Newsletters
Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home CRM Systems Customer Service Contact Centers Business Intelligence More Topics...
Advertisement
Free Gartner Report:
Drive innovation & collaboration
with the "Everyone's IT" approach.

View the research report
.
Customer Data
Gartner's #1 for endpoint backup
Average Rating:
Rate this article:  
Researcher Discovers Second eBay Vulnerability

Researcher Discovers Second eBay Vulnerability
By Jennifer LeClaire

Share
Share on Facebook Share on Twitter Share on Linkedin Share on Google Plus

With the FTC's emphasis on establishing a responsible standard of care for information security, we will see more of these investigations like the one into the eBay data breach. The kind of scrutiny being put on eBay in the wake of its data breach will help move enterprises away from silver bullet security solutions, toward defense-in-depth security.
 


No, the drama around the eBay breach is not over. Beyond probes by government agencies, a security researcher now says a second flaw could be used to hijack member accounts at the online auction platform.

According to Jordan Lee Jones, a college student in the United Kingdom, there’s a second vulnerability that remains open to hackers. Jones said he notified eBay via e-mail on Friday and got no response. He has published what he calls the “eBay cross-site scripting code” on his blog.

Here’s the backstory: Last Tuesday, eBay asked users to change their passwords in the wake of a cyberattack that compromised one of its databases. Unfortunately, it was a database that included eBay customers' names, encrypted passwords, e-mail addresses, physical addresses, phone numbers and dates of birth.

The PayPal Connection

We caught up with Dwayne Melancon, chief technology officer for Tripwire, to get his take on the unraveling eBay data breach story. He told us it appears the hack involved securely encrypted passwords, which makes it more difficult to gain access to users' eBay accounts en masse because it would require brute force decryption of passwords. But then he continued with a “however.”

“However, the fact that user e-mail addresses, physical addresses, and dates of birth were taken in the breach is more concerning,” Melancon said. “Criminals could use that information to masquerade as eBay customers on other sites, or perhaps use that information to 'social engineer' their way into users' other accounts on other services. Unlike the passwords, the other user-specific information was not encrypted and therefore easily reused by attackers.”

What does Melancon suggest? For starters, eBay users should be required -- not simply asked -- to reset their passwords. What’s more, password complexity rules should be in place to ensure users select complex passwords, he said. He also charged individual users with making sure they are not using the same passwords on various sites.

The PayPal Connection

eBay was careful to stress that PayPal was not involved in the breach. Nevertheless, Melancon noted that many eBay users also have their accounts connected to PayPal -- which eBay owns -- for payments. For that reason he’s also recommending that customers tap into PayPal’s two-factor authentication feature, which verifies your identity before you make a payment. In fact, he said it’s a best practice even without the eBay breach.

“eBay users have long been a popular target for phishing e-mails, and users must be especially wary during incidents like this,” Melancon said. “To be safe, users should not click on links in e-mails about eBay security or password changes. Instead, they should type the eBay URL directly into their browsers and log into the site that way to prevent disclosing their credentials to spoofed, malicious copies of the eBay site.”

With the Federal Trade Commission's increased emphasis on establishing a responsible standard of care for information security, Melancon believes we will see more of these investigations. He said this kind of scrutiny will help move enterprises away from so-called silver bullet security solutions, and toward defense-in-depth security.

“A well-designed security program hinges on foundational security controls that ensure that organizations know what is on their network, understand the risks and vulnerabilities in place, are able to enforce strong security configuration policies, and are able to continuously monitor the state of their systems, applications, and data to quickly identify suspicious changes or events," Melancon concluded.
 

Tell Us What You Think
Comment:

Name:

Lee:

Posted: 2014-05-29 @ 5:23pm PT
I simply find it hard to believe that if eBay owns PayPal that the company is telling the public the Truth when both ACCTS. Are connected.I say cancel your ACCTS. W/both eBay & PayPal til the they can prove your secure before disclosure of your info

Maria:

Posted: 2014-05-28 @ 9:40am PT
What is also problematic is that there are technical difficulties preventing the ebay password reset. I have tried multiple times and cannot get past the first screen to reset.



Get Powerful App Acceleration with Cisco. In a world where time is money, you need to accelerate the speed at which data moves through your data center. Cisco UCS Invicta delivers powerful, easy-to-manage application acceleration for data-intensive workloads. So you can make decisions faster and outpace the competition. Learn More.


 Customer Data
1.   Target Data Breach Cost: $148 Million
2.   Supervalu Suffers a Data Breach
3.   Experian Debuts Anti-Fraud Platform
4.   Facebook's Security Chief Questioned
5.   Black Hat: Security Threats Aplenty


advertisement
Target Data Breach Cost: $148 Million
Better customer data protection needed.
Average Rating:
Facebook's Security Chief Questioned
Spotlight shines on security strategy.
Average Rating:
Supervalu Suffers a Data Breach
Joins growing list of retailer victims.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
UPS Stores in 24 States Hit by Data Breach
Big Brown has been breached. UPS said that about 105,000 customer transactions at 51 of its UPS Store locations in 24 states could have been compromised between January and August.
 
Cost of Target Data Breach: $148 Million Plus Loss of Trust
The now infamous Target data breach is still costing the company -- and its shareholders -- plenty. In fact, the retailing giant forecast the December 2013 incident cost shareholders $148 million.
 
Aruba Networks Handles Black Hat with Aplomb
It's not an easy job. Aruba Networks' task throughout the Black Hat USA conference in Las Vegas this month was to ensure thousands of attendees could connect without malicious attacks.
 

Enterprise Hardware Spotlight
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 
Three New Lenovo PCs Aimed at Business Users
Businesses everywhere want computing solutions that do more for less money, and Lenovo has unveiled three new desktop PCs that offer solid computing at a budget-minded price.
 
Aruba Networks Handles Black Hat with Aplomb
It's not an easy job. Aruba Networks' task throughout the Black Hat USA conference in Las Vegas this month was to ensure thousands of attendees could connect without malicious attacks.
 

Mobile Technology Spotlight
Google Glass Adds Voice Access to Phone Contacts
The latest update to Google Glass will let users access their top 20 phone contacts with voice commands alone. A user can then choose a phone call, Google hangouts, e-mail or text messaging.
 
Samsung, B&N Target Amazon with Nook Tablet
They've seen the enemy and it is Amazon. So Samsung and Barnes & Noble are teaming up to combat their common foe with a 7-inch tablet that blends Samsung’s tech, Nook’s content and e-reader platform.
 
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Contact Centers | Business Intelligence | Sales & Marketing | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.