Re: eBay Account Phishing with eBay Redirect

[Nick FitzGerald <nick () virus-l demon co uk>]

Josh Tolley to "Steven":

[re-organized to sensible quoting order]
> > The page actually appears to link to eBay and it does, the link below is 
> > the one I received in my inbox recently.
> >
> > http://cgi4.ebay.com/ws/eBayISAPI.dll?MfcISAPICommand=RedirectToDomain&DomainUrl=http%3A%2F%2F%32%31%31%2E%31%37%32%2E%39%36%2E%37%2FUpdateCenter%2FLogin%2F%3FMfcISAPISession%3DAAJbaQqzeHAAeMWZlHhlWXS2AlBXVShqAhQRfhgTDrferHCURstpAisNRqAhQRfhgTDrferHCURstpAisNRpAisNRqAhQRfhgTDrferHCUQRfqzeHAAeMWZlHhlWXh
> >  
> >
> >
> > Simply:
> >
> > http://cgi4.ebay.com/ws/eBayISAPI.dll?MfcISAPICommand=RedirectToDomain&DomainUrl=www.website.com 
> I just tried this with my own URL, and eBay didn't forward me to some 
> other site. Perhaps they've plugged this already?

That's odd, because the original URL in the spam Steven reported (and 
as seen here earlier) still works, as does the redirector with a 
handful of arbitrary URLs I just plucked from memory.

At least, the redirector works if you put "http://"; (or variously 
encoded forms of the same) at the head of the URL.  URLs of the form 
"www.website.com" as suggested by Steven do not work.

In short, it does work so it's not fixed.

Site designers wanting to implement universal redirector URLs such as 
this (to simplify logging of their own offsite referrals??) should 
limit the redirector to _only_ accept redirects from their own servers. 
And no, using http's "Referer:" [sic] header is not, in general, good 
enough for this, but would help eBay in the short-term against tricks 
such as this phishing scam.  Of course, the modern world of content 
served by third-parties from arbitrarily many or few machines on quasi-
random IPs all round the globe, depending on load and so on, makes this 
_much_ harder to do properly, but that's part of the price you pay for 
using cheap ugly hacks such distributed content serving depends on...


Regards,

Nick FitzGerald