Feeds

eBay scripting trick used to boost seller ratings

Shockwave redirection ploy in mystery auction attack

Beginner's guide to SSL certificates

Hackers have been caught using a malicious scripting scam in an apparent attempt to boost their rating on eBay.

An auction for a 4WD car on eBay.co.uk featuring the ruse was brought to our attention by Reg reader John early on Monday. eBay pulled the auction on Monday afternoon but The Reg has this screenshot.

eBay car auction trigers dodgy redirection

The auction for a 2007 Range Rover Sport HSE offered a car valued at £40K for £12K. Clicking on the auction generated a suspicious pop-up, served up from Russia. Having established something was amiss we called up security experts at Sophos to analyse the attack, which we initially took to be a scripting variant of the Bayrob Trojan scam.

Not so.

Sophos established that surfers who click on the dodgy listing see a regular item page along with an embedded tag pointing to a Shockwave file. This Shockwave file redirects the user to an .aspx page in Russia. At the root of the page are two other similar .aspx pages - linking to other (already completed) vehicle auctions. ASPX is an html file format used to create Webforms.

The approach may have been used to harvest email addresses, or more likely as a way for dodgy sellers to give themselves a better reputation. Following the removal of the auction it's hard to be certain, but Sophos was able to make an educated guess about the purpose of the ruse.

Fraser Howard, a principal virus researcher at Sophos, concludes: "The scam appears to be hiding behind several other eBay sellers to piggyback on their reputations. The main listing itself (on the eBay site) is using a seller normally associated with online jewellery sales, a power seller. When you click through the the details page, and get redirected to the .aspx page on the .ru site, the seller is different again."

Sophos plans to add detection for the dodgy Shockwave file as the ReDir-A Trojan with its next update. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.