Scripts in eBay Postings May Enable Phishing Attacks
US-CERT Cyber Security Alert SA06-117A --
Scripts in eBay Postings May Enable Phishing Attacks
Original release date: April 27, 2006
Systems Affected:
The eBay web site may contain pages that affect various web browsers.
Overview:
A vulnerability in the eBay web site may allow an attacker to steal personal information from eBay customers.
Solution:
Verify the legitimacy of eBay web pages
Attackers may use the vulnerability to perform a phishing attack.
Make sure that the URL is accurate, and check the web site certificate to make sure that you are visiting an authentic eBay web page.
Description:
eBay allows users to incorporate a type of code, also known as scripting, into the auction descriptions on its web site. An attacker can use this code to modify pages on eBay's web site or redirect you to a malicious web page. These may appear to be legitimate eBay web pages that request personal information. Using these techniques, an attacker may be able to collect your passwords, credit card numbers, or other personal information.
Please see US-CERT Vulnerability note VU#808921 for details and additional workarounds.
References:
US-CERT Vulnerability Note VU#808921
The most recent version of this document can be found at:
http://www.us-cert.gov/cas/alerts/SA06-117A.html
Overview
The eBay web site contains a cross-site scripting vulnerability.
I. Description
eBay is a popular auction web site. When an eBay user posts an auction, eBay allows SCRIPT tags to be included in the auction description. This creates a cross-site scripting vulnerability in the eBay website. More information about cross-site scripting is available in CERT Advisory CA-2000-02.
II. Impact
An attacker may be able to obtain sensitive data from the eBay web site. As of the publication of this document, attackers are using this vulnerability to redirect auction viewers to phishing sites and to modify the eBay auction page to steal credentials. A wide range of impacts may be possible, including disclosure of passwords, credit card numbers, or other personal information. Likewise, information stored in cookies could be stolen or corrupted. An attacker could also exploit web browser vulnerabilities that require scripting support.
III. Solution
The US-CERT is currently unaware of a practical solution to this problem, however the following workarounds may help mitigate the vulnerability:
Disable scripting
Disable scripting in your web browser, as specified in the Securing Your Web Browser document and the Malicious Web Scripts FAQ. This can also be accomplished by adding "ebay.com" to the Restricted Sites zone in Internet Explorer. Users of Mozilla-based browsers can use Configurable Security Policies (CAPS) to disable scripting for the "ebay.com" web site.
Validate web site addresses
When interacting with web sites, pay close attention to the web site address displayed by the browser. Especially when providing login information, make sure the web browser is displaying the proper URL, as described in the eBay Spoof Email Tutorial and US-CERT Cyber Security Tip ST04-014.
Validate web site certificates
Web sites may require sensitive information such as passwords or credit card information. In these cases, make sure the web site is using an encrypted (HTTPS) connection. Validate the web site certificate, as described in US-CERT Cyber Security Tip ST05-010.
Spyware Doctor is a multi-award winning spyware removal utility that detects, removes and protects your PC from thousands of potential spyware, adware, Trojans, keyloggers, spybots and tracking threats.
Spyware Doctor is fully capable of detecting and removing hidden processes associated with complex threats and rootkits. Such threats are otherwise difficult to remove by conventional means since they may be hidden to the operating system.
A Startup Scanner removes references to malicious programs that run at startup in the registry and Windows startup files, as well as malicious files in Windows startup locations.
State-of-the-art scanning engines, including file scan, memory scan, registry scan, browser helper objects scan, cookie scan and much more.