Recent Hacked eBay Accounts - The Conspiracy Theory?

nightswimmer

As some of you may be aware, over the past few days there have been a large number of eBay accounts hacked (link provided by Soolin).

eBay have stated that this was done by people using the usual phishing techniques. Apparently however, there are some who are saying that this is just further proof that there is a serious security flaw with eBay's network.

The Register has an article about it here:

http://www.theregister.co.uk/2007/02/20/ebay_conspiracy/

I'm not one to believe conspiracy theories but just in case it's of interest, I thought I'd pass the link on.

nightswimmer

As a followup, The Register has printed some e-mails they have received from their readers on this topic:

http://www.theregister.co.uk/2007/02/22/conspiracy_letters/

rdwarr

Bear in mind that many people use the same ID and password for a lot of their online activities. So if there's been a successful hack into an online retailer then eBay will often follow a few days later.

soolin

I am always surprised by how many people post both on here and more commonly on other sites asking whether a recent email they have received (and usually responded to) is real or not. There appears to be a huge amount of people who do still fall for common phishing mails and as rdwarr suggests many people also use identical or similar passwords for everything. Whilst I am a bit of a lover of conspiracy theories (landing on the moon..huh!) I am still inclined to believe that this is nothing more sinister that basic key logger programmes or lack of security by users.

I am also never impressed by people in the industry (and I know a few) who start their emails with 'I'm a PC programmer and would never fall for a scam', I ony have to look at my inbox to see how many urban myth scare stories and fake virus alerts they sound round to everyone in their address books to know that they are often not as good as they think they are.

Omertron

As always, I think there's some people that will respond to phishing attacks and unscrupulous people can get accounts that way. However, I had my eBay account hacked in June last year and I know for certain that they had not got my password as it is a very strong password and unique to eBay. I'm always extremely careful with any accounts that involve money.

I was lucky that I had notification of listings turned on and was at the PC when the 50 handbags were listed on my account.

frivolous_fay

A very strong password doesn't help you if you're phished!

soolin

I also think we need to upgrade the warning thread as I think the phishers are trying to be more subtle. I had an email last week to my main email account associated with my main selling id. The email supposedly from paypal was spelt well, looked good, but much more worrying for those less savvy was actually addressed to my correct name in full.

To me it was still obvious it was a phish not least of which it asked me to double check my changes to a debit card I had recently added to my account (and I hadn't), but the use of my real name, as opposed to the name I use online was a worry. I suppose this could be a double edged scam, get my name through real sources, maybe a previous transaction or even via another website, and then use that to give weight to a phish.

nightswimmer

soolin wrote:

I also think we need to upgrade the warning thread as I think the phishers are trying to be more subtle. I had an email last week to my main email account associated with my main selling id. The email supposedly from paypal was spelt well, looked good, but much more worrying for those less savvy was actually addressed to my correct name in full.

I had one of those a few months ago.

I think it has got to the stage where both eBay and PayPal should no longer put any links within their e-mails whatsoever. There's no need for them to be there.

isthatreduced

I have just changed my password,feeling a tad more secure now.

neilwoods

Still get 2 or 3 of these phishing emails a week but to my old email address, luckly i havent recieved 1 to new email. Most of the time, they get your emails from people you have dealt with, there systems get hacked or they have responded to such an email.

Would be good if ebay and paypal made more of an effort to just tell everyone registered with them old and new, that they should never respond to any email asking for email and paypal details. And if they recieve any message, then they should go directly to the site and log in that way to check any message.

soolin

neilwoods wrote:

Would be good if ebay and paypal made more of an effort to just tell everyone registered with them old and new, that they should never respond to any email asking for email and paypal details. And if they recieve any message, then they should go directly to the site and log in that way to check any message.

Ebay and paypal do tell people that, over and over and over again on every email and on every contact form. Where phishing mails use the same format as a real mail they even carry the 'warning' about not following a link...which I always find amusing.