Newsletters
Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home CRM Systems Customer Service Contact Centers Business Intelligence More Topics...
APC Free White Paper
Optimize your network investment &
Enter to win a Samsung Galaxy Note

www.apc.com
Enterprise I.T.
Next Generation Data Center Is Here!
Average Rating:
Rate this article:  
Researcher Discovers Second eBay Vulnerability
Researcher Discovers Second eBay Vulnerability

By Jennifer LeClaire
May 27, 2014 12:41PM

Bookmark and Share
With the FTC's emphasis on establishing a responsible standard of care for information security, we will see more of these investigations like the one into the eBay data breach. The kind of scrutiny being put on eBay in the wake of its data breach will help move enterprises away from silver bullet security solutions, toward defense-in-depth security.
 



No, the drama around the eBay breach is not over. Beyond probes by government agencies, a security researcher now says a second flaw could be used to hijack member accounts at the online auction platform.

According to Jordan Lee Jones, a college student in the United Kingdom, there’s a second vulnerability that remains open to hackers. Jones said he notified eBay via e-mail on Friday and got no response. He has published what he calls the “eBay cross-site scripting code” on his blog.

Here’s the backstory: Last Tuesday, eBay asked users to change their passwords in the wake of a cyberattack that compromised one of its databases. Unfortunately, it was a database that included eBay customers' names, encrypted passwords, e-mail addresses, physical addresses, phone numbers and dates of birth.

The PayPal Connection

We caught up with Dwayne Melancon, chief technology officer for Tripwire, to get his take on the unraveling eBay data breach story. He told us it appears the hack involved securely encrypted passwords, which makes it more difficult to gain access to users' eBay accounts en masse because it would require brute force decryption of passwords. But then he continued with a “however.”

“However, the fact that user e-mail addresses, physical addresses, and dates of birth were taken in the breach is more concerning,” Melancon said. “Criminals could use that information to masquerade as eBay customers on other sites, or perhaps use that information to 'social engineer' their way into users' other accounts on other services. Unlike the passwords, the other user-specific information was not encrypted and therefore easily reused by attackers.”

What does Melancon suggest? For starters, eBay users should be required -- not simply asked -- to reset their passwords. What’s more, password complexity rules should be in place to ensure users select complex passwords, he said. He also charged individual users with making sure they are not using the same passwords on various sites.

The PayPal Connection

eBay was careful to stress that PayPal was not involved in the breach. Nevertheless, Melancon noted that many eBay users also have their accounts connected to PayPal -- which eBay owns -- for payments. For that reason he’s also recommending that customers tap into PayPal’s two-factor authentication feature, which verifies your identity before you make a payment. In fact, he said it’s a best practice even without the eBay breach.

“eBay users have long been a popular target for phishing e-mails, and users must be especially wary during incidents like this,” Melancon said. “To be safe, users should not click on links in e-mails about eBay security or password changes. Instead, they should type the eBay URL directly into their browsers and log into the site that way to prevent disclosing their credentials to spoofed, malicious copies of the eBay site.”

With the Federal Trade Commission's increased emphasis on establishing a responsible standard of care for information security, Melancon believes we will see more of these investigations. He said this kind of scrutiny will help move enterprises away from so-called silver bullet security solutions, and toward defense-in-depth security.

“A well-designed security program hinges on foundational security controls that ensure that organizations know what is on their network, understand the risks and vulnerabilities in place, are able to enforce strong security configuration policies, and are able to continuously monitor the state of their systems, applications, and data to quickly identify suspicious changes or events," Melancon concluded.
 

Tell Us What You Think
Comment:

Name:

Lee:

Posted: 2014-05-29 @ 5:23pm PT
I simply find it hard to believe that if eBay owns PayPal that the company is telling the public the Truth when both ACCTS. Are connected.I say cancel your ACCTS. W/both eBay & PayPal til the they can prove your secure before disclosure of your info

Maria:

Posted: 2014-05-28 @ 9:40am PT
What is also problematic is that there are technical difficulties preventing the ebay password reset. I have tried multiple times and cannot get past the first screen to reset.



APC has an established a reputation for solid products that virtually pay for themselves upon installation. Who has time to spend worrying about system downtime? APC makes it easy for you to focus on business growth instead of business downtime with reliable data center systems and IT solutions. Learn more here.


 Enterprise I.T.
1.   SAP Taps Apigee for API Management
2.   IBM Beefs Up Identity Intelligence
3.   USB Security Flaw Uncovered
4.   AMD Debuts 64-Bit ARM Server Chips
5.   Asana Revamps Mobile App


advertisement
IBM Beefs Up Identity Intelligence
To offer biz better security products.
Average Rating:
AMD Debuts 64-Bit ARM Server Chips
New Opterons target data center needs.
Average Rating:
Dell, BlackBerry Downplay Threat
Say Apple-IBM alliance can't hurt them.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Contact Centers | Business Intelligence | Sales & Marketing | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.