eBay Developer Important Security Update - Oh Please!
10 August 2009
EventHorizon1984
In the article "Passwords compromised for eBay developers," Chris Dawson of TameBay wrote:
- "eBay have identified a possible security flaw and are requiring all developers update their passwords."
- "The developer blog reports that eBay have recently identified a means by which someone could have" "gained access to eBay Developers Program account information."
We're not surprised this happened. The surprise is eBay in public admitting a "security flaw".
The equivalent of code monkey felgercarb can be found in this security announcement from the eBay Developers Program blog, regarding the "possible security flaw":
Important Security Update: developer.ebay.com
Posted by Laurel Kline in Critical Notes from Tech Support, Business News & Developer Website
Monday, Aug.10.2009, 3:06 PM PT
This is Kumar Kandaswamy, and I manage the eBay Developers Program. I'd like you to read this important message about account safety.
The safety and security of the eBay Developers Program is a top priority. While we believe that people are basically good, we also must live with the reality that there are fraudsters out there who have made it their illicit "profession" to find ways to exploit others on the Internet.
Occasionally, fraudsters attempt to gain unauthorized access to the eBay Developers Program. eBay has recently identified a means by which someone could gain access to eBay Developers Program account information. This type of access DOES NOT allow the capture of financial or other sensitive information, such as credit card or bank account information or Social Security numbers. Fortunately, we have not detected any unusual activity with any Developer account.
Out of an abundance of caution and to help ensure the security of the eBay Developers Program, we are requiring that all developers take the following steps:
- Take advantage of our new, stricter password standards and change your eBay Developers Program (developer.ebay.com) passwords. It is not necessary to change eBay (www.ebay.com) passwords.
If you believe you or your customers have been the victim of fraudulent activity, contact us immediately at developer-relations@ebay.com.
Sincerely,
Kumar Kandaswamy
There's much unintentional eBay humor with the statement from Kumar Kandaswamy that "safety and security of the eBay Developers Program is a top priority." Because historically that has not been the case.
Follow us.
Once upon a time Sergiu Daniel Popa was brought to the attention of the public by Dan Browning of the Star Tribune. As reported in his article "Suspect in 'phishing' scheme indicted":
- "A Romanian immigrant was indicted Tuesday in federal court in Minneapolis on charges that he operated a computerized "phishing" scheme for several years that raked in financial records and personal identification from thousands of individuals"
- "Sergiu Daniel Popa, 20, of Shelby Township, Mich., was indicted on three counts"
Days later there would be a post about the article on the eBay Stores Forum. This was followed quickly by eBay user ID spopa2006 stating, "Listen guys. I am Sergiu D. Popa. I am that horrible guy!" and "I will make your life a hell." And much much more.
When this activity and background was reported to eBay, their reponse was to delete the spopa2006 posts. He was able to keep his eBay account active. If you look quickly, you can view his Feedback Profile as of 11 August 2009 01:07 GMT.
This all would be rather uninteresting save for the fact that spopa2006 was a poster on the eBay Developer forums:
- "Hey there. I wrote a similar project in C++ by using pointers. However, the implemented network interface i used in C++ is no longer supported and I am not a C# guru as I am in c++. Tell me whether or not you got your solution. You can email me at gam30v3r2007@yahoo.com"
The activities of a registered eBay Developer. You know the ones who work on the software that eBay buyers and sellers use.
Feeling that "safety and security" yet?
Oh, and did we forget to mention that this took place in 2007? For those interested we kept the details in a June 2007 article, Sergiu D. Popa Response To Dan Browning Star Tribune Article.
Well there is innocent unless proven guilty.
BAMM!! But wait, there's more.
In October 2008 Dan Goodin followed up with "Romanian national cops to $700,000 phishing trip":
- "Who's your underworld Popa?"
- "22-year-old Romanian national has admitted he participated in a US-based phishing operation that raked in some $700,000 over a three-year period."
- "Sergiu Daniel Popa, who for the past seven years has lived in New York and Michigan, pleaded guilty in federal court in Minneapolis to two felonies related to the scheme. He faces a maximum of 10 years in federal prison and a fine of $500,000."
- "FBI agents began their investigation of Popa in early 2005."
Kumar Kandaswamy is crowing about protection from "fraudsters attempt to gain unauthorized access to the eBay Developers Program", but described here is a convicted hacker who eBay gave Developer Program access?
With spopa2006's regular eBay account active, you have to wonder if his Developer Program access remains active. And if he gave others access to his account, during his extended absence.
Kumar Kandaswamy said, "we have not detected any unusual activity with any Developer account".
Oh, Please!
How many times does a warning have to be given to eBay before someone listens?
And given the lax vetting process, one really has to wonder if there are other "Popa's" signed up to the Developer Program?
.
"So, people hire you to break into their places... to make sure no one can break into their places?"
"It's a living." Martin Bishop, Sneakers (1992)
//
//
//
Technorati Profile

EventHorizon1984 WeBlog Log

Event Horizon 1984
eCRATER EventHorizon1984
Amazon EventHorizon1984




Woot!


"Come to think of it", eBay Lifted the Heineken Advertising Slogan
2 November 2009
EventHorizon1984
It's been a long time since we've heard the phrase "Come to think of it". Not the "new" eBay ads flooding the market with "Come to think of it, eBay." But the Heineken slogan noted by Lucious Van Der Kreig on Auctionbytes."
"Come to think of it,
I'll have a Heineken."
Founded in 1864 by Gerard Adriaan Heineken, Heineken is "Europe's largest brewery."
Perhaps ironically you can find this 1986 color advertisement, "COME TO THINK OF IT ~ I'LL HAVE A HEINEKEN! 1986 AD" for sale by seller Woods_Elf on eBay.
.
"If there is something to steal, I steal it."
Pablo Picasso
//
Addendum
4 November 2009
A little extra digging turned up this gem.
The rest of the very very short article states the initial advertising budget was $12 million. Adjusted for inflation that would be about $28 million now.
One wonders how much eBay spent to copy an existing successful advertisement.
//
Addendum
6 November 2009
Yes, at this point we're merely having fun. After all eBay and it's compensated representatives are now spinning "Come to think of it" is a common idiom and essentially free for the taking.
Anyone know the name Mal MacDougall?
Here's to you Mr. Mal "Come to think of it, I'll have a Heineken" MacDougall.
.
"I'm never surprised when the gods of advertising remind me once again that there is nothing permanent in the business but change."
Mal MacDougall
.
Technorati Profile


EventHorizon1984 Blog Log
//
Posted on 02 November 2009 at 12:52 in Business, Commentary, eBay, Legal | Permalink | Comments (0) | TrackBack (0)
Technorati Tags: 1864, AuctionBytes, brewery, Come to think of it, eBay, Gerard Adriaan Heineken, Heineken, Mal MacDougal, The New York Times Philip H. Dougherty, Woods_Elf
Digg This | Save to del.icio.us