person manage to get around ALL my safeguards and still steal my account? And how could eBay have known it happened without me reporting it?

---

What about using the same password at other web sites? Do you do that?

[5] Perhaps eBay got notice from an educated user who sniffed out the scam. I know I contacted a seller about an auction once, and the seller pushed me to use a Wire Transfer to an account in Romania, so I alerted eBay fraud. They told me that the account was hijacked and notified the user and removed his auction items, and notified the original account holder. Perhaps that is what happened here too...

Ebay will most likely use systems to detect suspicious actions, likely using neural networks, banks use similar for finding odd transactions and detecting debt risk assessment, among many other things of course.

if you feed a neural net a series of parameters in the form of training data of know fraudlent transactions then you will be able to produce a network capable of monitoring in real time potential or likely actions such as these you have encountered. I've implemented similar systems in my work.

This scam could of course just be a quick way to make $14,000, but I would hedge my bets that is is more than likely a means of money laudering.

I see no problem with trading through ebay, its the use of commonsense and the use of hard measures with a fall back (I.E. a cheque you can cancel, or picking up in cash), Auctions have always been a places rampent with money laundering,

Paypal is Swiss centric, so I see no means by which the UK goverment can have any means of preventing it, if you know anything about swiss banking laws - but I could be wrong of course!

Anyway good luck.

i2c

Quote:

---

It was an E-Bay employee who was being dishonest?

---

I would HOPE that ebay encrypts all passwords so not even employees can see what the password is so I think I would safely remove that possiblity..

As to how ebay might have detected it first, maybe the person who stole it tried many different combinations or maybe the IP was an IP of a person known for doing this to other accounts (Although I would suspect they would block the IP first..but still remains a possibility). Or maybe they used a known-exploit that hasn't been patched yet.

Another thought, you said they restored your settings before you found out, maybe this person DID change the password but ebay changed it back before you found out about it..

[note] I'm not sure if any of these possibilities were mentioned I didn't have the time to read everything in detail, I skimmed through the posts..

If the e-mail address on your account was changed, how did you recieve the alert(e-mail?)? A common phishing scam is to send these "alerts" so you will log in via the phishing site to check the account,hence handing over the password to them. Not saying thats what happened, but you may want to go back to e-bay(the REAL e-bay)and change it again.


-Maestr0

Maestr0 you do make a good point (there have been scams working that way), but i know by personnal experience that when you do change your primary email address, eBay still sends a Email Change Notice to your previous mail.

It also sends an undeletable alert message to your ebay message center, notifying you of the change... so scam doesn't seem the case to me.

cheers

i2c

Quote:

---

Paypal is Swiss centric, so I see no means by which the UK goverment can have any means of preventing it, if you know anything about swiss banking laws - but I could be wrong of course!

---

The UK government can allow, licence, tax, or prevent anything it likes in the financial sector.

As you may be aware, bankers are licenced, brokers are licenced, pension and investment funds are licenced.................etc.

Recently the Inland Revenue and the Customs and Excise have been merged.

Banks now have to report every miscellaneous deposit of £10,000 or more into a private account.

The current UK government objective is to clamp down on money laundering and tax evasion. Auction sites and fringe banking outfits like PayPal are a rich source of this kind of activity and legislation/regulation is on its way ;)

Remember that there is income tax if you are trading, value added tax if you are trading and Capital Gains Tax if you are not trading.

We are dealing with a government that introduced taxation on the income and capital gains of pension funds, then has the temerity to complain about UK pensions being "underfunded"

The same outfit who tax free private health schemes, then whine about the cost of the National Heath Service?

I cannot reveal my source, but it is opposition front bench

;)

One thought for ya Angelic,
It happened once, it could happen again.

Ebay knows about it.

Call Ebay and press them for an answer, that is what I would do? Ask for the guy on the phone's boss till you get your answer, or ask for that guys boss. Someone knows and isn't telling.

This isn't a password strength issue nor is it a problem with your local security practices. You can set your PW to 130 chars and the same thing would happen.

Quote:

---

Ebay seems to be very slack on the code they let people use in the auctions/descriptions. Just an idea.

---

Of all the possibilities, this one carries the highest probability. I've seen about half dozen browser/piss poor code combos used against e-bay accounts.

At the moment, I recall seeing one reported about a week ago on a closed mailing list. The details are very similar to your experience. I'm guessing you are one of the random victims.

Meastr0, when you change an e-mail account on e-bay, their procedure is to send an alert to the e-mail account that was changed just for cases like this one.

Don't bother pressing e-bay for details. Insiders tell me that they do not disclose the facts of compromises except those approved through their public relations dept. Also, the reason they fixed it and know about the issue is because it was reported to them 7 days ago and they know precisely what to look for when this exploit is used.

Best rec. Get rid of IE.

--Th13

Quote:

---

The UK government can allow, licence, tax, or prevent anything it likes in the financial sector.

---

I guess we won't be seeing you chaps on the net much longer. ;) Blocking the ebay.co.uk and ebay.com urls, then paypal, next will be hacking sites of which antionline often filters into. Adios mate.

RoadClosed

Quote:

---

Blocking the ebay.co.uk and ebay.com urls, then paypal, next will be hacking sites of which antionline often filters into. Adios mate.

---

OMG! you credit our politicians with that amount of technical knowledge? :eek:

Nah! this will be the good old fashioned corporate regulatory legislation........rubber truncheon stuff......hehh, even our Home Secretary looks like a street thug :D

At the moment it is all about money, and government money not corporate money. In fact your RIAA and MPAA would probably wither and die over here, your "Millenium Copyright" thing would have no chance here..................nothing in it for the Treasury.

Can you name me a single government that has any idea about IT and the internet?

AFAIK they are looking on this as a sort of credit card and mail order purchasing situation, with money laundering and tax evasion thrown in? :rolleyes:

Are you sure you did not get Phflished....
I get e-mails all the time saying my Pay-Pal or e-bay
account was hacked.... But looking at the headders
always tells the truth...

Quote:

---

Can you name me a single government that has any idea about IT and the internet?

---

China. :p In the US banks are heavily regulated but what we call "Money Service Business" aren't. But these money services have to bank with someone to transact. And that is where they are monitored through existing laws such as the Bank Secrecy Act, Patriot Act, and some anti Money Laundering activities we have. In American it would be tough to get the government into regulating private business outside of banking. And I am not sure I want them too. Millions of transactions are checked every second I would wager. Most Americans don't realize how closely funds are monitored these days and our limit to trip a response is much lower than in the UK.

Sounds to me as if a Cracker is attempting to exploit a hole in ebay, this would be the reason why they didnt change the password. Just change the email and throw up a fake auction. If someone was really wanting to steal your account. Why not just "buy now" everything in site? That reminds me, Time to change all my passwords. I saw something resently on my auction I got a question for a thing I was selling and it was spam.

Sounds to me as if a Cracker is attempting to exploit a hole in ebay, this would be the reason why they didnt change the password. Just change the email and throw up a fake auction. If someone was really wanting to steal your account. Why not just "buy now" everything in site? That reminds me, Time to change all my passwords. I saw something resently on my auction I got a question for a thing I was selling and it was spam.

As for changing the password, I'd suggest something non-sensical (is that even a word?)

A friend of mine does this: Take a word and shift the letters to the top left or right.

For example, if your password was antionline, it'd become wj69p9j4 with the letters shifting to the upper-right.

Shifting to the upper left would be qh58i8h3.

Yeah, I already use wierd passwords like that.

Quote:

---

Another thought, you said they restored your settings before you found out, maybe this person DID change the password but ebay changed it back before you found out about it..

---

Let me clarify that -- It was a very short window of time that this all went down. I got the email alert confirming my email address change (which I of course did not authorize), so I logged into eBay (NOT by clicking on any links in the message, mind you) to find my personal settings changed. I was seconds away from contacting eBay when I actually received an email from them stating they discovered my account had been stolen and restored everything. So we're looking at about a five minute window. I knew before eBay notified me, but eBay found out before I had a chance to contact them.

Also, I use Firefox...I only use IE for sites that require it (which are fewer and fewer nowadays).

Couldn't have been phished since I never use links in emails. I always log in using a bookmark button in Firefox.

And thanks TH13 for a full, educated explanation there...That's what I was starting to suspect, some auction page that was exploiting a vulnerability. I just hadn't realized they had been that slack on preventing such things.

And Nihil, I rather enjoy being a retard...But I find the risk minimized if you monitor your accounts daily and report any odd activity the minute you see it. Even once my account was stolen, everything was brought under control and restored in mere minutes, so that was refreshing. Nothing's foolproof, but you can at least keep your risks to a reasonable minimum.

All of this sounds VERY familiar to me :rolleyes: . I get emails from "ebay" and "paypal" about my "accounts" in an email address that has never had either one attached to it. I also get emails from banks I've never had accounts with. All kinds of ebay and email scams, hijackings, etc. have and will abound. As much as you may not want to think about it, is there a possibility that someone close to you might have done this? About three or four years ago, a friend a good friend of mine had her ebay account temporarily hijacked by her son. He had installed a keylogger onto the computer and found passwords.Once he came up with the needed passwords, he changed her ebay information to a new email and paypal account he'd set up. Since he then knew her password for her email address, he just watched for the appropriate emails to come in, then deleted them.

You could also have gotten a keylogger come in on an auction site, or any other site, for that matter, that had one attached. Also, consider rootkits and backdoors. Remember: running just one spyware program on a pc is not enough. Different ones catch different things.

Els

From a little bit of research, it seems as if thehorse13 is correct. This seems to be an unreleased exploit which ebay have become aware of. I have searched the usual forums but have found nothing "new" so unless it is an old vulnerability that ebay have still not patched. (Which def could be the case!)