eBay redirection ruse reloaded
Print story18 month-old security flaw still remains unfixed
Posted in Security, 13th November 2006 16:38 GMT
Free whitepaper – Securing your Microsoft Internet Information Services (MS IIS) web server
A redirection script error on eBay's site remains open to abuse 18 months after The Register first reported it.
The flaw - actively exploited in phishing scams since February 2005 - creates a means to make fraudulent emails look more convincing.
Shortly after publishing a report on the problem, eBay assured us that it had plugged the hole. Despite this the site remains open to abuse through the same back door, as an email from Reg reader Adrien this week reminds us.
He notes that URLs such as this example are being bounced off eBay site onto other domains. In this case the surfer is redirected to Google, but sending people to less savory destinations is equally possible.
"I'm holding out for the second anniversary of the backdoor. I might bake a birthday cake and send it to them. A nice phish cake," Adrian said.
We are yet to hear back from the online auction house on whether it has any plans to address the problem. ®
Free whitepaper – Securing your Microsoft Internet Information Services (MS IIS) web server
Airport insecurity: the case of lost laptops
Jump start your Application Security initiatives
Reducing messaging and web security costs with managed services
Avoiding 7 common mistakes of IT security compliance
Extended Validation SSL Certificates
Feds: Hospital hacker's 'massive' DDoS averted
Buggy 'smart meters' open door to power-grid botnet
Microsoft knew of nasty IE bug a year before attacks
BlockMaster SafeStick hardware-encrypted USB drive