Newsletters
Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home CRM Systems Customer Service Contact Centers Business Intelligence More Topics...
Customer Service
24/7/365 Network Uptime!
Average Rating:
Rate this article:  
Researcher Discovers Second eBay Vulnerability
Researcher Discovers Second eBay Vulnerability

By Jennifer LeClaire
May 27, 2014 12:41PM

Bookmark and Share
With the FTC's emphasis on establishing a responsible standard of care for information security, we will see more of these investigations like the one into the eBay data breach. The kind of scrutiny being put on eBay in the wake of its data breach will help move enterprises away from silver bullet security solutions, toward defense-in-depth security.
 



No, the drama around the eBay breach is not over. Beyond probes by government agencies, a security researcher now says a second flaw could be used to hijack member accounts at the online auction platform.

According to Jordan Lee Jones, a college student in the United Kingdom, there’s a second vulnerability that remains open to hackers. Jones said he notified eBay via e-mail on Friday and got no response. He has published what he calls the “eBay cross-site scripting code” on his blog.

Here’s the backstory: Last Tuesday, eBay asked users to change their passwords in the wake of a cyberattack that compromised one of its databases. Unfortunately, it was a database that included eBay customers' names, encrypted passwords, e-mail addresses, physical addresses, phone numbers and dates of birth.

The PayPal Connection

We caught up with Dwayne Melancon, chief technology officer for Tripwire, to get his take on the unraveling eBay data breach story. He told us it appears the hack involved securely encrypted passwords, which makes it more difficult to gain access to users' eBay accounts en masse because it would require brute force decryption of passwords. But then he continued with a “however.”

“However, the fact that user e-mail addresses, physical addresses, and dates of birth were taken in the breach is more concerning,” Melancon said. “Criminals could use that information to masquerade as eBay customers on other sites, or perhaps use that information to 'social engineer' their way into users' other accounts on other services. Unlike the passwords, the other user-specific information was not encrypted and therefore easily reused by attackers.”

What does Melancon suggest? For starters, eBay users should be required -- not simply asked -- to reset their passwords. What’s more, password complexity rules should be in place to ensure users select complex passwords, he said. He also charged individual users with making sure they are not using the same passwords on various sites.

The PayPal Connection

eBay was careful to stress that PayPal was not involved in the breach. Nevertheless, Melancon noted that many eBay users also have their accounts connected to PayPal -- which eBay owns -- for payments. For that reason he’s also recommending that customers tap into PayPal’s two-factor authentication feature, which verifies your identity before you make a payment. In fact, he said it’s a best practice even without the eBay breach.

“eBay users have long been a popular target for phishing e-mails, and users must be especially wary during incidents like this,” Melancon said. “To be safe, users should not click on links in e-mails about eBay security or password changes. Instead, they should type the eBay URL directly into their browsers and log into the site that way to prevent disclosing their credentials to spoofed, malicious copies of the eBay site.”

With the Federal Trade Commission's increased emphasis on establishing a responsible standard of care for information security, Melancon believes we will see more of these investigations. He said this kind of scrutiny will help move enterprises away from so-called silver bullet security solutions, and toward defense-in-depth security.

“A well-designed security program hinges on foundational security controls that ensure that organizations know what is on their network, understand the risks and vulnerabilities in place, are able to enforce strong security configuration policies, and are able to continuously monitor the state of their systems, applications, and data to quickly identify suspicious changes or events," Melancon concluded.
 

Tell Us What You Think
Comment:

Name:

Lee:

Posted: 2014-05-29 @ 5:23pm PT
I simply find it hard to believe that if eBay owns PayPal that the company is telling the public the Truth when both ACCTS. Are connected.I say cancel your ACCTS. W/both eBay & PayPal til the they can prove your secure before disclosure of your info

Maria:

Posted: 2014-05-28 @ 9:40am PT
What is also problematic is that there are technical difficulties preventing the ebay password reset. I have tried multiple times and cannot get past the first screen to reset.



APC has an established a reputation for solid products that virtually pay for themselves upon installation. Who has time to spend worrying about system downtime? APC makes it easy for you to focus on business growth instead of business downtime with reliable data center systems and IT solutions. Learn more here.


 Customer Service
1.   Chief Customer Officers' Clout Grows
2.   FTC Wants Fix for Mobile Cramming
3.   Watson's First Consumer-Facing Gig
4.   Social Media Haters Speak Up
5.   Comcast Customer Service Fiasco


advertisement
Chief Customer Officers' Clout Grows
Especially in the tech sector.
Average Rating:
FTC Wants Fix for Mobile Cramming
Overcharges are 'the perfect scam'.
Average Rating:
Social Media Haters Speak Up
Survey says, now showing a little love.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Tor Internet Privacy Service Warns Users It Was Breached
You may never have heard of the Tor Project, but the Internet privacy service is making headlines. Tor’s devs say users might be victims of an attack launched against the project earlier this year.
 
Canadian Government Charges China with Cyberattack
The government of Canada is not happy with China. Canadian officials have accused "a highly sophisticated Chinese state-sponsored actor" of launching a cyberattack on its National Research Council.
 
Researchers Working To Fix Tor Security Exploit
Developers for the Tor privacy browser are scrambling to fix a bug revealed Monday that researchers say could allow hackers, or government surveillance agencies, to track users online.
 

Enterprise Hardware Spotlight
AMD's ARM-Based Opteron Out in $3K Dev Kit
It's dubbed "Seattle" and it's AMD's first 64-bit ARM-based Opteron processor. The low-power chip is being released as part of AMD’s Opteron A1100-series developer kit, and aimed at high-end data center needs.
 
Apple Updates MacBook Pros, Cuts Prices Up to $100
The popular MacBook Pro laptop line just got an update and a price cut of as much as $100. The MacBook Pro with Retina display now includes faster processors and double the memory.
 
Dell, BlackBerry Not Sweating Apple-IBM Alliance
IBM's recent move to partner with Apple to sell iPhones and iPads loaded with corporate applications has excited investors in both companies, but two rivals say they are unperturbed for now.
 

Mobile Technology Spotlight
Virgin Mobile Offers Custom Smartphone Plans
As the wireless carrier wars continue heating up, Virgin Mobile just threw the customization coal onto the fire. The firm has debuted a no-annual-contract plan with rates based on individual use.
 
Collaboration Provider Asana Revamps Mobile App
Asana, a collaboration software provider started by a Facebook founder, is now out with a rebuilt native iOS mobile app. It replaces one that even the company admits was not up to par.
 
FTC Wants Fix for 'Perfect Scam' of Mobile Cramming
The U.S. Federal Trade Commission has issued new guidelines to curb “mobile cramming,” a troublesome practice that adds unauthorized third-party charges to mobile phone bills.
 

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Contact Centers | Business Intelligence | Sales & Marketing | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.