eBay/Craigslist Ebay hacked

California · Feb 23, 2007

See
Mysterious 'Vladuz' again hacks eBay employee servers | The Register

A mysterious 'vladuz' is posting to ebays discussion boards using hacked ebay customer-help id's, and boasting about the huge number of recent auctions he diverted. He appears to be able to go into legitimate auctions and add something like "my inbox is full so ask-a-seller won't reach me. Instead email me at [unrelated email id]".

Links in the Register article, and Google searches on 'vladuz', will tell the rest of the story. It appears he can change auctions so that pay-it-now goes to his Paypal account rather than the auction seller's. Here's an Auctionguild story describing how the owner of an account discovered his auctions modified, and how his research led him to vladuz:
The Auction Guild Inc - ebaY Insider Hijack Scam?

This is a developing story, I don't have all the details.

As for us, I don't think I would send any payment or deposit for a tractor ahead of seeing it in person, until this gets resolved.

Taiser · Feb 23, 2007

WOW!!!

dougj7 · Feb 23, 2007

I had 2 of my auctions hacked into last week. Someone was able to retract all of the bids except the 1st bid. Legitimate bidders were emailing me asking why their bids were retracted. I ended up getting in touch with ebay and they confirmed a third party had access to my auctions and was able to manipulate them. Ebay cancelled both auctions and had me change my password. I have been using ebay since April of 1999 and this is the first time my auctions were hacked. Ebay needs to take some of its profits and invest in better security.

California · Feb 23, 2007

dougj7 said:
a third party had access to my auctions and was able to manipulate them.

It looks like ebay is suddenly wide open for massive fraud. For example new users can only list a limited number of auctions, but a new user bypassed the control and listed 3500 scam auctions. Thousands of scam auctions have appeared simultaneously in a format that needs to be input manually, which should be impossible.

A site that tracks ebay noted other major problems. See:
FireMeg.com News Blog: February 2007 and look at the 2/22 entry.

I became interested when I noticed nearly all the hits on my canned search (equipment, limited to 200 mile radius) had no location specified and they all looked slightly similar. My ask-the-seller notes got no replies from these bashful equipment dealers.

The usual scammer flags weren't present ('email me off ebay') but this was an obvious change in the complexion of ebay equipment auctions. Something is going on, and it appears the usual warnings need to be updated. As I noted above, I wouldn't send a confirming deposit on anything before I saw it in person.

Glowplug · Feb 23, 2007

Holy cr@p!!

slowrev · Feb 23, 2007

I have never bought enything off Ebay. And don't plan to. I deal with dealers and local auctions.
I do buy stuff over the internet, but only from known dealers.

I have been involved in the bleeding edge of Tech for many years and know it is not foolproof.

n8wrl · Feb 23, 2007

I guess my concern now is PayPal, which eBay owns. I have no idea what relationship the systems have, but now we're talking about bank account access.

Builder · Feb 23, 2007

My L-39 auction was just hacked into. The "buy it Now" option was selected for $29,900. I thought the tractor was sold, but the ****** simply stole my information and started his own auction. Now Ebay says I owe $335 dollars for an item that never sold. I'm disputing the fraudulent sale and think I'm done with Ebay for good after this one.

Too many fraud buyers. It's a shame because it used to be an effective place to sell. I had pretty good results up until then.

Lynkage · Feb 23, 2007

L39Builder said:
My L-39 auction was just hacked into. The "buy it Now" option was selected for $29,900. I thought the tractor was sold, but the ****** simply stole my information and started his own auction. Now Ebay says I owe $335 dollars for an item that never sold. I'm disputing the fraudulent sale and think I'm done with Ebay for good after this one.

Too many fraud buyers. It's a shame because it used to be an effective place to sell. I had pretty good results up until then.

Time to move to craigslist. At least the users have the ability to flag ads that are most likely fraud!!

tallyho8 · Feb 23, 2007

If your auction was hacked it is usually because you gave your password to someone on a phishing expedition.

They send you phony emails that look like they come from ebay with links to follow to answer. When you click the link it looks like a regular ebay sign-in page asking for your id and password. The second you sign-in they got ya! Don't ever sign in to any links from an email to ebay or paypal. Always go directly to their main website and sign in. If you ever forget and sign-in to a site from an email then go directly to that site and change your password.

I have well over 1000 deals on ebay and have never had a problem. Ebay has a lot of security features for you to follow for best results. Visit their security center for lots of guidelines.

CDsdad · Feb 23, 2007

Sounds like ebay has measures in place to maintain security. Also sounds like either their measures are inadequate, or are more trouble than they are worth. I'll keep it simple and shop local or make a road trip myself. I'm sure plenty of people enjoy ebay and have no trouble. They don't need me.

California · Feb 23, 2007

tallyho8 said:
If your auction was hacked it is usually because you gave your password to someone on a phishing expedition.

No.

This is new. This 'vladuz' appears to have an ability to walk through walls. He is adding his own 'email me for BIN' into active auctions of experienced ebayers and even programmers who would never fall for a phishing email. His ability to list thousands of auctions simultaneously, in a format that requires manual input and should take days, is another example.

Take a look at the Auctionweb and Firemeg links I posted above. This isn't simple phishing. The Auctionweb story indicates vladuz has been selling his hack program for nearly a year now. Its a real mess.

Builder · Feb 23, 2007

They might have a lot of security & features, but not everyone is 100% sure how to use them. You have to do a lot of reading & practicing to not get burned.

If you look at the discussion forums on Ebay, you'll see thousands of users who've been hijacked, stolen from and just given up.

I never gave anyone my passwords, I know how to watch out for phishing.

stones · Feb 23, 2007

Things like this has just put me off of Ebay for good.... Never bought anything I have not looked at and not going to start now... it might of been a good tool to use a year ago but the risk are just not worth it now. Security measures or not the risk is just not worth what I would get... buying or selling.

Todd_C · Feb 23, 2007

There have been numerous sites hacked this year. The technology the hackers are using is scary. I hate to sound grim, but there just is no way to protect your identity anymore.

greenedeere · Feb 24, 2007

2 years ago a seller on e-bay did not send a pay pal paid for item, e-bay did nothing to help or refund.Then someone posing as my wife on e-bay auction using her account somehow????? won a bid on item, e-bay e-mailed us.They closed our account,closed down pay pal account,then held @$980.00 for 5 days.I had to call e-bay security several times a day to get any thing done.I finally called my bank to find out when my account had been freed up,e-bay still has the account frozen,pay pal will still not clear this up,so e-bay is not used by us any longer.

Builder · Feb 24, 2007

greenedeere said:
2 years ago a seller on e-bay did not send a pay pal paid for item, e-bay did nothing to help or refund.Then someone posing as my wife on e-bay auction using her account somehow????? won a bid on item, e-bay e-mailed us.They closed our account,closed down pay pal account,then held @$980.00 for 5 days.I had to call e-bay security several times a day to get any thing done.I finally called my bank to find out when my account had been freed up,e-bay still has the account frozen,pay pal will still not clear this up,so e-bay is not used by us any longer.

That's horrendous. The worst part about them, is you can't get help immediately from them. Someone could be cleaning you out and you can't do anything.

Lynkage · Feb 24, 2007

here is a phone # for Paypal. 402-935-2017

greenedeere · Feb 24, 2007

I'll add this also, even though we stopped using them we still get e-mails from time to time from them of suspecting someone using our account.Warning us of the possibilities of all bad things that could happen.I did every thing possible at each time to talk to a "LIVE" warm body but never have.E-mail , phone calls for this type of problem, where you need help, has a system in which you follow their instructions step by step.The problem was there is no category in which we fell, guessing(A:they have never had this to happened before to need assistance(B:they would have to go out of their way to help admitting something went wrong and it was their fault(C:BOTH.Even by using a seperate Bank/VISA account a long PIN# and all the extra security measures,some how it did happen.If you could hire the thief to help e-bay/paypal to catch or to prevent this they probably would have to pay a mint for the service or could never hire anyone from the simple fact it would be to honest of a job and not nearly as much fun.