11 ms·

EBay under pressure as hacks continue

57 points by GotAnyMegadeth 12y ago

roywiggins 12y ago
Does anyone else remember when Flash could execute arbitrary Javascript in the containing page? That was super fun. Attempting to sandbox user-supplied Javascript just seems like an exercise in futility.
- daenz 12y ago
  > Attempting to sandbox user-supplied Javascript just seems like an exercise in futility. You just need to run the javascript in a interpreter written in javascript /sarcasm >> EDIT: oh god it's real https://github.com/mozilla/narcissus https://github.com/mozilla/narcissus
  - Igglyboo 12y ago
    Wait what? Wouldn't a js2js interpreter just be eval()??? How is this more than a joke project?
    - roywiggins 12y ago
      eval() calls the interpreter that's running the current code with some arbitrary string. The code that's interpreting it is not Javascript; you can't poke around and change it without recompiling whatever binary it is. Implementing Javascript in Javascript lets you quickly play with new features: you can add features to the toy interpreter more easily than nodejs. There's a long tradition of self-hosting compilers: C is compiled with programs that were written in C. PyPy is a Python interpreter written in Python (actually RPython but it's a subset of Python). http://en.wikipedia.org/wiki/History_of_compiler_construction#Self-hosting_compilers http://en.wikipedia.org/wiki/History_of_compiler_constructio...
Kenji 12y ago
"When customers clicked on a listing that had been compromised, they were brought to a sophisticated, official-looking site that asked victims to log in and share bank account details." Please. One glance at the URL ("vip-ohota.com.ua") and the fact that it's not SSL reveals that something fishy is going on. This is very, very basic, even non-tech people should look at the URL when they enter their information. You wouldn't tell a stranger your credit card number, you'd make sure you're talking to the right person.
- vegardx 12y ago
  A listing shouldn't take you out of Ebay. It's that simple. Ebay needs to fix this issue, yesterday. Non-tech savvy users don't always know what to look for, especially not when they're following what should be legitimate links.
- nwh 12y ago
  It's unreasonable to expect that of people. URLs are maddeningly maddling to parse even if you know what is going on, if you don't it's almost impossible to explain it. Why is ebay.com.au different to ebay.com.au.edgesuite.net, should I worry if I see that? Why is edgesuite alright for hosting the images on? It's a rabbit warren of edge cases and exceptions that defied all normal levels of explanations.
  - Kenji 12y ago
    If it's unreasonable to expect that of people, it's unreasonable of people to expect security.
    - ZeroMinx 12y ago
      Disagree. We technical people instinctively know there's a fundamental difference between those 2 domains. Normal people don't. And why should they? We (tech people) have to get the situation to a point where we don't expect normal people to have to know all these silly details. I'm not doing anything to help achieve this, I'm hoping other people are :)
yuhong 12y ago
Yea, it is funny that PayPal has a security bug bounty program but eBay don't. I think you can thank David Marcus and Bill Scott of PayPal for that.
Robadob 12y ago
The previous bbc article regarding this never stated that ebay allows users to embed javascript and flash into listings. No wonder they are having issues with xss.
- makomk 12y ago
  As far as I can tell they're not having problems with XSS. The listing description is actually an iframe served from a different domain with no access to anything on the eBay website. This appears to be a straightforward phishing attack.
  - yaeger 12y ago
    So, if I were to go to such a site with noscript activated, I would be okay? I mean, noscipt would probably set up to allow ebay.com so the site actually works, but this different domain will most likely be blocked, yes?
DanBlake 12y ago
Why is eBay not using sandboxed iframes for the auction description/content? You dont need JS to make amazing looking listings. Just look at all the customized subreddits with crazy stuff going on utilizing just CSS/HTML. All the 'tracking' needed for ebay listings could easily be done with a pixel as well.
- philo23 12y ago
  I was just about to comment that sandboxed iframes aren't really well supported but it seems like I'm completely wrong, they're much better supported than I expected http://caniuse.com/#feat=iframe-sandbox http://caniuse.com/#feat=iframe-sandbox Still it would leave a fair chunk of users with IE 9 or older no better than they are right now.
ufmace 12y ago
> The vulnerability centres around users' ability to place custom Javascript and Flash content into their listings pages. Wait, what? Is that true? If so, how could anybody think that allowing the user to place custom Javascript in their listing pages is a good idea in this day and age?
- pessimizer 12y ago
  It was common before facebook, and at this point businesses are built on it.
  - deleted 12y ago
    [deleted]
- Igglyboo 12y ago
  I have no idea, it was incredibly annoying on myspace. It's still used on tumblr but thankfully not as much as on myspace, people still include autoplaying music players however....
- yaeger 12y ago
  Really surprised to hear they still allow that. I haven't done business with eBay in years. Way back when, I felt pretty smart when discovering that I could just add extra pictures I served from some other webspace into my listings. Because eBay would charge you extra if you wanted to add more pictures. But I always thought that if people can add anything to such a listing, how is that different than visiting some malware invested site? Just add the payload and you have a website distributing your malware and all you need to do is choose a popular item to sell and you immediately have a very large audience.

Does anyone else remember when Flash could execute arbitrary Javascript in the containing page? That was super fun. Attempting to sandbox user-supplied Javascript just seems like an exercise in futility.

daenz 12y ago
> Attempting to sandbox user-supplied Javascript just seems like an exercise in futility. You just need to run the javascript in a interpreter written in javascript /sarcasm >> EDIT: oh god it's real https://github.com/mozilla/narcissus https://github.com/mozilla/narcissus
- Igglyboo 12y ago
  Wait what? Wouldn't a js2js interpreter just be eval()??? How is this more than a joke project?
  - roywiggins 12y ago
    eval() calls the interpreter that's running the current code with some arbitrary string. The code that's interpreting it is not Javascript; you can't poke around and change it without recompiling whatever binary it is. Implementing Javascript in Javascript lets you quickly play with new features: you can add features to the toy interpreter more easily than nodejs. There's a long tradition of self-hosting compilers: C is compiled with programs that were written in C. PyPy is a Python interpreter written in Python (actually RPython but it's a subset of Python). http://en.wikipedia.org/wiki/History_of_compiler_construction#Self-hosting_compilers http://en.wikipedia.org/wiki/History_of_compiler_constructio...

Kenji 12y ago

"When customers clicked on a listing that had been compromised, they were brought to a sophisticated, official-looking site that asked victims to log in and share bank account details." Please. One glance at the URL ("vip-ohota.com.ua") and the fact that it's not SSL reveals that something fishy is going on. This is very, very basic, even non-tech people should look at the URL when they enter their information. You wouldn't tell a stranger your credit card number, you'd make sure you're talking to the right person.

vegardx 12y ago
A listing shouldn't take you out of Ebay. It's that simple. Ebay needs to fix this issue, yesterday. Non-tech savvy users don't always know what to look for, especially not when they're following what should be legitimate links.
nwh 12y ago
It's unreasonable to expect that of people. URLs are maddeningly maddling to parse even if you know what is going on, if you don't it's almost impossible to explain it. Why is ebay.com.au different to ebay.com.au.edgesuite.net, should I worry if I see that? Why is edgesuite alright for hosting the images on? It's a rabbit warren of edge cases and exceptions that defied all normal levels of explanations.
- Kenji 12y ago
  If it's unreasonable to expect that of people, it's unreasonable of people to expect security.
  - ZeroMinx 12y ago
    Disagree. We technical people instinctively know there's a fundamental difference between those 2 domains. Normal people don't. And why should they? We (tech people) have to get the situation to a point where we don't expect normal people to have to know all these silly details. I'm not doing anything to help achieve this, I'm hoping other people are :)

yuhong 12y ago

Yea, it is funny that PayPal has a security bug bounty program but eBay don't. I think you can thank David Marcus and Bill Scott of PayPal for that.

Robadob 12y ago

The previous bbc article regarding this never stated that ebay allows users to embed javascript and flash into listings. No wonder they are having issues with xss.

makomk 12y ago
As far as I can tell they're not having problems with XSS. The listing description is actually an iframe served from a different domain with no access to anything on the eBay website. This appears to be a straightforward phishing attack.
- yaeger 12y ago
  So, if I were to go to such a site with noscript activated, I would be okay? I mean, noscipt would probably set up to allow ebay.com so the site actually works, but this different domain will most likely be blocked, yes?

DanBlake 12y ago

Why is eBay not using sandboxed iframes for the auction description/content? You dont need JS to make amazing looking listings. Just look at all the customized subreddits with crazy stuff going on utilizing just CSS/HTML. All the 'tracking' needed for ebay listings could easily be done with a pixel as well.

philo23 12y ago
I was just about to comment that sandboxed iframes aren't really well supported but it seems like I'm completely wrong, they're much better supported than I expected http://caniuse.com/#feat=iframe-sandbox http://caniuse.com/#feat=iframe-sandbox Still it would leave a fair chunk of users with IE 9 or older no better than they are right now.

ufmace 12y ago

> The vulnerability centres around users' ability to place custom Javascript and Flash content into their listings pages. Wait, what? Is that true? If so, how could anybody think that allowing the user to place custom Javascript in their listing pages is a good idea in this day and age?

pessimizer 12y ago
It was common before facebook, and at this point businesses are built on it.
- deleted 12y ago
  [deleted]
Igglyboo 12y ago
I have no idea, it was incredibly annoying on myspace. It's still used on tumblr but thankfully not as much as on myspace, people still include autoplaying music players however....
yaeger 12y ago
Really surprised to hear they still allow that. I haven't done business with eBay in years. Way back when, I felt pretty smart when discovering that I could just add extra pictures I served from some other webspace into my listings. Because eBay would charge you extra if you wanted to add more pictures. But I always thought that if people can add anything to such a listing, how is that different than visiting some malware invested site? Just add the payload and you have a website distributing your malware and all you need to do is choose a popular item to sell and you immediately have a very large audience.