Questions remain about eBay members' info theft

There are many unanswered questions about a data theft of information about eBay members.

Questions abound over the posting of confidential information from eBay members on one of the vendor's discussion forums, a sinister incident that has many of the online marketplace's buyers and sellers worried.

Although eBay has provided some information about the brazen dump of member data that happened early this week, it's not known who the culprit is nor how and when this person obtained the information.

Even more troubling: What has this "malicious fraudster," as eBay describes the person, already done with the names, addresses, member IDs and possibly credit card numbers of at least 1,200 eBay buyers and sellers?

Moreover, is this person still exploiting whatever hole, trick or vulnerability led him to the data? Does he have data on just the 1,200 members listed or possibly on many more?

"What makes this a big deal isn't just the amount of data compromised, but rather that this involves eBay," said computer security expert Mark Rasch, managing director of technology at FTI Consulting.

As the world's largest online marketplace, eBay stores financial data on millions of users and its platform is used to transact billions of dollars in sales. "Irrespective of the scope [of the data breach], the target makes it significant," Rasch said.

This much is known: On Tuesday morning, someone posted confidential information on about 1,200 eBay members in the company's Trust & Safety discussion forum.

Based on the initial reports of frantic users on this long thread, it appears that the "fraudster" posted data for about one hour until eBay shut the forum down.

Hours later on Tuesday, an eBay spokeswoman confirmed the incident and said the vendor knew for a fact that the information wasn't obtained by breaching eBay's security systems, suggesting instead that the culprit stole the information from others via methods such as phishing.

However, many users have expressed skepticism in the forums over eBay's prompt declaration that its systems weren't hacked into. Rasch shares this skepticism.

"I'd be reluctant to declare six hours after [such an incident] that my systems weren't breached, unless I definitely knew what had happened or had already caught someone," he said.

There can be many ways for someone to obtain this confidential data, including hacking a system and tricking individuals into disclosing the information via phishing, he said. It could also be a case of an inside job perpetrated by a disgruntled or corrupt employee at eBay or elsewhere with access to a database containing this data.

"EBay has to thoroughly and comprehensively investigate this and keep people advised of what it finds and take corrective actions," Rasch said.

This doesn't mean that eBay must provide hourly updates on the progress of its investigation, he said. However, eBay must at some point publicly close the loop on the incident and explain the scope of the damage and the causes.

It's unclear if eBay intends to reveal more details about the breach. Beyond the spokeswoman's comments on Tuesday, the only other eBay statement on the matter is an official blog post made a few hours after the incident.

By press time, eBay hadn't responded to several requests for comment.

Jonathan Garriss, executive director of the Professional eBay Sellers Alliance, agrees that eBay must inform users about the issue.

"EBay really needs to address this publicly at some point and say where the leak came from," said Garriss, also CEO of Gotham City Online, an apparel store on eBay. That way, buyers and sellers will feel that the issue was addressed and remedied.

It's clear that the data thief, in addition to profiting from the compromised information, also wanted very much to embarrass eBay by using the vendor's discussion forum for security issues as the vehicle for the data disclosure. "It was very brazen and very public," Rasch said.

On Tuesday, the eBay spokeswoman said that the credit card numbers disclosed didn't match with the ones eBay has on file for the affected members.

This brings up another question: Even if the numbers don't match the members, does eBay know if those numbers are nonetheless valid? Once data is posted on a public Web site, it must be assumed that others with malicious intentions copied it.

"The bottom line is that this data is in the hands of people who shouldn't have it," Rasch said.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Juan Carlos Perez

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?