New eBay fraud tactic: Viral Porn Trojan Horses (VPTH)

gonzo · 08-17-2006

A new tactic (which we have dubbed VPTH) has hit eBay hard the last couple of days. Unfortunately it's a really clever way to get lots of eBay uids/passwords AND it's very viral so it appears to be growing at an exponential rate.

Here's how the bad guys do it:
1. They use normal Phishing techniques to get an ebayer's uid/pwd (preferably a seller with some good feedback).
2. They post toins of malicious listing to popular categories. In the listings they:

Use something like porn imagery to draw heavy click-through to the listing
Turn on every eBay bonus feature you can imagine: bold, highlight, gallery plus, featured plus, etc. (hey they aren't paying so why not?!)
Lots of timese these are 1 day auctions so they are indexed quick and TnS doesn't have much time to a) find and b) react.
Now here's the trick - they put in the listing some malicious javascript that redirects anyone that clicks on the listing to a page at badguy.com that is 100% identical to an eBay login page and it says: "To view this item you must login".

3. Now the bad guys have tons of BUYER userid's and logins, which they then use to get into paypal accounts, launch more auctions and cause general mayhem.

4. Some of these are so clever you can't find which listing is doing it. They'll post a porn listing and then 10 regular ones all with the javascript in there. A seller saw one yesterday that seemed to infect every listing in the category - it somehow was changing the search results pages around.

In the last two weeks this scheme is happening more and more frequently. Yesterday the entire shoe category was full of these things.
Here's a real world example from yesterday (the black boxes are mine as this is a family oriented blog)->

If you saw this and clicked on the first listing, then entered your user ID and password, you can say goodbye to your ebay identity, potentially your paypal plus your account would be harvested for emails and you would be on every spammers list very quickly. Most likely your password would be immediately changed (I'm sure they have spiders for this) and your account added to the hijacked list, then more listings would be introduced from your account (this is where the geometrical progression/viral part of the scheme comes in).

Jace · 08-18-2006

hm...last I checked javascript was not allowed in listings

Greg B · 08-18-2006

Thanks for the heads up Gonzo but I don't think Ebay sellers can put java script into their listings. There is a way to do it another way but I can't say it here or it'll be too easy for the bad guys to figure out and exploit.

brand0n · 08-19-2006

ive seen it done a few times.

pretty clever really and im sure boat loads of people go for it.

08-17-2006	#1
gonzo Fat Fucking Nobody Want to see your own Advertising Here! Join Date: Apr 2003 Location: Atlanta,Ga. Posts: 17,795 Blog Entries: 11	New eBay fraud tactic: Viral Porn Trojan Horses (VPTH) A new tactic (which we have dubbed VPTH) has hit eBay hard the last couple of days. Unfortunately it's a really clever way to get lots of eBay uids/passwords AND it's very viral so it appears to be growing at an exponential rate. Here's how the bad guys do it: 1. They use normal Phishing techniques to get an ebayer's uid/pwd (preferably a seller with some good feedback). 2. They post toins of malicious listing to popular categories. In the listings they: Use something like porn imagery to draw heavy click-through to the listing Turn on every eBay bonus feature you can imagine: bold, highlight, gallery plus, featured plus, etc. (hey they aren't paying so why not?!) Lots of timese these are 1 day auctions so they are indexed quick and TnS doesn't have much time to a) find and b) react. Now here's the trick - they put in the listing some malicious javascript that redirects anyone that clicks on the listing to a page at badguy.com that is 100% identical to an eBay login page and it says: "To view this item you must login". 3. Now the bad guys have tons of BUYER userid's and logins, which they then use to get into paypal accounts, launch more auctions and cause general mayhem. 4. Some of these are so clever you can't find which listing is doing it. They'll post a porn listing and then 10 regular ones all with the javascript in there. A seller saw one yesterday that seemed to infect every listing in the category - it somehow was changing the search results pages around. In the last two weeks this scheme is happening more and more frequently. Yesterday the entire shoe category was full of these things. Here's a real world example from yesterday (the black boxes are mine as this is a family oriented blog)-> If you saw this and clicked on the first listing, then entered your user ID and password, you can say goodbye to your ebay identity, potentially your paypal plus your account would be harvested for emails and you would be on every spammers list very quickly. Most likely your password would be immediately changed (I'm sure they have spiders for this) and your account added to the hijacked list, then more listings would be introduced from your account (this is where the geometrical progression/viral part of the scheme comes in). __________________ We are putting the bastards of this world on notice; greed and corruption will always be met with "a voice made of ink and rage." "Never try and be like anyone else" - Hunter S. Thompson "The truth is the truth no matter how you try and package a lie" - Shellee Hale

08-18-2006	#2
Jace .... $100 for every ImLive sign-up Join Date: Mar 2004 Posts: 4,392 Blog Entries: 1	Re: New eBay fraud tactic: Viral Porn Trojan Horses (VPTH) hm...last I checked javascript was not allowed in listings

08-18-2006	#3
Greg B Members Join Date: Dec 2003 Posts: 497	Re: New eBay fraud tactic: Viral Porn Trojan Horses (VPTH) Thanks for the heads up Gonzo but I don't think Ebay sellers can put java script into their listings. There is a way to do it another way but I can't say it here or it'll be too easy for the bad guys to figure out and exploit. __________________ BOONE'S ADULT CARTOONS

08-19-2006	#4
brand0n Members Join Date: Nov 2003 Posts: 711	Re: New eBay fraud tactic: Viral Porn Trojan Horses (VPTH) ive seen it done a few times. pretty clever really and im sure boat loads of people go for it. __________________ whats the sig rules?