Samker's Computer Forum - SCforum.info
World TOP Headlines: => Latest Security News & Alerts => Topic started by: Samker on 26. October 2007., 00:45:23
-
The auction site has been the target of a hacker called Vladuz, whose actions are causing concern to the website's users and owners alike. Danny Bradbury reports
Who is Vladuz? Since at least the start of this year, eBay has been looking for this hacker from eastern Europe. According to evidence seen by the Guardian, he is able to see the listings of and listen to telephone conference calls within eBay. Sources in the hacking community say that he claims to be listening in on some meetings held by eBay chief executive Meg Whitman.
Says eBay: "This fraudster is known to eBay, Romanian authorities and the US Secret Service who are all working towards securing an arrest and successful prosecution."
Concerned to reassure users, it adds: "The central eBay site is and always has been secure." The company says, however, that the "phone system is 'open' because we conduct calls with external parties who need access to it. Confidential calls made through our system require separate security information."
Despite the reassurances, this is not the first time Vladuz has embarrassed eBay. And he is extremely good at covering his tracks. "He covers himself very well with Gmail, and uses anonymous proxies [remote computers] to access those accounts too," says David Steiner, editor of online auction news publisher Auctionbytes.
Hacker's background
What is known from the hacking community is that the individual is in his mid to late 20s and has a strong background in programming. He operates from Romania, where he was born, and has years of experience working in a corporate environment.
He also has a history of both operating and facilitating eBay-based scams. As early as 2004, someone calling themselves Vladuz was selling a set of PHP files designed to create phishing sites that would collect eBay data. "It is a very basic SDK [software development kit], allowing script kiddies to set up a phishing email scam," says Simon Heron, director of UK security company Network Box. "It sets up a website that uses as much as it can from the genuine eBay site to give it the right look and feel. The logon and password are sent to the scammer." In the readme file that he used to distribute the kit was the message: "Well go there and scam the fucking bastards! For ANY scam email me and I'll do it in max 30 hours."
While he has been in operation for several years, the spotlight has only recently fallen on Vladuz. He first came to notice in December, when Rosalinda Baldwin from The Auction Guild, an independent publisher that monitors eBay's activities (auctionguild.com), began seeing large numbers of fake auctions emerging from Chinese scammers using accounts hijacked from their real owners. "Researching that, I came across the name Vladuz in association with someone writing programs that Chinese hackers were using and building on to do these hijacks," she alleges.
At the start of the year, he turned up again, this time posting several times on eBay's forums. His posts were coloured pink, indicating that he was posting as an eBay employee. The company said that the pink postings were due to a handful of compromised eBay accounts.
"The funny thing was that he emailed through eBay, and when he was doing that he emailed me eBay employee passwords and user names," says Josh Shaffer, who founded the site FireMeg.com, which attacks the auction site's management.
In February, he attempted to highlight perceived flaws in eBay's security systems by publishing a plugin for the Firefox browser designed automatically to solve eBay's "Captchas". A Captcha is a security challenge displaying distorted text which users must type in to prove that they are real people. They work because the text is supposed to be too difficult for computers to read. Heron confirms that the plugin code (linked to a site registered with a stolen credit card) was clean; it only did what it said, without tricking the user. But others suggest that there was a payload: it directed users to a site with a Romanian domain hosted by Yahoo! (now taken down), which reportedly required users to enter some credentials. That could be a phishing route.
The most spectacular hack for which he has claimed responsibility involved the posting of at least 1,200 eBay users' personal information on an eBay discussion board late last month. The postings stayed up for over an hour, in spite of complaints from users, before the whole board was taken down. The company insists that the credit card details posted did not belong to users.
What drives Vladuz? "He told me in one email, 'I'm not a good Samaritan. I'm in it for the money'," says Baldwin. "It sounds like he's selling the tools as well as using them." But other incidents on eBay point to different motives. Days after the credit card hack, the "About me" page for eBay lawyer Scott Noyce was altered and his personal details were posted on the page. At the bottom was the signature "SGI Inc - V". SGI stands for Solutions for Generating Income, and is the name that Vladuz gave to the team of people that helped him to run his scams earlier in his career.
He used a thread on the auction watching site Pheebay.com to boast of the Noyce incident and also to claim responsibility for the credit card hack. On that thread, he pointed to a February report about Noyce contacting German scam monitoring site Falle-Internet.de. The letter threatened them with legal action unless they took down some eBay-related pages. "Revenge time," said Vladuz.
"I demand an explanation," posted one eBay user on an eBay forum a week later, when his account was mysteriously shut down and reinstated. Another replied that the same had happened to him, accompanied by an email that read: "Stop saying shit stuff about me, asshole. vladuz." eBay posted a response saying that the hacker had found some old administrative functions that had not been turned off after a security change. "We are undergoing an audit to ensure obsolete code that may still exist for other reasons is secure," it said.
Security fears
"If there's an administrative portal that was visible on an external server, how many other scammers have been using that?" asked Ed 'Doc' Koon, who runs the eBay monitoring site ebaymotorssucks.com. In the past few months, eBay has downplayed Vladuz's significance, but Koon is one of a number of eBay watchers who believes that the company's security is far from watertight.
eBay makes the rules of engagement clear for customers, describing the dangers of phishing emails that lure users to enter their details into fake eBay sites. But what about the redirect scams? "You have people actually embedding in auction pages redirects to fake sign-in pages," says Pheebay. Clicking on a valid eBay page would thus take you straight to a phishing site. "I probably get a couple of emails a week from people that fall for these redirect scams," says Koon. Redirect scams have been seen on eBay for more than a year. "I had one last week from a guy who sent $7,200 for a 57 Chevy convertible," Koon says. "Hello? Your money's gone."
Others worry about "second chance" scams, in which fraudsters contact auction losers pretending to be from eBay, offering them the chance to bid on an item again. The link takes them to another site where their information is stolen. "How are these scammers getting these peoples' direct email addresses?" asks Koon.
Rodger Flemming, who helps run Falle-Internet, speculates that scammers may have access to the eBay database. Screenshots of tools) purported to have been created to manipulate eBay's systems have been posted on eBay watchers' sites, but it is difficult to prove their authenticity. eBay maintains that the website has not been hacked, but such denials are always tainted with the obvious question: how can you be sure? When presented with news of the recent phone system hack, which targets internal corporate systems rather than the website, eBay admitted that it had no knowledge of it.
Intimate knowledge of systems
That hack, revealed to the Guardian by a source close to Vladuz, demonstrates an intimate knowledge of systems central to eBay's day-to-day business operations. It has given the hacker access to a broad range of information. And nobody knows for how long Vladuz may have been eavesdropping.
While the community mulls these issues, some have said that Vladuz could be more than one person. Another theory, perhaps both more likely and more frightening, is that there are more like him. "There are thousands of hackers. It doesn't make much sense that he'd be the only one out there," says AuctionBytes' Steiner. "It makes no sense to me that if these things are as wide open as he says, he would be the only one."
And there's the worry. For every loose-tongued, forum-happy blackhat, there could be many silent, disciplined ones. This latest revelation will do little to reassure users. Millions of dollars each day are transacted via eBay. The company made a net income of $1.1bn (£543m) last year on almost $6bn of revenues, and people depend on it for their livelihoods and it is a linchpin of the online economy. But just how safe is eBay from the dark side of the web?
(Copyright by Guardian Unlimited)
http://www.guardian.co.uk/technology/2007/oct/25/ebay.hacking