Questions remain about eBay members' info theft
679593
(InfoWorld) - Questions abound overÂ the posting of confidential information from eBay members on one of the vendor's discussion forums, a sinister incident that has many of the online marketplace's buyers and sellers worried. Although eBay has provided some information about the brazen dump of member data that happened Tuesday morning, it's not known who the culprit is nor how and when this person obtained the information. Even more troubling: What has this "malicious fraudster," as eBay describes the person, already done with the names, addresses, member IDs, and possibly credit card numbers of at least 1,200 eBay buyers and sellers? Moreover, is this person still exploiting whatever hole, trick, or vulnerability led him to the data? Does he have data on just the 1,200 members listed or possibly on many more? "What makes this a big deal isn't just the amount of data compromised, but rather that this involves eBay," said computer security expert Mark Rasch, managing director of technology at FTI Consulting. As the world's largest online marketplace, eBay stores financial data on millions of users, and its platform is used to transact billions of dollars in sales. "Irrespective of the scope [of the data breach], the target makes it significant," Rasch said. This much is known: On Tuesday morning, someone posted confidential information on about 1,200 eBay members in the company's Trust & Safety discussion forum. Based on the initial reports of frantic users on this long thread, it appears that the "fraudster" posted data for about one hour until eBay shut the forum down. Hours later on Tuesday, an eBay spokeswoman confirmed the incident and said the vendor knew for a fact that the information wasn't obtained by breaching eBay's security systems, suggesting instead that the culprit stole the information from others via methods, such as phishing. However, many users have expressed skepticism in the forums over eBay's prompt declaration that its systems weren't hacked into. Rasch shares this skepticism. "I'd be reluctant to declare six hours after [such an incident] that my systems weren't breached unless I definitely knew what had happened or had already caught someone," he said. There can be many ways for someone to obtain this confidential data, including hacking a system and tricking individuals into disclosing the information via phishing, he said. It could also be a case of an inside job perpetrated by a disgruntled or corrupt employee at eBay or elsewhere with access to a database containing this data. "eBay has to thoroughly and comprehensively investigate this and keep people advised of what it finds and take corrective actions," Rasch said. This doesn't mean that eBay must provide hourly updates on the progress of its investigation, he said. However, eBay must at some point publicly close the loop on the incident and explain the scope of the damage and the causes. It's unclear if eBay intends to reveal more details about the breach. Beyond the spokeswoman's comments on Tuesday, the only other eBay statement on the matter is an official blog post made a few hours after the incident. By press time, eBay hadn't responded to several requests for comment on Wednesday. Jonathan Garriss, executive director of the Professional eBay Sellers Alliance, agrees that eBay must inform users about the issue. "eBay really needs to address this publicly at some point and say where the leak came from," said Garriss, also CEO of Gotham City Online, an apparel store on eBay that also has its own site. That way, buyers and sellers will feel that the issue was addressed and remedied. It's clear that the data thief, in addition to profiting from the compromised information, also wanted very much to embarrass eBay by using the vendor's discussion forum for security issues as the vehicle for the data disclosure. "It was very brazen and very public," Rasch said. On Tuesday, the eBay spokeswoman said that the credit card numbers disclosed didn't match with the ones eBay has on file for the affected members. This brings up another question: Even if the numbers don't match the members, does eBay know if those numbers are nonetheless valid? Once data is posted on a public Web site, it must be assumed that others with malicious intentions copied it. "The bottom line is that this data is in the hands of people who shouldn't have it," Rasch said.
389780
Someone used an eBay discussion forum on Tuesday to post confidential information about eBay users along with what may be their credit card numbers.
73282
PayPal, the online payment service owned by auction firm eBay, has been suffering intermittent glitches since Friday. Some users have been locked out of their accounts for long periods, and
11163
(InfoWorld) - Hard drives full of confidential data are still turning up on the second-hand market, researchers have reported. Investigations carried out on behalf of BT by the University of Glamorgan in the U.K., Edith Cowan University in Australia, and Longwood University in the U.S., found that 37 percent of drives surveyed had traces of personal data on them. Damningly, this figure is much the same as it was for the same surveys undertaken by the universities in each of the last two years, suggesting that either companies are ignoring the issue or simply lack the tools to adequately wipe data before resale. Sensitive information retrieved included salary details, financial data of specific companies, credit card numbers, medical data, visa applications, details of online purchases, and inevitably, online pornography. The sample totalled 350 hard drives acquired in online auctions. "Given the level of exposure that the subjects of security and identity theft has received in recent times, and the availability of suitable tools to ensure the safe disposal of information, it is difficult to understand why disks are still not being effectively cleaned before they are disposed off," said BT's security research head, Dr Andy Jones. "When organizations dispose off surplus and obsolete computers and hard disks, they must ensure that adequate procedures are in place to destroy any data and also to check that the procedures that are in place are effective -- whether they are handled by internal resources or through a third party contractor," he said. The full report -- which has yet to be made publically available -- reveals that buying second-hand disks is an unreliable way to get hold of storage. Of the 133 disks bought in the U.K., 44 percent of them didn't even work. But of those that did, 19 percent had enough information on them to identify the organization from which they had come, 65 percent had enough data to identify named people, and 17 percent contained "illicit" data. Techworld is an InfoWorld affiliate.
232492
InfoWorld - Online auction giant eBay has been slow to respond to concerns about pirated software being sold there, prompting the Software & Information Industry Association (SIIA)Â to file nine lawsuits against eBay-based software sellers, an SIIA official said.
549821
Someone used an eBay Inc. discussion forum on Tuesday to post confidential information about eBay users along with what may be their credit card numbers.
613039
It's still not known who the culprit is nor how and when this person obtained the information.
542154
The Net giants incur the wrath of Privacy International, and eBay draws the attention of the U.K.'s Information Commissioner.
633805
First, thanks for the great comments on yesterday's post about Apple and the hard disk of my MacBook. People were universally positive and helpful, and I can say I really learned some really important things as a result of the discussion. First, the cost of the data on the hard disk swamps the value of the value of the disk and even the value of the computer. There was source code on the computer, and other information, which if it fell into the wrong hands, could cause some serious problems for me. I have no agreement with Apple that covers the security or privacy of the data. As far as I know they think they own the contents of the disk as well as the disk itself. The experience I had with them actually makes me think they probably do feel its theirs. This from a company that takes the security of its own private information very seriously, they seem to have almost no regard for the security of its customers' information. You have no control over when a hard disk will crash, or any foreknowledge of when it's even likely to crash. So there's no way to protect against this kind of security issue. And that's what it is. What kind of sense does it make to invest in firewalls, and of what value is Apple's claim that Macs are inherently more secure, when all the data on one of my computers is now completely out of my control forever? I'm not so concerned about the privacy issues, but I could imagine that other people might be. And if identity thieves are not aware of this backdoor way to get access to private information, how long before they are? Security experts always warn us that obscurity is not a good strategy for security. So what to do?  Basically I've given up on trying to get Apple to do the right thing and give me my disk back. Some people at the Emeryville store are well-itentioned, and are just naive about the problems that can come when you trust people with all your data. Others just don't care. Either way it seems unlikely that I'm going to get it back, and even if I do, it's been out of my control for too long.  I'm going to go through the tedious job of changing the passwords on all my sensitive online accounts. That was overdue anyway. And next time a laptop blows its hard disk, I'm either going to replace it myself and shred the old disk, the same way I'd shred any sensitive documents before throwing them out, or just throw away the whole computer. I know this isn't green, but there seems to be no other course that's anything close to secure. And always be aware that you could lose a laptop, or it could be stolen. So far it seems that this is not yet an identity theft concern, but you can't be sure, and it won't be long before it is.  Thanks again for all the good info, advice and vibe.
191745
Internet still a den of thieves For the seventh year in a row, identity theft is the number one complaint reported to the US Federal Trade Commission.â¦
56558
Two eBay laptop sellers--one of whom ended up without either his laptop or the buyer's money for it--share their experiences.
684289
EBay&#39;s online payment service PayPal has suffered intermittent glitches since late last week, locking some users out of their accounts for long stretches and making
380529
Things just aren&#39;t going well for Timothy Scott Short. Just days after a pair of tech support calls he made to printer manufacturer Digimarc&#160;resulted in his arrest, he now finds himself on the receiving end of a data breach with his Social Security number and birthdate accidentally made public via the federal court&#39;s Electronic Case Files (ECF) system.It&#39;s an ironic development, because Short, 33, was arrested in connection with the Oct. 5 theft of a Missouri Department of Revenue printer and a PC containing data on as many as 500 state residents.Short&#39;s personal information was discovered by the IDG News Service, listed on a court document called a Criminal Case Cover Sheet, which was publicly available to users of the ECF system. Normally, this document should only be accessible to those involved in the case, but it appears to have been inadvertently made public, according to a clerk with the U.S. District Court for the Eastern District of Missouri, who asked not to be identified because she was not authorized to speak with the press. &quot;It&#39;s something on our side,&quot; she said, adding that technical staff is now looking into the problem.The U.S. Judicial Conference, which sets policy for U.S. courts, has said that this kind of information should be removed from publicly available electronic court records, but actually removing all the sensitive information has proved difficult.&quot;If you went online to various court systems, you could find social security numbers of many individuals,&quot; said Paul Stephens, director of policy and advocacy with the Privacy Rights Clearinghouse. &quot;It&#39;s a really, really difficult question to answer, just because you&#39;re dealing with so many jurisdictions.&quot;Social Security numbers are the building blocks of identity theft crime because they can be used to secure credit cards. &quot;Any time you are placing Social Security numbers online, your are subjecting that person to identity theft,&quot; Stephens said.With the push to make public documents available online, other government databases have had similar problems. Earlier this year, the states of California and Colorado were forced to take their Uniform Commercial Code (UCC) databases offline after privacy advocates pointed out that the Social Security numbers and other data they contained could be misused by identity thieves.Short, however, may have bigger problems to worry about. He&#39;s facing $250,000 in fines and 10 years in prison on charges of possession of &quot;document-making implements&quot; in connection with the theft. He was arrested after U.S. Secret Service Special Agent John Bush recognized his voice in calls placed to a tech support line of the company that makes the stolen printer.&#160;
336282
PayPal Outage Effects Online Retailing and eBay  eBay Inc.'s online payment system PayPal said on Tuesday that account data and personal information were not compromised by a glitch in the new system update that has resulted in some users not being able to log into their accounts and also PayPal not ...
300862
Reposted in the queue as it's impossible or at least very complicated to move it as I asked (although the post where aphrael said such thing disappeared so perhaps this is not the case after all - another minor K5 mystery).  The original discussion can be found here (read it as there are some clarifications by rusty). All right, here is the (adapted) diary. Rusty posted a comment in the diary entitled "Would you pay 10USD for K5 Life Membership?" saying that K5 will become a pay site once new user registrations will be reactivated: "I was thinking $5.00 (none / 0) (#18) by rusty on Thu Sep 06, 2007 at 04:42:15 PM CET But it would actually be charged. That plus a hash of the identifying CC info so you only get one account ever, and I think we'd either shrivel up to nothing and die, or solve the spamming and crapflooding issues. Funny that someone else is thinking about this right now. It'll probably happen before I turn new signups back on." This of course begs the question: HIBT? If so I'll bite (see some considerations under the fold).
310505
A Swiss company has launched an eBay for details on unpatched security vulnerabilities.
196659
Online auction giant eBay has been implicated in piracy lawsuits. The Software & Information Industry Association is suing several eBay sellers as part of its campaign to stop auctioning of pirated software.