bugtraq - Re: eBay Account Phishing with eBay Redirect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <421239F5.5219.32D950B8@localhost>
Date: Tue, 15 Feb 2005 18:05:41 +1300
From: Nick FitzGerald <nick@...us-l.demon.co.uk>
To: incidents@...urityfocus.com, bugtraq@...urityfocus.com
Subject: Re: eBay Account Phishing with eBay Redirect

Josh Tolley to "Steven":

[re-organized to sensible quoting order]
> > The page actually appears to link to eBay and it does, the link below is 
> > the one I received in my inbox recently.
> > 
> > http://cgi4.ebay.com/ws/eBayISAPI.dll?MfcISAPICommand=RedirectToDomain&DomainUrl=http%3A%2F%2F%32%31%31%2E%31%37%32%2E%39%36%2E%37%2FUpdateCenter%2FLogin%2F%3FMfcISAPISession%3DAAJbaQqzeHAAeMWZlHhlWXS2AlBXVShqAhQRfhgTDrferHCURstpAisNRqAhQRfhgTDrferHCURstpAisNRpAisNRqAhQRfhgTDrferHCUQRfqzeHAAeMWZlHhlWXh 
> > 
> > 
> > Simply:
> > 
> > http://cgi4.ebay.com/ws/eBayISAPI.dll?MfcISAPICommand=RedirectToDomain&DomainUrl=www.website.com 
> > 
> I just tried this with my own URL, and eBay didn't forward me to some 
> other site. Perhaps they've plugged this already?

That's odd, because the original URL in the spam Steven reported (and 
as seen here earlier) still works, as does the redirector with a 
handful of arbitrary URLs I just plucked from memory.

At least, the redirector works if you put "http://" (or variously 
encoded forms of the same) at the head of the URL.  URLs of the form 
"www.website.com" as suggested by Steven do not work.

In short, it does work so it's not fixed.

Site designers wanting to implement universal redirector URLs such as 
this (to simplify logging of their own offsite referrals??) should 
limit the redirector to _only_ accept redirects from their own servers. 
And no, using http's "Referer:" [sic] header is not, in general, good 
enough for this, but would help eBay in the short-term against tricks 
such as this phishing scam.  Of course, the modern world of content 
served by third-parties from arbitrarily many or few machines on quasi-
random IPs all round the globe, depending on load and so on, makes this 
_much_ harder to do properly, but that's part of the price you pay for 
using cheap ugly hacks such distributed content serving depends on...

Regards,

Nick FitzGerald