EBay Exposes Users to Phishing Attack and Data Loss (Video)
Posted by: Timothy Weaver on 02/03/2016 10:14 AM
[
Comments
]
According to Roman Zaikin, a researcher with Check Point, there is vulnerability on EBay that would allow a page to open that could expose user to phishing attacks and data theft.
“As we demonstrated to the eBay security team in the proof of concept, we were able to bypass their security policies and insert a malicious code to our seller page without any difficulty or restriction,” the firm writes.
If a hacker created a store and used a new programming language (JSF**k), eBay would then unknowingly load additional script from the attackers’ own server.
Since JSF**k only uses six different characters – []()!+, and eBay only strips alpha-numeric ones from inside tags, attackers could bypass protections put up by the company.
“This allows the attacker to insert a remote controllable JavaScript that he can adjust to, for example, create multiple payloads for a different user agent,” Check Point writes, adding that an attacker could use it to trick a victim into downloading a malicious app or use the vulnerability to carry out phishing attacks.
Source: ThreatPost
“As we demonstrated to the eBay security team in the proof of concept, we were able to bypass their security policies and insert a malicious code to our seller page without any difficulty or restriction,” the firm writes.
If a hacker created a store and used a new programming language (JSF**k), eBay would then unknowingly load additional script from the attackers’ own server.
Since JSF**k only uses six different characters – []()!+, and eBay only strips alpha-numeric ones from inside tags, attackers could bypass protections put up by the company.
“This allows the attacker to insert a remote controllable JavaScript that he can adjust to, for example, create multiple payloads for a different user agent,” Check Point writes, adding that an attacker could use it to trick a victim into downloading a malicious app or use the vulnerability to carry out phishing attacks.
Source: ThreatPost
Comments
