eBay Hacked, Requests All Users Change Passwords

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
Statements like this, coming from the company that has just been hacked, are kind of funny because they always say the same thing.

eBay says that it has been able to narrow down the attack to "a small number of employee login credentials" stolen by cyberattackers. That provided the attackers access to eBay users' names, encrypted passwords, e-mail addresses, physical addresses, phone numbers, and dates of birth.
Click to expand...
 
This is why you invest in training for employees to prevent these breaches. The weakest link in the security chain is most often the users.
 
Morsx said:
This is why you invest in training for employees to prevent these breaches. The weakest link in the security chain is most often the users.
Click to expand...

It's also a lot easier and better for the bottom line to throw an employee or two under the bus rather than admit your security protocols suck.
 
This happened two months ago! Dam near a day late and a dollar short. Lucky for me, I could give a care less about my ebay account. I will change it, obviously, but I don't understand what the motivation is to do so. That it contains my address? As if that can't be publicly obtained anyhow? We might as well just start expecting this kind of stuff to happen, it's getting so frequent.
 
Parja said:
It's also a lot easier and better for the bottom line to throw an employee or two under the bus rather than admit your security protocols suck.
Click to expand...

Sure, but that can include the network administrators, not just the non-IT staff.
 
ravx25 said:
This happened two months ago! Dam near a day late and a dollar short. Lucky for me, I could give a care less about my ebay account. I will change it, obviously, but I don't understand what the motivation is to do so. That it contains my address? As if that can't be publicly obtained anyhow? We might as well just start expecting this kind of stuff to happen, it's getting so frequent.
Click to expand...

Well.. how much you want to bet that 80% plus users use the same password with their paypal account.

I am surprised that there haven't been an explosion in fraudulent postings.
 
Another thing.. it could have been a precursor to a larger effort.. such as harvesting emails, names, addresses, etc. for a phishing campaign.
 
Good job eBay. Keep hiring idiots in your security division simply because they tout a CISSP certification and a degree from a stupid Indian tech school.
 
ravx25 said:
This happened two months ago! Dam near a day late and a dollar short. Lucky for me, I could give a care less about my ebay account. I will change it, obviously, but I don't understand what the motivation is to do so. That it contains my address? As if that can't be publicly obtained anyhow? We might as well just start expecting this kind of stuff to happen, it's getting so frequent.
Click to expand...

If someone has access to your ebay account, they can change your email information (and link it to a scam/stolen paypal account). Then start selling products, while never shipping anything. By the time eBay and Paypal stop them, they will have transfered the money out and you have the police knocking on your door to arrest you for fraud.
 
So instead of pushing out a site-wide automated forced reset they rely on a press release? That's F-ing unbelievable!
 
cyclone3d said:
Well.. how much you want to bet that 80% plus users use the same password with their paypal account.

I am surprised that there haven't been an explosion in fraudulent postings.
Click to expand...

Oof, then they deserve what they get for making those passwords the same. Frankly, not that it couldn't be garnered somehow/someway, my financial website passwords are different and much stronger than simple sites like Ebay and I never connect sites such as Paypal to them.

nutzo said:
If someone has access to your ebay account, they can change your email information (and link it to a scam/stolen paypal account). Then start selling products, while never shipping anything. By the time eBay and Paypal stop them, they will have transfered the money out and you have the police knocking on your door to arrest you for fraud.
Click to expand...

I can see how that could be a nuisance. Given my sparse history on my years old ebay account, though, it wouldn't take long to see it was complete fraud. Heck, I don't even know how to sell anything on Ebay since I never have done so, hah. I'm sure it's not hard, I've just never done so.
 
Funny story my wife just yesterday had a fraudulent charge from paypal to ebay and nobody at ebay or paypal could figure it out. Then i wake up this morning and see this in the news.

Coincidence or not?
 
i got an email from ebay this morning about changing your password. I did and luckily I don't use the same one for paypal.
 
cyclone3d said:
Another thing.. it could have been a precursor to a larger effort.. such as harvesting emails, names, addresses, etc. for a phishing campaign.
Click to expand...

I would think that one of the best attacks they could do (And probably thought of by now) is to take your e-mail address for the account and send you an e-mail saying ebay was hacked please click here to change your password. If they copy the original email verbatim and send their copy out after ebay does a lot of people will probably assume it was just sent twice and click on the new one (theirs) to go to the "ebay" page to change their password.
 
Ebay need to go out of business.... rampant materialism by selling in virtual garage sale.
 
Wow, 2 months ago. You're really on top of things, eBay!
 
Strange. No notification of any kind when I log into my Ebay account. Since the hash is probably what was stolen I think if you already have a long complex password it's relatively safe.
 
BettiePage said:
does this mean I need to change my paypal log in as well?
Click to expand...

According to the article Paypal is in a seperate Database so it is unaffected. As long they were different passwords you shouldn't need to change it. That said, you're no doubt following best practices and changing your password every 90 days anyway right? :p
 
They never emailed me to change my password but I think I'll do it anyway.
 
My eBay account doesn't have any useful information. It has an e-mail address I only use for eBay, an address of shipping service, a prepaid Visa card and a phone number of my office. Nothing to steal really.
 
These damn companies need to be held accountable for this. Seriously. This is out of control. Every month, there's some new idiot corporation who's been heisted.

The problem is that there's currently no (dis)incentive -- stores will fiercely guard their physical property, but when it comes to customers' "property", they don't give a rat's ass. Why? Because there's no consequence. Not even from a publicity/marketing perspective. No one cares, no one complains, happens all the time.

We need to start raining down lawsuits on these companies to get this under control. Of course, that's the trick -- how do you show actual, tangible damages from stolen data? Hard to quantify.

Realistically, I suppose it's mostly a lost cause -- people don't care about privacy, people don't care about amorphous, non-tangible personal/private data. Out of sight, out of mind. And by the time someone's personal data is used illicitly, the length of time will warrant a disconnection of cause-and-effect from the theft. And even then, it's not like you could really prove that the theft stemmed from Target/eBay/etc.'s heisting.

In other words, this will continue to happen regularly until someone or something bends the corporation(s) over a knee and reddens some cheeks.
 
Cant even change my password due to errors being thrown left and right from eBay. Nice.
 
DogChainX said:
12345
Click to expand...

then shalt thou count to three, no more, no less. Three shall be the number thou shalt count, and the number of the counting shall be three. Four shalt thou not count, neither count thou two, excepting that thou then proceed to three. Five is right out :p
 
They need to tell us when it was patched up or if it was patched up. Fuckin' A. I don't know if it was after I made an account or if it's still a problem, so if I changed my password, it would be pointless or not.
 
BettiePage said:
does this mean I need to change my paypal log in as well?
Click to expand...


Only if you use the same password. Though if your Paypal password is easy to guess from the ebay password they stole it may be safer to change it as well.
 
Finally got an email from Ebay tonight suggesting to change my password. Pathetic...
 
You must log in or register to reply here.
Back
Top