'Fraudster' posts confidential eBay member data on forum
691595
(InfoWorld) - Someone used an eBay discussion forum on Tuesday to post confidential information about eBay users along with what may be their credit card numbers. The incident, first reported by AuctionBytes.com, a technology news site that focuses on e-commerce, led the e-commerce giant to shut down the forum, which ironically is devoted to the discussion of security issues. Nichola Sharpe, an eBay spokeswoman, confirmed that on Tuesday morning someone the vendor describes as "a malicious fraudster" posted the names and contact information of 1,200 eBay members on the company's Trust & Safety discussion forum. "This information could have been obtained as part of an account takeover. Since this time, our Trust and Safety team has been proactively addressing this situation," she said. Along with members' information, the "fraudster" also posted what appear to be credit card numbers. However, if that's what they are, they don't match the ones eBay has on file for the members whose contact information was disclosed, Sharpe said. "We are in the process of proactively contacting members by phone, so that if the information is valid somehow -- regardless how this fraudster acquired the information -- these members can take the steps they need to take to protect themselves," Sharpe said. The "fraudster" didn't obtain the information by breaching eBay's security systems, so eBay thinks the culprit stole the information via methods like phishing, she said. The company has posted more information in an official blog post. The incident, which eBay continues to monitor, has been broadly reported and commented on by eBay users on this long thread. In its article, AuctionBytes reported being able to access the forum and view several posts before they were removed. The posts included fields labeled "Id verified" and "Store" along with a time-date stamp of the user registration, AuctionBytes reported, adding that it hasn't been able to verify the accuracy of the information viewed.
420172
A bargain at $69 From the files of IT bloopers comes this cautionary tale: a California man stumbled upon a stash of confidential data belonging to the Arkansas Democratic Party after its computer consultant accidentally sold a hard drive containing the material on eBay.â¦
490721
A PC drive offered for sale as new on eBay turned out to have come from the laptop of an Arkansas Democratic Party official -- and it still contained sensitive information when the buyer received it.
468877
EBay has expressed &quot;outrage&quot; over the arrest of the chief executive of its India operations because a user of its shopping and auction portal, Baazee.
160555
Information on individuals has been collected in a scam using e-greetings that appear to come from a secret admirer.
204748
eBay battles several days' worth of PayPal glitches.
380521
Hardly an hour goes by without Thomas Serafin or one of his cyber-sleuths checking what eBay has to offer.
146885
(InfoWorld) - Usernames and passwords for more than 100 e-mail accounts at embassies and governments worldwide have been posted online. Using the information, anyone can access the accounts that have been compromised. Computer Sweden Â has verified the posted information and spoken to the person who posted them. The posted information includes names of the embassies and governments, addresses to e-mail servers, usernames and passwords. Among the organizations on the list are the foreign ministry of Iran, the Kazakh and Indian embassies in the U.S. and the Russian embassy in Sweden. Freelance security consultant Dan Egerstad posted the information. He spoke openly about the leak when Computer Sweden contacted him. "I did an experiment and came across the information by accident," he said. Egerstad says he never used the information to log in to any of the compromised accounts in order not to break any laws. Computer Sweden confirmed that the login details for at least one of the accounts is correct. Egerstad forwarded an e-mail sent on Aug. 20 by an employee at the Swedish royal court to the Russian embassy. The person who sent the e-mail, in which she declines an invitation to the Russian embassy, has confirmed that she sent the e-mail. "Yes, that is right. We did decline the invitation. As far as I can remember I did send the e-mail," she said. Computer Sweden has not been able to confirm the authenticity of any of the other information that has been posted. "When something like this happens you usually contact people and ask them to fix it. But in this case it felt too big for that, calling to other countries," Egerstad said. Of the compromised accounts, 10 belong to the Kazakh embassy in Russia./p> Around 40 belong to Uzbeki embassies and consulates around the world. Login details for e-mail accounts at the U.K. visa office in Nepal were also posted. Login details for the foreign ministry of Iran, the Kazakh and Indian embassies in the U.S. and the Russian embassy in Sweden were also posted. "I hope this makes them take action. Hopefully, faster than ever before, and I hope they become a bit more aware of security issues," Dan Egerstad says. Computer Sweden has contacted both the Russian and Indian embassies in Stockholm for comment. The Russian embassy confirmed the leaks and says that logins have now been changed. The Indian embassy declined to confirm the information and give comment. Computer Sweden has not published where the login details can be found. The information in this story has been verified by Computer Sweden without using any of the published login details. Computer Sweden is an InfoWorld affiliate.
104789
Auction site 'humiliated' and 'harassed' The row continues between eBay and Harry Potter author J.K. Rowling.â¦
620214
On Paul Jones' weblog today, there's a posting covering one of the banes of PHP life - form processing/handling.
222984
Q: I have been receiving an increasing number of e-mail requests to participate in financial schemes that are clearly bogus and illegal.
238483
For some, replying to Internet scams is a rewarding hobby. They call themselves scam-baiters, and they have started taking justice into their own hands.
679593
(InfoWorld) - Questions abound overÂ the posting of confidential information from eBay members on one of the vendor's discussion forums, a sinister incident that has many of the online marketplace's buyers and sellers worried. Although eBay has provided some information about the brazen dump of member data that happened Tuesday morning, it's not known who the culprit is nor how and when this person obtained the information. Even more troubling: What has this "malicious fraudster," as eBay describes the person, already done with the names, addresses, member IDs, and possibly credit card numbers of at least 1,200 eBay buyers and sellers? Moreover, is this person still exploiting whatever hole, trick, or vulnerability led him to the data? Does he have data on just the 1,200 members listed or possibly on many more? "What makes this a big deal isn't just the amount of data compromised, but rather that this involves eBay," said computer security expert Mark Rasch, managing director of technology at FTI Consulting. As the world's largest online marketplace, eBay stores financial data on millions of users, and its platform is used to transact billions of dollars in sales. "Irrespective of the scope [of the data breach], the target makes it significant," Rasch said. This much is known: On Tuesday morning, someone posted confidential information on about 1,200 eBay members in the company's Trust & Safety discussion forum. Based on the initial reports of frantic users on this long thread, it appears that the "fraudster" posted data for about one hour until eBay shut the forum down. Hours later on Tuesday, an eBay spokeswoman confirmed the incident and said the vendor knew for a fact that the information wasn't obtained by breaching eBay's security systems, suggesting instead that the culprit stole the information from others via methods, such as phishing. However, many users have expressed skepticism in the forums over eBay's prompt declaration that its systems weren't hacked into. Rasch shares this skepticism. "I'd be reluctant to declare six hours after [such an incident] that my systems weren't breached unless I definitely knew what had happened or had already caught someone," he said. There can be many ways for someone to obtain this confidential data, including hacking a system and tricking individuals into disclosing the information via phishing, he said. It could also be a case of an inside job perpetrated by a disgruntled or corrupt employee at eBay or elsewhere with access to a database containing this data. "eBay has to thoroughly and comprehensively investigate this and keep people advised of what it finds and take corrective actions," Rasch said. This doesn't mean that eBay must provide hourly updates on the progress of its investigation, he said. However, eBay must at some point publicly close the loop on the incident and explain the scope of the damage and the causes. It's unclear if eBay intends to reveal more details about the breach. Beyond the spokeswoman's comments on Tuesday, the only other eBay statement on the matter is an official blog post made a few hours after the incident. By press time, eBay hadn't responded to several requests for comment on Wednesday. Jonathan Garriss, executive director of the Professional eBay Sellers Alliance, agrees that eBay must inform users about the issue. "eBay really needs to address this publicly at some point and say where the leak came from," said Garriss, also CEO of Gotham City Online, an apparel store on eBay that also has its own site. That way, buyers and sellers will feel that the issue was addressed and remedied. It's clear that the data thief, in addition to profiting from the compromised information, also wanted very much to embarrass eBay by using the vendor's discussion forum for security issues as the vehicle for the data disclosure. "It was very brazen and very public," Rasch said. On Tuesday, the eBay spokeswoman said that the credit card numbers disclosed didn't match with the ones eBay has on file for the affected members. This brings up another question: Even if the numbers don't match the members, does eBay know if those numbers are nonetheless valid? Once data is posted on a public Web site, it must be assumed that others with malicious intentions copied it. "The bottom line is that this data is in the hands of people who shouldn't have it," Rasch said.
465593
A sophisticated multistage attack by identity thieves appears to have significantly compromised eBay and perhaps PayPal as well.
339599
A data dump by an individual eBay describes as a "malicious fraudster" exposed names and contact information for 1,200 users of the auction site online. The information led to the closure of the discussion group in which the information was released -- a discussion group devoted to, ironically, security issues.
187938
Beware of any e-mail claiming to come from "frauddep@ftc.gov"--it carries a nasty payload.
425620
Updated: The company says someone &quot;has recently misappropriated and disseminated through Web sites confidential information about an unreleased Apple product.