Newsletters
Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home CRM Systems Customer Service Business Intelligence Sales & Marketing More Topics...
Customer Data
Tame your scariest paperwork. Find Out How
Average Rating:
Rate this article:  
Researcher Discovers Second eBay Vulnerability
Researcher Discovers Second eBay Vulnerability

By Jennifer LeClaire
May 27, 2014 12:41PM

Bookmark and Share
With the FTC's emphasis on establishing a responsible standard of care for information security, we will see more of these investigations like the one into the eBay data breach. The kind of scrutiny being put on eBay in the wake of its data breach will help move enterprises away from silver bullet security solutions, toward defense-in-depth security.
 



No, the drama around the eBay breach is not over. Beyond probes by government agencies, a security researcher now says a second flaw could be used to hijack member accounts at the online auction platform.

According to Jordan Lee Jones, a college student in the United Kingdom, there’s a second vulnerability that remains open to hackers. Jones said he notified eBay via e-mail on Friday and got no response. He has published what he calls the “eBay cross-site scripting code” on his blog.

Here’s the backstory: Last Tuesday, eBay asked users to change their passwords in the wake of a cyberattack that compromised one of its databases. Unfortunately, it was a database that included eBay customers' names, encrypted passwords, e-mail addresses, physical addresses, phone numbers and dates of birth.

The PayPal Connection

We caught up with Dwayne Melancon, chief technology officer for Tripwire, to get his take on the unraveling eBay data breach story. He told us it appears the hack involved securely encrypted passwords, which makes it more difficult to gain access to users' eBay accounts en masse because it would require brute force decryption of passwords. But then he continued with a “however.”

“However, the fact that user e-mail addresses, physical addresses, and dates of birth were taken in the breach is more concerning,” Melancon said. “Criminals could use that information to masquerade as eBay customers on other sites, or perhaps use that information to 'social engineer' their way into users' other accounts on other services. Unlike the passwords, the other user-specific information was not encrypted and therefore easily reused by attackers.”

What does Melancon suggest? For starters, eBay users should be required -- not simply asked -- to reset their passwords. What’s more, password complexity rules should be in place to ensure users select complex passwords, he said. He also charged individual users with making sure they are not using the same passwords on various sites.

The PayPal Connection

eBay was careful to stress that PayPal was not involved in the breach. Nevertheless, Melancon noted that many eBay users also have their accounts connected to PayPal -- which eBay owns -- for payments. For that reason he’s also recommending that customers tap into PayPal’s two-factor authentication feature, which verifies your identity before you make a payment. In fact, he said it’s a best practice even without the eBay breach.

“eBay users have long been a popular target for phishing e-mails, and users must be especially wary during incidents like this,” Melancon said. “To be safe, users should not click on links in e-mails about eBay security or password changes. Instead, they should type the eBay URL directly into their browsers and log into the site that way to prevent disclosing their credentials to spoofed, malicious copies of the eBay site.”

With the Federal Trade Commission's increased emphasis on establishing a responsible standard of care for information security, Melancon believes we will see more of these investigations. He said this kind of scrutiny will help move enterprises away from so-called silver bullet security solutions, and toward defense-in-depth security.

“A well-designed security program hinges on foundational security controls that ensure that organizations know what is on their network, understand the risks and vulnerabilities in place, are able to enforce strong security configuration policies, and are able to continuously monitor the state of their systems, applications, and data to quickly identify suspicious changes or events," Melancon concluded.
 

Tell Us What You Think
Comment:

Name:

Lee:

Posted: 2014-05-29 @ 5:23pm PT
I simply find it hard to believe that if eBay owns PayPal that the company is telling the public the Truth when both ACCTS. Are connected.I say cancel your ACCTS. W/both eBay & PayPal til the they can prove your secure before disclosure of your info

Maria:

Posted: 2014-05-28 @ 9:40am PT
What is also problematic is that there are technical difficulties preventing the ebay password reset. I have tried multiple times and cannot get past the first screen to reset.



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Customer Data
1.   Facebook To Track Users' TV Habits
2.   Salesforce Partners with Philips
3.   Facebook Social Experiment Irks Us
4.   Montana Health Care Data Hacked
5.   Where In World Is the Private Data?


advertisement
Facebook Social Experiment Irks Us
Secretive test was legal, but ethical?
Average Rating:
Facebook To Track Users' TV Habits
Teams with Nielsen for mobile analytics.
Average Rating:
Where In World Is the Private Data?
IT security pros don't have a clue.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Wall Street Journal Hacked Again
Hacked again. That’s the story at the Wall Street Journal this week as the newspaper reports that the computer systems housing some of its news graphics were breached. Customers not affected -- yet.
 
Dropbox for Business Beefs Up Security
Dropbox is upping its game for business users. The cloud-based storage and sharing company has rolled out new security, search and other features to boost its appeal for businesses.
 
34 European Banks Hit by Android-Skirting Malware
Criminals have been finding gaping holes in Android-based two-factor authentication systems that banks around the world are using. The result: 34 banks in four European countries have been hit.
 

Enterprise Hardware Spotlight
Microsoft Makes Design Central to Its Future
Over the last four years, Microsoft has doubled the number of designers it employs, putting a priority on fashioning devices that work around people's lives -- and that are attractive and cool.
 
Contrary to Report, Lenovo's Staying in Small Windows Tablets
Device maker Lenovo has clarified a report that indicated it is getting out of the small Windows tablet business -- as in the ThinkPad 8 and the 8-inch Miix 2. But the firm said it is not exiting that market.
 
Seagate Unveils Networked Drives for Small Businesses
Seagate is out with five new networked attached storage products aimed at small businesses. The drives are for companies with up to 50 workers, and range in capacity from two to 20 terabytes.
 

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Business Intelligence | Sales & Marketing | Contact Centers | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.