Alert: Ebay Hacked

[Michael Panfeld]

I was looking or Arri stuff on Ebay and stumbled on to a nerve-rattling hack. I clicked on an auction for a Zeiss 5 lens set. The item # is 370777999040

It takes me to a page that is outside the Ebay site. I did not realize this at first. What I did see is that this auction is a fake auction that has popped up many times. I recognized the photo. So I tried to report it by clicking on th Report Item Link. Instead of taking me to that page, it takes me to a Buy it Now Page. I tried clicking on the Customer service link and it takes me to the log in page and asked for my log in credentials. Backing off I returned to the auction page and noticed that I was no longer logged in. This is when I noticed that that I was no longer on the Ebay.com web site, but was here: <Link removed by admin>
I also went to the see Seller's Other Items page and guess what, the auction was not there, it was invisible.

This is very very shocking. I am on the phone with Ebay right now, but wanted to warn others ASAP. The popular scam of listing high-price film gear with notes to contact the buyer at a gmail account to buy it now just got a lot scarier.

 

[Andy White]

Wow - you're right. A scary one.

Basically there's a re-direct on the page (the item number takes you to the false site straight away).

Nasty.

 

[David Collard]

Thanks for alerting.

I'm not entirely surprised. Ebay has a weak search engine so perhaps that says a lot about its security.

 

[Brandon J.F.]

Looks like all their items do this: http://www.ebay.com/sch/pittypatscloset/m.html?_ipg&_from&_nkw&_armrs=1&_sop=3

Very scary. eBay needs to fix this immediately.

 

[Brandon J.F.]

I found the code that does the redirect.

Here is the JavaScript file: http://mny2f.com/design.js

Here is the page it is referenced in: http://vi.raptor.ebaydesc.com/ws/eB...atscloset&excSoj=1&rptdesc=1&excTrk=1&lsite=0

That page is loaded as a frame on the real eBay page.

Here is the eBay page: http://www.ebay.com/itm/Brother-NV4...990?pt=BI_Sewing_Machines&hash=item565417468e

It's not the same product, but it works like this with all this seller's product pages.

 

[ericyoung]

Thanks for the heads up Michael!

 

[Mike Garrick]

Note to all they 're at it again on numerous items listed in the Arri search.

Like 5 arri primes for $2K ..........................man what a sweet deal . Click on the item & you end up on some other site.

Watch your URL address bar .!

 

[Paul Hudson]

And today an R1 with less than 60 hours was listed at $2500 (buy it now) with a note to contact the seller.

 

[Paul Hudson]

And today an R1 with less than 60 hours was listed at $2500 (buy it now). This also had the note "don't bid here, contact seller"

 

[Steve Sherrick]

There are days when I definitely feel the whole internet thing just isn't worth it. Too many people looking to lie, cheat, and steal. Eventually, we'll all get hit in one way or another. But, it's the ship most of us have decided to get on and I'm not sure it's coming back to port anytime soon. Just have to be as cautious as possible.