Identity Theft at eBay and PayPal

[SamHouston]

My homepage was set to google. That is the first thing I checked because I know that I can inadvertently change it. I ran all kinds of spyware removal and now the eBay opening page is gone. One trojan was found and removed. AVG found it when McAfee did not.

Glad to hear that you solved the problem.

I swear by AVG for the same reason that you mention. They have caught things that other virus protection software has missed on my hard drive, even the software that I paid for.

AVG is free to home users and it is better than the stuff that cost me money in the past.

 

[TexasGal]

SH,

I am SO glad you mentioned AVG. My daughter needed protection on her computer at home, and I was able to tell her about it. They offer 3 free products, anti-virus, anti-spyware, and anti-rootkit.

Thanks!
TG

 

[SamHouston]

I posted about my problems on my book blog and someone at Computer World spotted it and linked it to an article on the eBay hacking problem. Apparently, this is a major problem that started showing up in August and is getting worse. Although eBay was asked to comment, they have not yet done so.

Custom-built botnet steals eBay accounts

"Online auction site eBay has been targeted by identity thieves, who are wielding a botnet that uses brute force to uncover valid account log-in information, a Tel Aviv-based security company said Monday."

(click on the link for more details)

 

[TexasGal]

What is brute force regarding hacking? Since it can't be , what is it?

 

[SamHouston]

What is brute force regarding hacking? Since it can't be , what is it?

I'm not entirely sure myself, but the article tries to explain it.

I just wish these guys would use their expertise to add something of value to the internet rather than trying to steal from those who use it for legitimate purposes. What a waste of their talent...

Now, if I could just get close enough to the guy who caused me this headache, I'd love to use that baseball bat on his fingers.

 

[ERD50]

ERD50,

I am not hearing every single day or week that my bank is being hacked or someone is using any of my credit cards.

Cars and wallets are stolen every day. Houses are broken into everyday. DO we stop using these?

If you don't feel comfortable with eBay or PayPal or anyone else, stop doing business with them. That is your right.

I just think your idea that the security problem lies with PayPal is a bit misguided. What is happening in all the stories I've seen, is that the 'bad guys' are STEALING your password/login FROM YOU (not from PayPal). Think of that password/login as the 'keys' to your account.

If someone steals your car keys, do you blame the car manufacturer or the car dealer? No. You blame the 'bad guy', or maybe yourself for making your keys accessible. So, why blame PayPal when someone steals the keys to your account?

If someone steals your wallet, do you blame the US government for making currency that requires no identification to use?

I think the correct way to look at this is:

A) If you have a computer that is susceptible to virus attacks, it is the equivalent of living in a high-crime area. Maybe you don't want to own an expensive car in such an area. So, maybe you don't want to have a PayPal account, or any type of personal account on the internet either. Or maybe you spend $5 on a better lock.

B) Even with a secure computer, if you are susceptible to 'social engineering' attacks (you comply with requests for your password), then you are engaging in risky on-line behavior. So, maybe you don't want to have a PayPal account, or any type of personal account on the internet either. Or maybe you spend $5 on a better lock.

C) Though it looks to me that the 'bad guys' are not PayPal's fault, if enough people drop their accounts over fear of virus key loggers or phishing, PayPal will need to do something to counter this (just like car makers added locks/alarms - so they could sell more cars). Right now, it looks like they decided to offer extra security (quite effective IMO) for $5 (probably below their cost). If that isn't good enough, they will need to go further.

Considering the volume of eBay postings I see, I doubt they will go further for now.

I did just sign up with PayPal and I am concerned, hence my interest in this thread. However, since my computer at least has a history of being secure, and since that 'ShieldsUp' website shows me to be 'invisible' (Stealth Mode) on the internet, and since I NEVER respond directly to emails or other social engineering attacks, I feel fairly comfortable with it. Based on what I read, I would NOT tie my bank account to it, and I m considering getting a separate credit card, just for stuff like this - it would be a pain to cancel/reset some of the auto payments I have made to my current cards.

-ERD50

 

[JonnyM]

ERD50 Well written. I take responsibility for my own PC/Network/Internetwork Security. I've used Paypal about a thousand times now. They have intervened on my behalf the one time I needed them to. But that is beside the point. There are vulnerabilities in all types of transactions. If the kid that can't count change keys in the wrong amount at the Starbucks drive through, I will get the wrong amount of change from my 20. It's my responsibility to make sure, or write it off, but my choice.

I'll likely pay the 5 bucks for the next level of security. I've priced those gadgets for the Network I used to maintain, and they were pricey. That's giveaway at $5 and cheap insurance, with only a little inconvenience.

 

[figner]

What is brute force regarding hacking? Since it can't be , what is it?

Generally it refers to trying many combinations (of usernames/passwords, key/value pairs, or whatever the thing is you're attempting to crack), until you hit upon one that works. A well designed web site or application can make this more difficult by (for instance) having a timeout after a certain number of invalid login attempts.

Here's a wikipedia entry with more details:
Brute force attack - Wikipedia, the free encyclopedia

 

[TexasGal]

Posted by ERD50: Based on what I read, I would NOT tie my bank account to it, and I m considering getting a separate credit card, just for stuff like this - it would be a pain to cancel/reset some of the auto payments I have made to my current cards.

Great idea ERD50. If nothing else, this discussion has perhaps given people the impetus to manage their PayPal account in a more cautious manner. I still have my credit card registered with them. We'll see how it goes.

JonnyM, if I did a lot of business through PayPal, I would probably protest the fee and pay it anyway. I don't use it often so I can allow myself to sound more adamant. I am glad they took care of your problem as well as OP's.

Only the criminal perpetrating the crime is responsible, but I do believe that any enterprise should do everything humanly possible to ensure the security of their users at their cost (I'm sure these crimes are costing them a fortune). I will do everything on my personal computer to ensure security at my cost. Banks are adding other layers of security without debiting my account for a $5 fee (although they probably stick it to me elsewhere) and I think EB/PP should do the same thing. If I have to pay an additional $5 for every website where I do business, it is going to get ridiculous. IMHO, a third or fourth level of security should be paid by the enterprise which uses the website to sell goods and services to consumers, i.e. virtual keyboards or some other method, including security keys.

Now here is another idea, if I could buy ONE device that would work on all websites where I do business, that would be something that I would purchase without blinking.

Just because I have an opinion about who should pay for added security on an enterprises's website does not mean that you should interpret that as being easy on the criminal. After all, I am a native Texan. String em up! (kidding) We are all already paying a premium because of criminal activity.

Thanks for the good discussion. There is not a subject on this forum that doesn't have multiple viewpoints and lots of tangents. That is fun!

I hope others who have experiences related to identify theft and account hijacking will post on this forum just so that we can all have an opportunity to think back through our security strategies. The OP's first post started me thinking about mine. I am in the process of going out to change all my passwords and will use strong ones. Many of mine were weak or medium. So another lesson learned that began with this thread!

Thanks to all!
TG

 

[free4now]

Supposedly a famous bank robber was asked why he robs banks and answered "Because that's where the money is". This is why paypal has so many security problems... not because paypal has inferior security but simply because all the fraudsters know it's the most likely place that someone online will have their money. They know that a paypal phishing expedition will yield the most passwords simply because more people have paypal accounts than any other online banking service.

Another saying is that you don't have to outrun the bear, just outrun the other person running from the bear. I feel relatively secure in my paypal usage because I have a strong password, never respond to phishing emails, and maintain my antivirus and firewall. There will always be enough clueless people on the internet to keep the fraudsters supplied with low hanging fruit, so I'm not particularly worried that they would do something exotic like break into a checking account that had been disconnected from paypal. If they find your paypal account is closed they'll probably just lose interest and move on to someone else with an open paypal account.

One security tip that I don't see mentioned often: use an email password that is strong and different from all your other passwords. The biggest concern I have is that a fraudster could break into my email account and then use it to confirm almost any kind change to my financial accounts. Losing access to the email account I've been using for more than a decade would also be about the biggest hassle I could imagine, far worse than having to close a financial account or two.

 

[clifp]

Question - do you think this was the result of a phishing scam? Maybe you don't remember, but did you go to a (fake) eBay account directly from a pfishing email?

If not, that means the hackers have found other ways in, an then I am worried.

-ERD50

The short answer is I am not sure. The longer answer is I did have a talk with Ebay about how they got my password, and the security folks at ebay were pretty uncommital about it.

In the proceeding several months I had been soliciting with ebay phishing schemes. I dutifully passed them on to Ebay. I am not a big Ebay or PayPal user a couple of times a year. So any request to do anything on Ebay or PayPal would have been viewed by me with skepticism. So I rather doubt.

I suspect that most likely way is that I had been sloppy about using a generic password, so possibly any website I had register would have a good chance of guessing my username a password. I since have made a point of not using my generic password for any site where money is involved.

 

[joesxm3]

Step 1 is to make a good password.

Longer than 8 characters.

Letters and numbers maybe special characters if allowed, mixed case.

One nice suggestion I read recently is to make a sentence that you can remember and then use the first letter of each word to make the password. That ay it can be long yet remembered.

Different password for each site. rite them down and lock it up in case you forget.

That e-bay security key sounds good - too bad they have the gall to charge for it, but probably worth getting.

 

[chinaco]

Step 1 is to make a good password.

Longer than 8 characters.

Letters and numbers maybe special characters if allowed, mixed case.

One nice suggestion I read recently is to make a sentence that you can remember and then use the first letter of each word to make the password. That ay it can be long yet remembered.

Different password for each site. rite them down and lock it up in case you forget.

That e-bay security key sounds good - too bad they have the gall to charge for it, but probably worth getting.

Step 2. Change the passwords on a regular basis. (perhaps quarterly).

 

[chinaco]

Question - do you think this was the result of a phishing scam? Maybe you don't remember, but did you go to a (fake) eBay account directly from a pfishing email?

If not, that means the hackers have found other ways in, an then I am worried.

-ERD50

According to the article, the recent compromise used brute-force to collect IDs and PWs. If that technique was used, it may indicate that a common security best practice is not in place. The practice being "inactivate an account after several (small number) unsuccessful attempts to login". Brute force often takes a bunch of tests. The login id for ebay is readily available... it is everyone's screen handle. A more secure approach would be to not make the login id public. Keep the login id private and have people key in a different handle.

There are many, many ways to exploit a weakness and compromise a site. There are loads of cracks in the way sites are designed and the supporting pieces of the system. The cracks often extend to the basic business processes (employees and their procedures).

You (as a customer) can do everything right and some other weak link in the chain can be compromised.

When it comes to the internet... Security was an after thought! Holes will continue to be chased for years to come. And the thieves are getting more sophisticated. No longer is the problem a lone nerd reveling over his accomplishment of just breaking into a site and defacing it. Now we face organized crime rings.


If I were using ebay or paypal, I would get the two-factor device (even if I had to pay for it). Consider it a cost of doing business with that platform.

If any of my financial institutions offer two-factor devices, and I use the online service, I will get it.

One basic way to protect oneself (related to internet accounts) is to close unused (or little used) accounts. Personally I limit who I do business with over the internet. For me, ebay is a novelty not a necessity.

 

[Lsbcal]

From what I understand, Vanguard will not let the user try more then about 3 attempts before deactiviation. If trying from a computer outside the home I think that they ask additional questions that the user has preselected, such as was city were you married in. If other companies aren't using at least this sort of system, it makes you wonder why.

I agree that easy passwords should only be used for non-financial, non-sensitive accounts like a web forum. Personally, if your password is robust I don't see the need to consistently change it on a regular basis -- give me a convincing argument if you think this is wrong.

Les

P.S. Just downloaded AVG's rootkit tool. It runs quite quickly on my XP system and I'll just run it every month or so I guess.

 

[ERD50]

The practice being "inactivate an account after several (small number) unsuccessful attempts to login". Brute force often takes a bunch of tests. The login id for ebay is readily available... it is everyone's screen handle. A more secure approach would be to not make the login id public. Keep the login id private and have people key in a different handle.

You make some good points. Having a separate user name from what is displayed is good, but really no better than requiring a longer password.

X character hidden login ID plus Y character password = public login ID and an (X+Y) length password. No difference.

But that public login id does give the scammers a limited number of accounts to try to crack, which makes weak passwords all that more vulnerable - I think I'm, going to go back and make sure I have a very strong password on ebay/paypal.

Brute force and a limit at three attempts: I suspect that their robots would just make three attempts, note it, and move on to the next account. Come back to the first after they cycle through all of them, maybe a day later. They don't need to keep going until they find YOUR password, they just need to keep going till the find ANY password. Then start again.

Like lsbcal notes, some of my financial sites are leaving cookies on my computer, and when I try to log on from a different computer it sees that I don't have the cookie from the latest log on, and starts asking the security questions. Maybe the viruses can get into the cookie jar, though I would assume this is encoded?

-ERD50

 

[whitestick]

ERD50,
It is fairly obvious the bad guys have it in for PayPal so I think PayPal is responsible to offer me another layer of security free if they want me to continue doing business with them.

I can undestand your feelings from a user perspective, however, this is a topic that I have been deeply involved with, for my MegaCorp. In that role, I can tell you that the cost to implement and operate that two-factor key is significantly higher then the PayPal charge of $5 per user. Matter of fact, from the costs that i have been looking at to implement a bare bones similar implimentation, I would question if their CFO had knowledge of their providing a service like that for such a low price. I believe that the charge is primarily to cover the cost of shipping and handling, which as we know for a commercial account is not free.
Personally, as soons as I was able to purchase the token from PayPal, I placed my order, and thought it a bargain.
IMHO.

 

[ERD50]

An example of poor practice from a legitimate business

I got an email from my CC company today. I am 99% sure this is legit, but have not checked yet. I'm going to post a portion of it here (with links and ID removed for safety - but in blue font):

If you are concerned about the authenticity of this message, please click here or call the phone number on the back of your credit card and reference the <snip> If you would like to learn more about e-mail security or want to report a suspicious e-mail, click here

Note: If you are concerned about clicking links in this e-mail, the <snip> services mentioned above can be accessed by typing www.<snip>.com directly into your browser.

This is really stupid. They are conditioning people to click links in an email they get. Just because it has the company name, does not mean it is legit. You should ASSUME it is fake, and follow their second suggestion - go to the site directly. They should not even spell out the URL in the email, they should do like they did with the phone # ' call the number on your card or statement'.

There should not be an "IF' about it - DO NOT CLICK from an email!

Stupid, stupid, stupid. - ERD50

 

[chinaco]

... Having a separate user name from what is displayed is good, but really no better than requiring a longer password.

X character hidden login ID plus Y character password = public login ID and an (X+Y) length password. No difference.

I follow your logic, but you missed something...

The max length of X and Y together is alway greater than the max length of Y.

Knowing the ids enables the hacker (i.e., software) to focus the attack on valid accounts.

 

[ERD50]

I follow your logic, but you missed something...

The max length of X and Y together is alway greater than the max length of Y.

Knowing the ids enables the hacker (i.e., software) to focus the attack on valid accounts.

Yes, implied (but not stated) was that the new 'Y' password used would be as many char as the old login ID plus the old password.

Weak passwords are bad. I need to put a few of mine on an exercise plan

-ERD50

 

[Dawg52]

From what I understand, Vanguard will not let the user try more then about 3 attempts before deactiviation. If trying from a computer outside the home I think that they ask additional questions that the user has preselected, such as was city were you married in. If other companies aren't using at least this sort of system, it makes you wonder why.

Fidelity does this as well. I actually had someone try to hack into my Fidelity account a few months ago. They informed me of this and closed all my accounts and established new ones. I established new passwords and user names too.

I was on the last leg of my old computer so I got a new one at the same time all this occurred. I had a virus I couldn't get rid of so I dumped it. Just didn't trust it anymore. I make sure I get anti-virus updates and run scans frequently now.

Just got through changing all user names and passwords with all financial institutions I use. Just can't be too careful anymore.