I recently found out about yet another issue Ebay has had with security on there site. This time, the issue is script injection. I've attempted to briefly expose the technical innerworkings of this in this post. Here's an example:
When the use clicks on this page, a piece of remote javascript is loaded using this:
Which, in turn loads this script from a Greek site:
Which, in turn loads this script from a Greek site:
I don't know if any of the site owners are innocent, so I've commented them out just in case.
This JavaScript then sends a redirect to another page, which in turn redirects to a site asking for the users Ebay credentials (note the Norton verification seal in the bottom corner):
The login page is a PHP page and seems to change according to different ads placed on Ebay, but they're all focussed on phising Ebay credentials.
To resolve this, Ebay should stop users submitting javascript in the description of listed products and, as this has actually been around for a while in the form of a flash app, flash should also be blocked.
No comments :
Post a Comment
Please be responsible with comments. Any comments made on posts over 14 days will be moderated before appearing on the site.