3 ms·

EBay in 2017 was a giant shitshow (and probably still is, but I don't use it anymore). Both their security and support are complete trash, even if you happen to

EBay in 2017 was a giant shitshow (and probably still is, but I don't use it anymore). Both their security and support are complete trash, even if you happen to be lucky (like me) and they reply quickly. I woke up one morning to get an email notification thanking me for purchasing a back bumper, a wing, and a few other parts for a 2012 Hyundai Genesis, which I obviously don't have and neither have I made that purchase. The fraudster even put their real delivery address and name less than 20 miles away from where I lived (which I reverse searched and confirmed that the name was associated with that address). I immediately notified eBay about this, they refunded me the purchase, and asked me to change my password. I did all that, removed the perp's address from the account, but eBay didn't have a legitimate 2FA solution, so I was kinda out of luck here. Lo and behold, the day after, I wake up to info on my account (name+address) changed again. They couldn't change the email, as I have 2FA on my email account, but they did everything they could aside from that with my eBay account. This repeated at least one more time afterwards. By the end of this saga, I just gave up and closed my eBay account after getting my refund. I just did some googling, and it seems like eBay STILL doesn't support any form of 2FA aside from SMS-based one (which is exactly how, I suspect, they got into my account in the first place, as I didn't get my email compromised). What a shame, but oh well.

_underfl0w_ 7y ago
This is really bad advice, but remember that two can play at this game. You have this idiot's real name and address, as well as the make and model of the car they drive. Food for thought.
- filoleg 7y ago
  The story is a bit more complicated (but not by much), however, there is absolutely nothing I can do here. What am I gonna do, show up to some address in South Atlanta demanding whoever lives there to stop using my eBay account without authorization? And that's with the strong assumption that the person whose name and address was used is the same person who actually accessed my account (for all I know, the person living at that address could be totally unaware). EBay has all the info on the perp, but they decided to do nothing, and I am not going to start a civil lawsuit because of $1.2k that got refunded to me pretty much instantly. Just for the sake of satisfying my own curiosity, I looked further (back when it all happened) into the person who hacked into my account and found some interesting stuff. The perp took some measures to cover their steps, but it was done very poorly: 1. The name and address used for the purchase belonged to a woman who lived at the address used for delivery in South Atlanta (verified that). I decided to check her social media, and saw that she held a job as a nurse or something like that, with nothing suspicious pointing at her actually being the perp. Her account looked pretty "professional" and normal. 2. Suspiciously enough, she didn't even have a Hyundai Genesis car, which is what the parts were ordered for. But then I noticed something interesting. 3. There was a guy appearing in a lot of her pics that looked like he was her bf. He didn't seem to have a job listed anywhere on any of his social media. He did, however, happened to own a 2012 Hyundai Genesis coupe. Also, most of his FB profile pics were either selfies or of his car or of him brandishing guns (mostly in his bedroom, all while displaying poor trigger discipline), which is not really damning on its own, but in the context, it definitely doesn't play in his favor. Which leads me to a reasonable hypothesis that the guy who got access to my account used the name and address of his gf to ship the car parts he fraudulently bought, so that she takes the fall in case the authorities decide to investigate.
  - justanotherc 7y ago
    Also as you alluded to, it doesn't sound like someone worth confronting at his house lol.
    - Infernal 7y ago
      Friends don't let friends confront fraudsters with poor trigger discipline.
- gefh 7y ago
  Quite possibly an innocent address the fraudster is using as a dead drop.
  - filoleg 7y ago
    Yup, that's as much as I confirmed myself, if you take a look at my other comment in the thread. It seems like the fraudster used the name and address of his gf as the shipping info.
sireat 7y ago
How were they able to read eBay's SMSs sent to your phone number? A number of online services I use send SMSs as a form of 2FA. Apparently this is not entirely safe.
- filoleg 7y ago
  Sim-cloning is a very popular technique for this, but it is far from being the only commonly used technique to get around SMS-based 2FA. 2FA through SMS isn't safe, and while it is better than no 2FA at all, it is just barely better than none. If you are curious to find more info, there is a lot of writing that has been done on this topic. I am very impartial to Brian's writing on security topics, and he has at least one post regarding SMS-based 2FA [0]. 0. https://krebsonsecurity.com/2018/08/reddit-breach-highlights-limits-of-sms-based-authentication/#more-44585 https://krebsonsecurity.com/2018/08/reddit-breach-highlights...
  - deleted 7y ago
    [deleted]

_underfl0w_ 7y ago

This is really bad advice, but remember that two can play at this game. You have this idiot's real name and address, as well as the make and model of the car they drive. Food for thought.

filoleg 7y ago
The story is a bit more complicated (but not by much), however, there is absolutely nothing I can do here. What am I gonna do, show up to some address in South Atlanta demanding whoever lives there to stop using my eBay account without authorization? And that's with the strong assumption that the person whose name and address was used is the same person who actually accessed my account (for all I know, the person living at that address could be totally unaware). EBay has all the info on the perp, but they decided to do nothing, and I am not going to start a civil lawsuit because of $1.2k that got refunded to me pretty much instantly. Just for the sake of satisfying my own curiosity, I looked further (back when it all happened) into the person who hacked into my account and found some interesting stuff. The perp took some measures to cover their steps, but it was done very poorly: 1. The name and address used for the purchase belonged to a woman who lived at the address used for delivery in South Atlanta (verified that). I decided to check her social media, and saw that she held a job as a nurse or something like that, with nothing suspicious pointing at her actually being the perp. Her account looked pretty "professional" and normal. 2. Suspiciously enough, she didn't even have a Hyundai Genesis car, which is what the parts were ordered for. But then I noticed something interesting. 3. There was a guy appearing in a lot of her pics that looked like he was her bf. He didn't seem to have a job listed anywhere on any of his social media. He did, however, happened to own a 2012 Hyundai Genesis coupe. Also, most of his FB profile pics were either selfies or of his car or of him brandishing guns (mostly in his bedroom, all while displaying poor trigger discipline), which is not really damning on its own, but in the context, it definitely doesn't play in his favor. Which leads me to a reasonable hypothesis that the guy who got access to my account used the name and address of his gf to ship the car parts he fraudulently bought, so that she takes the fall in case the authorities decide to investigate.
- justanotherc 7y ago
  Also as you alluded to, it doesn't sound like someone worth confronting at his house lol.
  - Infernal 7y ago
    Friends don't let friends confront fraudsters with poor trigger discipline.
gefh 7y ago
Quite possibly an innocent address the fraudster is using as a dead drop.
- filoleg 7y ago
  Yup, that's as much as I confirmed myself, if you take a look at my other comment in the thread. It seems like the fraudster used the name and address of his gf as the shipping info.

sireat 7y ago

How were they able to read eBay's SMSs sent to your phone number? A number of online services I use send SMSs as a form of 2FA. Apparently this is not entirely safe.

filoleg 7y ago
Sim-cloning is a very popular technique for this, but it is far from being the only commonly used technique to get around SMS-based 2FA. 2FA through SMS isn't safe, and while it is better than no 2FA at all, it is just barely better than none. If you are curious to find more info, there is a lot of writing that has been done on this topic. I am very impartial to Brian's writing on security topics, and he has at least one post regarding SMS-based 2FA [0]. 0. https://krebsonsecurity.com/2018/08/reddit-breach-highlights-limits-of-sms-based-authentication/#more-44585 https://krebsonsecurity.com/2018/08/reddit-breach-highlights...
- deleted 7y ago
  [deleted]