I just tried this out and it worked for me. I got a page asking for a
login name and made up a login name and password. After ``logging
in'', I got a page asking for my address, phone, CCN, bank information,
etc. (They ask for everything! ATM PIN, SSN, DOB, etc... who would
actually provide this to the real eBay!?)

After I submitted my fake data, it redirected me to the real eBay login.

Regards,
Jonathan Rockway

On 14 Feb 2005, at 1:08 PM, Josh Tolley wrote:

> I just tried this with my own URL, and eBay didn't forward me to some
> other site. Perhaps they've plugged this already?
>
> Josh Tolley
> Raintree Systems, Inc.
> http://www.raintreeinc.com
> 760 509 9000
>
> Steven wrote:
>> I am not sure if this is better served by incidents or bugtraq, but
>> in any event here it is. I frequently get the fake looking e-mails
>> phishing for my Paypal, eBay, and banking login/password information.
>> Generally the links to the spoofed webpages are just links to a fake
>> page with a modified A HREF tag. However, it appears someone has
>> found that eBay's actual page has a command to redirect to a
>> specified webpage. While this shouldn't be a big risk, it still
>> poses a small one and is being actively exploitated.
>> The page actually appears to link to eBay and it does, the link below
>> is the one I received in my inbox recently.
>> http://cgi4.ebay.com/ws/eBayISAPI.dll?
>> MfcISAPICommand=RedirectToDomain&DomainUrl=http%3A%2F%2F%32%31%31%2E%3
>> 1%37%32%2E%39%36%2E%37%2FUpdateCenter%2FLogin%2F%3FMfcISAPISession%3DA
>> AJbaQqzeHAAeMWZlHhlWXS2AlBXVShqAhQRfhgTDrferHCURstpAisNRqAhQRfhgTDrfer
>> HCURstpAisNRpAisNRqAhQRfhgTDrferHCUQRfqzeHAAeMWZlHhlWXh Simply:
>> http://cgi4.ebay.com/ws/eBayISAPI.dll?
>> MfcISAPICommand=RedirectToDomain&DomainUrl=www.website.com Steven
>> steven (at) lovebug (dot) org [email concealed]
>>
--
Jonathan Rockway <jrockw2 (at) uic (dot) edu [email concealed]>
http://www.uic.edu/~jrockw2/

[ reply ]