BugTraq
eBay Account Phishing with eBay Redirect Feb 13 2005 06:08AM
Steven (steven lovebug org) (1 replies)
Re: eBay Account Phishing with eBay Redirect Feb 14 2005 07:08PM
Josh Tolley (josh raintreeinc com) (2 replies)
Re: eBay Account Phishing with eBay Redirect Feb 15 2005 05:05AM
Nick FitzGerald (nick virus-l demon co uk)
Josh Tolley to "Steven":

[re-organized to sensible quoting order]
> > The page actually appears to link to eBay and it does, the link below is
> > the one I received in my inbox recently.
> >
> > http://cgi4.ebay.com/ws/eBayISAPI.dll?MfcISAPICommand=RedirectToDomain&D
omainUrl=http%3A%2F%2F%32%31%31%2E%31%37%32%2E%39%36%2E%37%2FUpdateCente
r%2FLogin%2F%3FMfcISAPISession%3DAAJbaQqzeHAAeMWZlHhlWXS2AlBXVShqAhQRfhg
TDrferHCURstpAisNRqAhQRfhgTDrferHCURstpAisNRpAisNRqAhQRfhgTDrferHCUQRfqz
eHAAeMWZlHhlWXh
> >
> >
> > Simply:
> >
> > http://cgi4.ebay.com/ws/eBayISAPI.dll?MfcISAPICommand=RedirectToDomain&D
omainUrl=www.website.com
> >
> I just tried this with my own URL, and eBay didn't forward me to some
> other site. Perhaps they've plugged this already?

That's odd, because the original URL in the spam Steven reported (and
as seen here earlier) still works, as does the redirector with a
handful of arbitrary URLs I just plucked from memory.

At least, the redirector works if you put "http://" (or variously
encoded forms of the same) at the head of the URL. URLs of the form
"www.website.com" as suggested by Steven do not work.

In short, it does work so it's not fixed.

Site designers wanting to implement universal redirector URLs such as
this (to simplify logging of their own offsite referrals??) should
limit the redirector to _only_ accept redirects from their own servers.
And no, using http's "Referer:" [sic] header is not, in general, good
enough for this, but would help eBay in the short-term against tricks
such as this phishing scam. Of course, the modern world of content
served by third-parties from arbitrarily many or few machines on quasi-
random IPs all round the globe, depending on load and so on, makes this
_much_ harder to do properly, but that's part of the price you pay for
using cheap ugly hacks such distributed content serving depends on...

Regards,

Nick FitzGerald

[ reply ]
Re: eBay Account Phishing with eBay Redirect Feb 15 2005 12:25AM
Jonathan Rockway (jrockw2 uic edu) (1 replies)
RE: eBay Account Phishing with eBay Redirect Feb 15 2005 09:47PM
Thomas T. Evans, III (ttevans hawkcorp net)


 

Privacy Statement
Copyright 2010, SecurityFocus