Re: eBay Account Phishing with eBay Redirect
Josh Tolley to "Steven":
[re-organized to sensible quoting order]
> > The page actually appears to link to eBay and it does, the link below is
> > the one I received in my inbox recently.
> >
> > http://cgi4.ebay.com/ws/eBayISAPI.dll?MfcISAPICommand=RedirectToDomain&DomainUrl=http%3A%2F%2F%32%31%31%2E%31%37%32%2E%39%36%2E%37%2FUpdateCenter%2FLogin%2F%3FMfcISAPISession%3DAAJbaQqzeHAAeMWZlHhlWXS2AlBXVShqAhQRfhgTDrferHCURstpAisNRqAhQRfhgTDrferHCURstpAisNRpAisNRqAhQRfhgTDrferHCUQRfqzeHAAeMWZlHhlWXh
> >
> >
> >
> > Simply:
> >
> > http://cgi4.ebay.com/ws/eBayISAPI.dll?MfcISAPICommand=RedirectToDomain&DomainUrl=www.website.com
> >
> >
> I just tried this with my own URL, and eBay didn't forward me to some
> other site. Perhaps they've plugged this already?
That's odd, because the original URL in the spam Steven reported (and
as seen here earlier) still works, as does the redirector with a
handful of arbitrary URLs I just plucked from memory.
At least, the redirector works if you put "http://"; (or variously
encoded forms of the same) at the head of the URL. URLs of the form
"www.website.com" as suggested by Steven do not work.
In short, it does work so it's not fixed.
Site designers wanting to implement universal redirector URLs such as
this (to simplify logging of their own offsite referrals??) should
limit the redirector to _only_ accept redirects from their own servers.
And no, using http's "Referer:" [sic] header is not, in general, good
enough for this, but would help eBay in the short-term against tricks
such as this phishing scam. Of course, the modern world of content
served by third-parties from arbitrarily many or few machines on quasi-
random IPs all round the globe, depending on load and so on, makes this
_much_ harder to do properly, but that's part of the price you pay for
using cheap ugly hacks such distributed content serving depends on...
Regards,
Nick FitzGerald