EBay Hackers

[tommy.irene]

www.itv.com/news/story/2014-05-21/ebay-users-urged-to-change-passwords-after-hacking/      .http://www.bbc.co.uk/news/technology-27503290

[colic2bullsgirlore]

Apparently the hacked details have been and still are available for purchase on the deep web/darknet or whatever you

want to call it (pastebin)....

http://mashable.com/2014/05/22/ebay-users-at-risk-after-cyberattack-change-passwords/

Many password-reset questions involve a birthday, phone number and physical address. At the very least, this sort of data would make it easy for criminals attempting to bypass security settings. It could also be used to aid identity-theft schemes.

" It's shocking that names, phone numbers, dates of birth, email addresses and home addresses were not only not encrypted — but stored in plain text. And keep in mind, this data is not optional. In order to sign up for an eBay account, a user must provide a name, address and phone number. If you want to sell anything on eBay, you must provide a birthdate showing you are over 18. So for those 145 million active eBay accounts, users had no choice of what information to give the company. It's shocking that eBay would choose not to encrypt that kind of sensitive information "

Already, as researcher Ashkan Soltani notes, at least one person claims to be selling the alleged user database.

The person in question wants 1.453 BTC (about $753) in exchange for access to a supposed 145,312,663 unique

records.

But it seems to be a fake, based on eBay's response:

[azureline**]

The info I saw says the passwords are encrypted?

[colic2bullsgirlore]

Yes..... and.... the hackers have had from late February to the second week in May to unencrypt them.

but your personal information was not encrypted in any way

To reset any remote  internet site password a hacker would minimally need

your full name

your date of birth

your street address

your telephone number

your email address

Ebay has compromised 148,000,000 full names, dob, street addresses, tel numbers and email addys.

your ebay username and mine  has been inextricably linked to our RL names, addresses.phoine numbers and email

addresses............regardless off how many times you change your ebay password......... your ebay user name will,

until/unless you close your account, forever be linked on the hacked data files to your RL name your address your

phone number and an email address..................

an absolute gold mine as the story stated for phone scammers to gain your "trust' to release more sensitive information.

the change of ebay password is a "trogan horse" in that it does SFA in addressing the nux of the data breach

[colic2bullsgirlore]

Ebay is trying to fob off the real reason for the cyber attack.... the reason was not to gain access to your password..... the

personal information gained was the trophy...... the passwors encryption is a red herring to make you feel good.

The plain fact is ebay was entrusted to keep my personal details secure. I was required to give them those to initiate my

account. They assured me my details were secure but they have failed to protect them and short of gaining a new persona

they can never be made secure again.

[azureline**]

What do you suggest they should do?

[bright.ton42]

Don't know if this has been clarified or not - but a strong password consists of -

Lowercase letters

symbols

numbers

Upper case letters.

It doesn't have to be that long either if it contains all those. 

[imastawka]

I noticed mine was strong when the box was blank,  lol

[clickbaitoz]

It sort of worries but then theres not much point seeing as i lost my wallet a few years ago with all my id in it  In comparison this is just like 'oh well', So far i've had no issues but then again i haven't tried to apply for a loan etc, anyone trying to do that in my name probably wouldn't have much luck anyway lol I did cancel my bank cards & file a police report within the hour though so at least if anything dodgy does happen i have that as backup, not sure how much good it would do though.

It constantly amazes me when i hear of some of these hacking stories just how little security we really seem to have when we entrust some of these corporations with our personal information. If they don't even encrypt the data,, its like leaving your house unlocked so a burglar can let themselves in, actually its more like inviting them for a cup of tea!

[colic2bullsgirlore]

---

@azureline** wrote:

What do you suggest they should do?

---

A.As far as ebay account security goes. Allow a onetime ebay username change where my old ebay username is

hidden rather than being recorded as they are at the moment. so that my ebay username again becomes 'anonymous'

to my RL  details save for ebay and the ebayers who commit to purchase off me.

ie change my ebay username from Colic2bullsgirlore to freephartingpigs with the old username recorded on my id history as

*******************

This would for the main inhibit scammers realigning my ebay username with my personal details and make my ebay

account a little more secure than it is now

(unless I did something stupid like changing my username to Colic2bullsgirlore* which would make it easier for

scammers to connect)

B. EBAY SHOULD ENCRYPT MY PERSONAL DETAILS (AND OTHER SENSITIVE INFORMATION) THAT EBAY IS

ENTRUSTED WITH NOW.......... 

C. ebay should remain responsible for the financial loss that I may incur from

their lack of security ie... exhibit contrition rather than their normal aloof ways

How's that for a start???