2 ms·

For the hack to work, the victim's computer had to get a cookie from ebay. The widget caused this cookie to get downloaded to the victims computer, but only thi

For the hack to work, the victim's computer had to get a cookie from ebay. The widget caused this cookie to get downloaded to the victims computer, but only this cookie. Normal visits from legitimate users get everything on the page. Adding a small invisible file meant that a normal user would get this file as well as the cookie but the malicious widget would only grab the cookie. Finding out how many IP's were legit vs bogus was then a simple matter of going through the http logs making sure all gets of the cookie had matching gets of the gif. Cookie gets without gif gets were fraud.

Sujan 14y ago
With cookie-stuffing the cookie is normally "generated" by loading a page in an invisible iframe. The loaded page is actually the same you would land on if you clicked normal advertising, with "everything on the page" - including an invisible gif. Visibility or Invisibility of the iframe doesn't change anything to the loading of this file. That's why it doesn't make sense to me. Or did they use another method to place the cookie I don't know about?
- kybernetyk 14y ago
  You could trigger cookie setting with the img tag. <img src=http://affiliate-link-to-ebay.com&#62 http://affiliate-link-to-ebay.com> would set the cookie on most browsers. I don't know if that works anymore because my "affiliate" time is well long over but I guess this loophole has been fixed long since. IIRC iframe was a little problematic with some websites as they had frame break out scripts [1] - so you had to be creative. The golden wild west times ... I somehow miss them. Money was lying on the information super highway - you just had to pick it up ;) [1] something like http://www.thesitewizard.com/archive/framebreak.shtml http://www.thesitewizard.com/archive/framebreak.shtml
  - Sujan 14y ago
    Ebay didn't use frame breakers, so much I know ;)
- a5seo 14y ago
  The user might have received the one pixel "trap" cookie, but the article says they were watching to see users who only visited 1 page, since "normal" users click around and look at a few pages. If you only get the hidden pixel once, that's a sign you aren't normal. It will be interesting to see how this goes in court since you cannot prove that any given single user was NOT a "real" user. But on the whole, the traffic smells wrong. I don't understand why eBay didn't just ban the users when they suspected foul play. Trying to prove this criminally beyond a reasonable doubt would have been hard.

Sujan 14y ago

With cookie-stuffing the cookie is normally "generated" by loading a page in an invisible iframe. The loaded page is actually the same you would land on if you clicked normal advertising, with "everything on the page" - including an invisible gif. Visibility or Invisibility of the iframe doesn't change anything to the loading of this file. That's why it doesn't make sense to me. Or did they use another method to place the cookie I don't know about?

kybernetyk 14y ago
You could trigger cookie setting with the img tag. <img src=http://affiliate-link-to-ebay.com&#62 http://affiliate-link-to-ebay.com> would set the cookie on most browsers. I don't know if that works anymore because my "affiliate" time is well long over but I guess this loophole has been fixed long since. IIRC iframe was a little problematic with some websites as they had frame break out scripts [1] - so you had to be creative. The golden wild west times ... I somehow miss them. Money was lying on the information super highway - you just had to pick it up ;) [1] something like http://www.thesitewizard.com/archive/framebreak.shtml http://www.thesitewizard.com/archive/framebreak.shtml
- Sujan 14y ago
  Ebay didn't use frame breakers, so much I know ;)
a5seo 14y ago
The user might have received the one pixel "trap" cookie, but the article says they were watching to see users who only visited 1 page, since "normal" users click around and look at a few pages. If you only get the hidden pixel once, that's a sign you aren't normal. It will be interesting to see how this goes in court since you cannot prove that any given single user was NOT a "real" user. But on the whole, the traffic smells wrong. I don't understand why eBay didn't just ban the users when they suspected foul play. Trying to prove this criminally beyond a reasonable doubt would have been hard.