Release of "Anatomy of Online Fraud: How Thieves Targeted eBay Users but Got Stopped Instead"
COLUMBUS, OHIO--(June 20, 2003). Interhack releases "Anatomy of Online Fraud: How Thieves Targeted eBay Users but Got Stopped Instead", a technical report documenting an online fraud case targeted against eBay users. In the past week, two similar fraud schemes have been launched against Best Buy users.
The report should be of interest to users of web sites for commercial activity, developers and operators of such sites, security professionals, and law enforcement officials who need to deal with cases of online fraud.
Available free of charge from Interhack's Web site, the report details how the fraud was committed, how the perpetrators were identified and reported, and how law enforcement officials were alerted.
In a nutshell, it works like this:
- The attacker builds a fraudulent web site that looks just like eBay's.
- The attacker sends email out to eBay users telling them that they need to re-enter their credit card number, giving a link in the email that looks like an eBay link but really goes to the attacker's web site.
- The user logs in to the attacker's web site, using his eBay name and password. The attacker's site will accept anything and store it.
- The user then is told to enter his credit card number, which he presumably does, and the attacker's site saves it.
- The attacker's site shows a "thank you for updating your account" page, and thinks that everything is normal. Meanwhile, the attacker can do whatever he likes as that user on the eBay site, and can use the victim's credit card number for any purpose.
Users can defend themselves against these kinds of schemes simply:
- Do not be rushed -- take the time to think about things if they seem strange.
- Follow established procedure -- beware of anything that urges you to break the normal process in order to speed things along or for any other reason.
- Question things you don't understand -- don't be afraid to keep asking questions until you get a reasonable explanation.
- Verify that you're on the web site you think you are before entering in any information.
There are some good things to note:
- The sender of the email and the web site host were identified quickly
- The fraudulent web site was down a few hours after the fraud started
- Federal law enforcement was easy to reach