new wave of phishing attacks against eBay

A new wave of phishing attacks against eBay is exploiting a clever combination of wildcard DNS records and cross-site scripting (XSS) vulnerabilities to use other people’s websites to help steal credentials from victims.

The first attacks using this combined method of wildcard DNS records and XSS were detected by Netcraft on February 10th, although the source code behind the attacks suggest that the planning had begun a day earlier. The attacks have continued to the present day, and the fraudulent eBay login form remains accessible through the wildcard domains.

Fraudsters launched the attack using a number of sites that host vulnerable versions of iRedirector Subdomain Edition. This PHP and MySQL based system allows website owners to use wildcard DNS records on their domains to forward subdomains like http://user.example.com to URLs like http://www.example.com/members/~username.

A cross-site scripting vulnerability on the affected iRedirector sites is allowing the fraudsters to inject framesets into specific pages. These framesets load content from one of the fraudsters’ websites hosted in France at http://df0x.54.pl, which in turn loads an iframe located at http://0xdc4bdd88:88/ws/eBayISAPI.dll/. This injected iframe presents a fraudulent eBay login page, which prompts the victim to submit their eBay User ID and Password to a site hosted by Sudokwonkangnambonbujang in South Korea.

Because the vulnerable sites can be accessed via wildcard DNS records, the fraudsters have made the attacks look all the more convincing by making the hostnames look similar to those used by the genuine eBay login page. For example, the attack has used many hostnames that are similar to this:

phishing address

phishing address

The hostnames used in these attacks also contain a seemingly random string of hexadecimal digits. These are simply MD5 hashes of small integers. It is likely that this semi-random measure is being used to try and bypass simplistic firewalls or email filters, which may not recognise fraudulent URLs if part of the hostname changes.

The unobtrusive methods used in the current wave of attacks have obvious appeal to fraudsters — the wildcard DNS records mean that it’s easy to use arbitrary hostnames for each attack, allowing each vulnerable site to be convincingly used for many different targets. Furthermore, there is no need for the fraudsters to fully compromise a website, as the cross-site scripting vulnerability allows the fraudulent content to be placed on the sites without gaining internal access to the server. Finally, all it takes is a simple Google search to find additional sites with the same vulnerabilities. The combination of these factors makes it entirely feasible to automate the whole process.


Sursa
2009-02-18 15:15:52



Comenteaza





Ultimele 25 posturi adăugate

05:14:05ECOU DE LA PONT —» Leo Butnaru
19:34:07James Rickards – Sold Out —» APort | "Pentru un român care știe citi, cel mai greu lucru e să nu scrie." I.L. Carag
12:39:49ESG: noua paradigmă în responsabilitatea socială corporativă —» Efrosnatalita’s Blog
09:57:53Fericirea stă în lucruri mici! —» Sunt MAMĂ!
09:52:13Micile și marile bucurii ale lunii martie-aprilie 2024 —» Sunt MAMĂ!
21:41:02Ce cărţi bune am mai citit (17) —» APort | "Pentru un român care știe citi, cel mai greu lucru e să nu scrie." I.L. Carag
15:05:25DIN VITRALIU # 60 (IV) —» Leo Butnaru
05:10:43DIN POEZIA AVANGARDEI UCRAINENE —» Leo Butnaru
05:29:37POEME DIN „MIȘCAREA LITERARĂ” —» Leo Butnaru
05:52:50DIN REVISTA „MIȘCAREA LITERARĂ” —» Leo Butnaru
19:36:37Râde cel care râde la urmă. Veronica Dragalin pare hotărâtă să lupte pe bune cu corupția, cu sau fără sediu propriu —» Nicolae Federiuc
09:19:40Școala de vară cu pregătire olimpică la fizică 2024 —» Fizica pentru Moldova
05:29:36DIN VITRALIU # 60 (III) —» Leo Butnaru
15:24:55Primarul incită la ură, rezolvă problema apei cu ușa încuiată —» Curaj.TV | Media alternativă
15:00:22Plantează și îngrijește pomi la marginea capitalei —» Curaj.TV | Media alternativă
14:45:48Șantier poluant, lăudat de poliția locală a lui Ciucu —» Curaj.TV | Media alternativă
14:43:01Pajiștea, la fel de importantă ca pădurea —» Curaj.TV | Media alternativă
13:47:34Întâlnirea bibliotecarilor – bucuria cititorilor —» BiblioCity
05:18:35Concursul literar „La izvoarele înțelepciunii” dedicat vieții și activității literare a poetului Vasile Romanciuc —» BiblioCity
05:02:48Găsiți-l și cereți-i cartea cu autograf – Vă va înfrumuseța prezentul și, mai ales, viitorul —» BiblioCity
05:01:58Răsărit literar la Biblioteca „Mihail Ciachir” —» BiblioCity
04:53:38DIN VITRALIU # 60 (Nr. 2) —» Leo Butnaru
21:46:51Vampiru’ deputat —» APort | "Pentru un român care știe citi, cel mai greu lucru e să nu scrie." I.L. Carag
19:06:25El Dorado —» Andrei LANGA. Blogul personal
15:36:13În trecere —» APort | "Pentru un român care știe citi, cel mai greu lucru e să nu scrie." I.L. Carag