No, the drama around the eBay breach is not over. Beyond probes by government agencies, a security researcher now says a second flaw could be used to hijack member accounts at the online auction platform.
According to Jordan Lee Jones, a college student in the United Kingdom, there’s a second vulnerability that remains open to hackers. Jones said he notified eBay via e-mail on Friday and got no response. He has published what he calls the “eBay cross-site scripting code” on his blog.
Here’s the backstory: Last Tuesday, eBay asked users to change their passwords in the wake of a cyberattack that compromised one of its databases. Unfortunately, it was a database that included eBay customers' names, encrypted passwords, e-mail addresses, physical addresses, phone numbers and dates of birth.
The PayPal Connection
We caught up with Dwayne Melancon, chief technology officer for Tripwire, to get his take on the unraveling eBay data breach story. He told us it appears the hack involved securely encrypted passwords, which makes it more difficult to gain access to users' eBay accounts en masse because it would require brute force decryption of passwords. But then he continued with a “however.”
“However, the fact that user e-mail addresses, physical addresses, and dates of birth were taken in the breach is more concerning,” Melancon said. “Criminals could use that information to masquerade as eBay customers on other sites, or perhaps use that information to 'social engineer' their way into users' other accounts on other services. Unlike the passwords, the other user-specific information was not encrypted and therefore easily reused by attackers.”
What does Melancon suggest? For starters, eBay users should be required -- not simply asked -- to reset their passwords. What’s more, password complexity rules should be in place to ensure users select complex passwords, he said. He also charged individual users with making sure they are not using the same passwords on various sites.
The PayPal Connection
eBay was careful to stress that PayPal was not involved in the breach. Nevertheless, Melancon noted that many eBay users also have their accounts connected to PayPal -- which eBay owns -- for payments. For that reason he’s also recommending that customers tap into PayPal’s two-factor authentication feature, which verifies your identity before you make a payment. In fact, he said it’s a best practice even without the eBay breach.
“eBay users have long been a popular target for phishing e-mails, and users must be especially wary during incidents like this,” Melancon said. “To be safe, users should not click on links in e-mails about eBay security or password changes. Instead, they should type the eBay URL directly into their browsers and log into the site that way to prevent disclosing their credentials to spoofed, malicious copies of the eBay site.”
With the Federal Trade Commission's increased emphasis on establishing a responsible standard of care for information security, Melancon believes we will see more of these investigations. He said this kind of scrutiny will help move enterprises away from so-called silver bullet security solutions, and toward defense-in-depth security.
“A well-designed security program hinges on foundational security controls that ensure that organizations know what is on their network, understand the risks and vulnerabilities in place, are able to enforce strong security configuration policies, and are able to continuously monitor the state of their systems, applications, and data to quickly identify suspicious changes or events," Melancon concluded.