eBay scripting trick used to boost seller ratings (Shockwave redirection ploy)

The Register (U.K.) ^ | March 18, 2008 | John Leyden

[Stoat]

eBay scripting trick used to boost seller ratings

Shockwave redirection ploy in mystery auction attack

By John Leyden → More by this author

 

 

Published Tuesday 18th March 2008 17:04 GMT

---

Hackers have been caught using a malicious scripting scam in an apparent attempt to boost their rating on eBay.

An auction for a 4WD car on eBay.co.uk featuring the ruse was brought to our attention by Reg reader John early on Monday. eBay pulled the auction on Monday afternoon but The Reg has this screenshot.

The auction for a 2007 Range Rover Sport HSE offered a car valued at £40K for £12K. Clicking on the auction generated a suspicious pop-up, served up from Russia. Having established something was amiss we called up security experts at Sophos to analyse the attack, which we initially took to be a scripting variant of the Bayrob Trojan scam.

Not so.

Sophos established that surfers who click on the dodgy listing see a regular item page along with an embedded tag pointing to a Shockwave file. This Shockwave file redirects the user to an .aspx page in Russia. At the root of the page are two other similar .aspx pages - linking to other (already completed) vehicle auctions. ASPX is an html file format used to create Webforms.

The approach may have been used to harvest email addresses, or more likely as a way for dodgy sellers to give themselves a better reputation. Following the removal of the auction it's hard to be certain, but Sophos was able to make an educated guess about the purpose of the ruse.

Fraser Howard, a principal virus researcher at Sophos, concludes: "The scam appears to be hiding behind several other eBay sellers to piggyback on their reputations. The main listing itself (on the eBay site) is using a seller normally associated with online jewellery sales, a power seller. When you click through the the details page, and get redirected to the .aspx page on the .ru site, the seller is different again."

Sophos plans to add detection for the dodgy Shockwave file as the ReDir-A Trojan with its next update.

[fieldmarshaldj]

Back after I first registered in ‘99, I opted to get this nice-looking handmade piano stool (shipping from about 100 miles away). It was about $120 (not including shipping, which was about $20-$25). Got it, pulled it out of its packaging (it was well packed), but it was obviously crapola. The legs were loose, the ball underneath the legs was smashed. Contacted the seller, he told me to ship it back and he’d replace it. Several weeks later, get another one, same condition, total crap. I demanded a refund and said he could have it shipped back to him (in pieces) at his expense. He sent the refund but never contacted me again about having it shipped back. He tried selling the stools again and I personally emailed the bidders to tell them they were total crap. He soon vanished from eBay.

[Stoat]

The bauble sounds like a version of the VPN Token we use here at DHS. The number on the token is randomly generated and that in combination with a PIN is your password for logging in.

That's very interesting, thank you.  If Homeland Security is using it, then perhaps it's not quite such a haphazard, slapdash fix that I had assumed it was and is in fact an accepted industry-standard security component.  I'm somewhat familiar with things like dongles which can be used for adding one or more layers of security, but I hadn't used this sort of thing before which doesn't plug into the user's computer and uses the preexisting online entry interface.  Perhaps I should get one after all.

[Stoat]

Thanks very much for pinging your list :-)