Is It Safe to Shop On Ebay? What's Going On?

March 10, 2008

Alida Antonia Cornelius



Is it safe to shop on ebay?

 This past week I purchased a couple of harnesses for my pup. I like the old type with the real metal buckles and not the new plastic kind. My dog has already destroyed a beautiful hand made harness a friend gave me. One quick bite and the plastic buckle was broken and the harness was history.

 I had resorted to ebay because you can't find the type with metal buckles in pet stores ANYWHERE anymore. 

Okay, maybe you can find them somewhere, but I have looked in every store in Madison, Indiana and no one carries that type of dog harness. And I couldn't even find them online at dog supply stores. Not even on Pet Smart's site.

 So, if you can't find what you are looking for anywhere else, odds are you can find it on ebay.

 And sure enough, I found two. And for a great price.

 As usual, I paid for them with paypal, as is the method of paying for items on ebay.

 Today, the harnesses were in my mailbox. Two red dog harnesses with shiny metal buckles.  "Aha!" I said to myself, "let her try and destroy these beauties."

 However, a very strange thing happened.

 At 10 PM, I get an email telling me that the seller had shipped them out today and to click on the link to check out the shipping details.  The email contained the exact details of the transaction and the link in it took me to the website for the United States Postal Service. Somehow, the "phishers" had obtained a copy of the shipping email from the seller, forwarded it to me, with the CORRECT HEADER ISP OF EBAY! Now, that's the scary part.  You can't just check the header details to know if the email is a phish or not anymore.


I wondered if something was wrong...I have sold and bought on ebay before.  So, just to be safe, instead of clicking on the links, I forwarded the email to paypal and reported it as a "spoof". 

 (Don't you just love these new terms..."spoof" and "phish"? Where do they get these words? Who makes them up?)

 They replied that is was indeed a phish. A phish is when someone is trying to get your private information by sending you to a fake website where you would use your password. Then they use that information to access your account. I had also reported the email to CERT, the federal government agency and they replied to me that it was a phish and they would be investigating it.

 I have had numerous emails which I new were phishes from ebay before. I always knew they were fake. 

 But, this is the first time I ever had a phish which had all the seller's correct information, address, email address, the whole nine yards.

 Now, I am very good with on-line security. I keep up with all the lastest hacking news. I get regular emails from the federal government agency, CERT telling about the latest vulnerabilities. I have top of the line antivirus and firewall software, even though people say you don't need all that if you have an Apple computer.

 So, how did the hackers get the exact invoice of my transaction this past week?

 That is something entirely new and I think ebay's website may actually have been compromised.

 The strangest thing is that I even checked the ISP numbers in the header of the email and it said that the email WAS from ebay!

 I am waiting to hear from ebay and also paypal.

 Just two weeks ago, I finally convinced myself that I should do online banking and immediately fell in love with how easy it made bill paying. For years, I would not do it, knowing that ONE day, the hackers were going to get my information and clean me out.

 Now, I am not so sure that was a good idea.

 If you shop on ebay, and you use paypal, you better know what you are doing.

 If I had not received those dog harnesses in the mail today, even I, a veteran computer user of 25 years would have been duped.

 Here is a link to the website of Antiphishing.org where you can read about phishing and staying safe on the net. And you can also report phishes to them.

  
http://www.antiphishing.org/ 


 Remember the days when someone asked you if you wanted to go fishing?

 Today if someone asks you that, they may be wanted by the Cyber Crimes division of the FBI.

 Oh, how times have changed. 



(Please read this about the Storm Botnet.  Your computer may be infected. http://en.wikipedia.org/wiki/Storm_botnet)
 
 UPDATE MARCH 11, 2008
From what I have discovered, the first phish happened to the seller in some manner. She clicked on a link in an email from paypal or ebay regarding the sale and it was a fake. Somehow it then sent a phish to me, the buyer. However, it was a good thing the timing was off, or I would have clicked on the link to get the details of the delivery. When the hackers start messing with the United States Post Office, I would imagine that CERT is going to take an extra interest in this type of "phishing". Newer, more sophisticated DNS-changing trojans can be on computers also, which will take users to fake URLs. That could have been the case also which happened to the seller's computer. If you don't have good antivirus software and you don't update your software BEFORE you get on the internet, you shouldn't be buying or selling on any site.
That's all I know for now.