16 Jan
2006
16 Jan
'06
8:51 p.m.
A quick warning because I know a lot of y'all deal extensively on
eBay, and I obviously hadn't seen this one before.
I just got a phished "My Messages" eBay email from "a potential
buyer". It purported to be a question about a listed item, and the
links to the listing took me to a fake login page. It's very slick, I
wasn't paying attention and I fell for it.
What's really ugly is that the phishing site actually *does* bounce
you into your own account and log you in.
And hell yes I just changed my password. And my Paypal password.
Doc
16 Jan
16 Jan
9:31 p.m.
Doc Shipley wrote:
A quick warning because I know a lot of y'all
deal extensively on
eBay, and I obviously hadn't seen this one before.
This is new to me too. I got one earlier today, but I caught it. What
made me suspect something was up, was that the email was so generic. In
addition, he asked things that were plainly stated in my auction. I did
a search for the username, and it came back as no longer a registered user!!
I just got a phished "My Messages" eBay email from "a potential
buyer". It purported to be a question about a listed item, and the
links to the listing took me to a fake login page. It's very slick, I
wasn't paying attention and I fell for it.
Well, if you look, it wasn't actually in the message area if you logged
into "My Ebay".
What's really ugly is that the phishing site actually *does* bounce
you into your own account and log you in.
I don't see how that's possible. Unless you mean that your browser
automatically fills in your username and password into a fake ebay page,
as if it were the real one. Otherwise, why would the scammer even need
to send an email to you?
Chad Fernandez
Michigan, USA
9:48 p.m.
C Fernandez wrote:
Well, yeah, but that was a little late. :\
Like I said, if I had been paying attention (and if eBay wasn't
constantly "tweaking" the look and feel), it would have been fairly easy
to spot. But I wasn't.
No, I mean that when I clicked the "item link" in the phisher's
email, and logged into the page it took me to, it redirected me to eBay
and logged me into my real account, so that I ended up in my normal "My
Summary" interface, with my current watched items and stuff showing.
I don't know how they did it, but I'm guessing it just requires a
little PHP code on the phisher's site.
Doc
Doc Shipley wrote:
This is new to me too. I got one earlier today, but I caught it. What
made me suspect something was up, was that the email was so generic. In
addition, he asked things that were plainly stated in my auction. I did
a search for the username, and it came back as no longer a registered
user!!
Right. And on mine, the auction item number was invalid.
I just got a
phished "My Messages" eBay email from "a potential
buyer". It purported to be a question about a listed item, and the
links to the listing took me to a fake login page. It's very slick, I
wasn't paying attention and I fell for it.
Well, if you look, it wasn't actually in the message area if you logged
into "My Ebay". What's
really ugly is that the phishing site actually *does* bounce
you into your own account and log you in.
I don't see how that's possible. Unless you mean that your browser
automatically fills in your username and password into a fake ebay page,
as if it were the real one. Otherwise, why would the scammer even need
to send an email to you?
10:01 p.m.
Doc Shipley wrote:
Right. And on mine, the auction item number was
invalid.
I just checked the auction number I got, and it acted as if I were doing
a regular search..... like for a part number or something. I found the
"related search" links interesting. one of them was the username that I
got in the email.
Well, yeah, but that was a little late. :\
Like I said, if I had been paying attention (and if eBay wasn't
constantly "tweaking" the look and feel), it would have been fairly easy
to spot. But I wasn't.
I noticed the email wasn't exactly like what I'm used to getting, but I
figured Ebay had just revamped it.
No, I mean that when I clicked the "item
link" in the phisher's email,
and logged into the page it took me to, it redirected me to eBay and
logged me into my real account, so that I ended up in my normal "My
Summary" interface, with my current watched items and stuff showing.
I get what your saying now.
I did report this to Ebay. Normally, I don't bother, but I figured if I
hadn't seen this approach before, maybe they hadn't either.
I did a quick Google search, and I got about 1 page of hits, using the
username I was given. Another slight twist, is that the guy will claim
that he's tried twice to send payment via Paypal, wants to know if
there's something wrong with your Paypal account. One potential victim
noticed that the sender must be using multiple usernames because he
forgot to change it in one spot, so his email showed two different
supposed users sending the message.
Chad Fernandez
Michigan, USA
10:19 p.m.
At 08:31 PM 1/16/2006, C Fernandez wrote:
Well, if you look, it wasn't actually in the
message area if you logged into "My Ebay".
Yes, and that's the best way to avoid the zillion fake eBay messages.
Don't rely on your own email, only read it in "My eBay." That's what
eBay tells you to do.
I don't see how that's possible. Unless you
mean that your browser automatically fills in your username and password into a fake ebay
page, as if it were the real one. Otherwise, why would the scammer even need to send an
email to you?
The code under the "Sign in Securely" button on eBay's login page
just does a POST to :
https://signin.ebay.com/ws/eBayISAPI.dll?co_partnerid=2&siteid=0&Us…
with a few variables set, so it's easy to fake from another site.
Automated posting of forms is a useful trick.
- John
17 Jan
17 Jan
3:16 p.m.
A quick warning because I know a lot of y'all deal extensively on
eBay, and I obviously hadn't seen this one before.
I just got a phished "My Messages" eBay email from "a potential
buyer". It purported to be a question about a listed item, and the
links to the listing took me to a fake login page. It's very slick, I
wasn't paying attention and I fell for it.
I'm sure I'll get caught now...
I stick with ancient e-mail software that doesn't let ne click on links.
That doesn't attempt to decode/dsipaly html. And which certaily doesn't
run executable programs (in any language).
I am less likely to get caught by something like this because I will spot
that the link doesn't go to ebay.co.uk or wherever, but goes to some
totally unknown site. At which point I am pretty sure it's fraudulent
-tony
5:05 p.m.
Tony Duell wrote:
I am less likely to get caught by something like this
because I will spot
that the link doesn't go to ebay.co.uk or wherever, but goes to some
totally unknown site. At which point I am pretty sure it's fraudulent
Tony,
I use Firefox, which does show me where a link goes when I put the mouse
pointer over it. I didn't mention it, but it's one of first things I
look for, when I'm presented with a link.
Chad Fernandez
Michigan, USA
6:14 p.m.
I use Firefox, which does show me where a link goes
when I put the mouse
pointer over it. I didn't mention it, but it's one of first things I
look for, when I'm presented with a link.
Sure, but it's a lot easier to assume it's genuine, or click by accident,
than to have to type in the link and not notice it's going somewhere
totally wrong.
-tony
8:39 p.m.
Tony Duell wrote:
Sure, but it's a lot easier to assume it's
genuine, or click by accident,
than to have to type in the link and not notice it's going somewhere
totally wrong.
I have to cut and paste any links I get in an email. I'm not sure why.
Maybe becasue I have Windows so stripped down, or maybe becasue I
don't use M$ IE. Firefox works pretty well for me. It's sort of a
midpoint between full manual (your setup) and full auto (the M$ way).
Chad Fernandez
Michigan, USA
7:44 p.m.
----- Original Message -----
From: ard at p850ug1.demon.co.uk (Tony Duell)
Date: Tuesday, January 17, 2006 8:16 pm
Subject: Re: Sort of OT; new eBay phish
Yeah, its very easy. I almost
fell for this one myself. I'd imeediatly
change your ebay password.
Also thing I now make a habit of is entering a wrong password first,
every time I'm asked for one. I think this very slightly raises my
security level.
All the best
Larry Cuffe
A quick warning because I know a lot of y'all deal
extensively on
eBay, and I obviously hadn't seen this one
before.
I just got a phished "My Messages" eBay email from "a
potential
buyer". It purported to be a question about
a listed item, and
the
links to the listing took me to a fake login
page. It's very
slick, I
> wasn't paying attention and I fell for it.
I'm sure I'll get caught now...
I stick with ancient e-mail software that doesn't let ne click on
links.
That doesn't attempt to decode/dsipaly html. And which certaily
doesn't
run executable programs (in any language).
I am less likely to get caught by something like this because I
will spot
that the link doesn't go to ebay.co.uk or wherever, but goes to
some
totally unknown site. At which point I am pretty sure it's fraudulent
-tony
18 Jan
18 Jan
9:18 a.m.
I stick with ancient e-mail software that doesn't let ne click on links.
That doesn't attempt to decode/dsipaly html. And which certaily doesn't
run executable programs (in any language).
I am less likely to get caught by something like this because I will spot
that the link doesn't go to ebay.co.uk or wherever, but goes to some
totally unknown site. At which point I am pretty sure it's fraudulent
I use elm for my work email which does the same as you describe. For
personal email I use Thunderbird which will show the full link when
your mouse pointer hovers over it. (Plus you can also turn off
automatic picture get from the internet)
Cheers,
Bryan
10:16 a.m.
I use elm for my work email which does the same as you
describe.
I use elm for my mail, period, which does the same as you describe. :)
--
--------------------------------- personal: http://www.armory.com/~spectre/ ---
Cameron Kaiser * Floodgap Systems * www.floodgap.com * ckaiser at floodgap.com
-- Never send a human to do a machine's job. -- "The Matrix"
------------------
11:31 a.m.
I stick with ancient e-mail software that doesn't let ne click on links.
That doesn't attempt to decode/dsipaly html. And which certaily doesn't
run executable programs (in any language).
I am less likely to get caught by something like this because I will spot
that the link doesn't go to ebay.co.uk or wherever, but goes to some
totally unknown site. At which point I am pretty sure it's fraudulent
I use elm for my work email which does the same as you describe. For
19 Jan
19 Jan
12:32 a.m.
I use elm for
my work email which does the same as you describe. For
It's not suprising it does the same thing. I'm running (an ancient
version of) elm too. OK, I sometimes also use pine when I get a
MIME-encoded attachment that is actually useful.
18 Jan
18 Jan
12:38 p.m.
Bryan Pope wrote:
I use elm for my work email which does the same as you
describe. For
personal email I use Thunderbird which will show the full link when
your mouse pointer hovers over it. (Plus you can also turn off
automatic picture get from the internet)
oops, I said I use Firefox earlier..... I meant Thunderbird.
Chad Fernandez
Michigan, USA
6793
days inactive
6795
days old
14 comments
7 participants
participants (7)
-
ard＠p850ug1.demon.co.uk -
bpope＠wordstock.com -
doc＠mdrconsult.com -
fernande＠internet1.net -
jfoust＠threedee.com -
Laurence.Cuffe＠ucd.ie -
spectre＠floodgap.com