Feeds

Vuln exposes eBay developer accounts

Password changes ordered

The essential guide to IT transformation

eBay security officials are requiring members of its developer program to change their passwords following the discovery of a vulnerability that could allow attackers to intercept sensitive account details.

"eBay has recently identified a means by which someone could gain access to eBay Developers Program account information," Kumar Kandaswamy, manager of the eBay Developers Program, wrote in an advisory posted on the auctioneer's website. "Out of an abundance of caution and to help ensure the security of the eBay Developers Program, we are requiring that all developers" change their passwords.

The vulnerability doesn't allow attackers to capture financial data such as credit card numbers and so far there are no known exploits targeting it. Kandaswamy didn't elaborate on on the weakness.

Over a several-month span in 2007, a hacker who called himself Vladuz was able to penetrate some eBay defenses and gain unauthorized access to parts of its network reserved for employees. The online miscreant, who was fond of bragging about his exploits on eBay chat boards, was later arrested in Romania, where he is believed to have resided.

eBay's developer program helps developers use its API to write applications for the site. The site recently imposed stricter standards on members when creating passwords. Just last week, security guru Bruce Schneier issued this refresher on the secure creation of passwords. ®

Next gen security for virtualised datacentres

More from The Register

next story
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.