eBay Developer Important Security Update - Oh Please!
10 August 2009
EventHorizon1984
In the article "Passwords compromised for eBay developers," Chris Dawson of TameBay wrote:
- "eBay have identified a possible security flaw and are requiring all developers update their passwords."
- "The developer blog reports that eBay have recently identified a means by which someone could have" "gained access to eBay Developers Program account information."
We're not surprised this happened. The surprise is eBay in public admitting a "security flaw".
The equivalent of code monkey felgercarb can be found in this security announcement from the eBay Developers Program blog, regarding the "possible security flaw":
Important Security Update: developer.ebay.com
Posted by Laurel Kline in Critical Notes from Tech Support, Business News & Developer Website
Monday, Aug.10.2009, 3:06 PM PT
This is Kumar Kandaswamy, and I manage the eBay Developers Program. I'd like you to read this important message about account safety.
The safety and security of the eBay Developers Program is a top priority. While we believe that people are basically good, we also must live with the reality that there are fraudsters out there who have made it their illicit "profession" to find ways to exploit others on the Internet.
Occasionally, fraudsters attempt to gain unauthorized access to the eBay Developers Program. eBay has recently identified a means by which someone could gain access to eBay Developers Program account information. This type of access DOES NOT allow the capture of financial or other sensitive information, such as credit card or bank account information or Social Security numbers. Fortunately, we have not detected any unusual activity with any Developer account.
Out of an abundance of caution and to help ensure the security of the eBay Developers Program, we are requiring that all developers take the following steps:
- Take advantage of our new, stricter password standards and change your eBay Developers Program (developer.ebay.com) passwords. It is not necessary to change eBay (www.ebay.com) passwords.
If you believe you or your customers have been the victim of fraudulent activity, contact us immediately at [email protected].
Sincerely,
Kumar Kandaswamy
There's much unintentional eBay humor with the statement from Kumar Kandaswamy that "safety and security of the eBay Developers Program is a top priority." Because historically that has not been the case.
Follow us.
Once upon a time Sergiu Daniel Popa was brought to the attention of the public by Dan Browning of the Star Tribune. As reported in his article "Suspect in 'phishing' scheme indicted":
- "A Romanian immigrant was indicted Tuesday in federal court in Minneapolis on charges that he operated a computerized "phishing" scheme for several years that raked in financial records and personal identification from thousands of individuals"
- "Sergiu Daniel Popa, 20, of Shelby Township, Mich., was indicted on three counts"
Days later there would be a post about the article on the eBay Stores Forum. This was followed quickly by eBay user ID spopa2006 stating, "Listen guys. I am Sergiu D. Popa. I am that horrible guy!" and "I will make your life a hell." And much much more.
When this activity and background was reported to eBay, their reponse was to delete the spopa2006 posts. He was able to keep his eBay account active. If you look quickly, you can view his Feedback Profile as of 11 August 2009 01:07 GMT.
This all would be rather uninteresting save for the fact that spopa2006 was a poster on the eBay Developer forums:
- "Hey there. I wrote a similar project in C++ by using pointers. However, the implemented network interface i used in C++ is no longer supported and I am not a C# guru as I am in c++. Tell me whether or not you got your solution. You can email me at [email protected]"
The activities of a registered eBay Developer. You know the ones who work on the software that eBay buyers and sellers use.
Feeling that "safety and security" yet?
Oh, and did we forget to mention that this took place in 2007? For those interested we kept the details in a June 2007 article, Sergiu D. Popa Response To Dan Browning Star Tribune Article.
Well there is innocent unless proven guilty.
BAMM!! But wait, there's more.
In October 2008 Dan Goodin followed up with "Romanian national cops to $700,000 phishing trip":
- "Who's your underworld Popa?"
- "22-year-old Romanian national has admitted he participated in a US-based phishing operation that raked in some $700,000 over a three-year period."
- "Sergiu Daniel Popa, who for the past seven years has lived in New York and Michigan, pleaded guilty in federal court in Minneapolis to two felonies related to the scheme. He faces a maximum of 10 years in federal prison and a fine of $500,000."
- "FBI agents began their investigation of Popa in early 2005."
Kumar Kandaswamy is crowing about protection from "fraudsters attempt to gain unauthorized access to the eBay Developers Program", but described here is a convicted hacker who eBay gave Developer Program access?
With spopa2006's regular eBay account active, you have to wonder if his Developer Program access remains active. And if he gave others access to his account, during his extended absence.
Kumar Kandaswamy said, "we have not detected any unusual activity with any Developer account".
Oh, Please!
How many times does a warning have to be given to eBay before someone listens?
And given the lax vetting process, one really has to wonder if there are other "Popa's" signed up to the Developer Program?
.
"So, people hire you to break into their places... to make sure no one can break into their places?"
"It's a living." Martin Bishop, Sneakers (1992)
/*
Silencing the Lambs - eBay Cuts Voices Roster
Silencing the Lambs - eBay Cuts Voices Roster
26 August 2009
EventHorizon1984
It's that time of year when rosters get cut in professional Football. In that same vein eBay has taken to slashing it's eBay Voices lineup from 130 to 100.
According to an AuctionBytes article "Is eBay Phasing out 'Voices' Focus-Group Program?", the person "responsible for Voices, eBay Senior Manager of Seller Development "responsible for Voices" Garnor Morantes said:
Incidentally, detouring a bit. If you're thinking "focus group??", here's something we pulled (sort of) at random:
Mary Marczak & Meg Sewell
Unfortunately eBay doesn't quite get how not to use focus groups:
And someone is ignoring the disadvantages:
"I do not think it means what you think it means."
Indigo Montoya, The Princess Bride (1987)
.
This roster cut has produced some consternation from eBay Voices members.
For example eBay perennial favorite PowerSeller Marty (clact (5147)) made his usual flurry of correct and incorrect statements. Or as he described other people doing the same thing, "all the BULL$&*@ in these comments". Such as:
This individual should consider that they're wrong on two counts. According to eBay CEO John Donahoe eBay is moving in the right direction. And about that focus groups myth? Check out this old interesting article.
Business Week
Shoot The Focus Group
14 November 2005
As you might expect, the reaction of eBay Voices members posting comments to the AuctionBytes article "eBay Silences Founding 'Voices' Members" varied. Some of the posts read:
When Voices was founded, it's members were actually helpful to the employees in forming programs.
The past several years, many members felt that they were nothing more than "lab rats" as ebay measured reactions to already made decisions.
When the administrator of the program, Garnor Morantes, has to remind members to be positive about their comments and admit that he's hesitant about opening up the comments for all employees to view...they do not want to hear what they need to know...they want to hear what they want to hear...
Signed...former Voices member
Those who are being removed this week will be sorely missed. Those who were involuntarily removed in the past (or resigned under obvious pressure to do so), not so much.
eBay is a business. It is not evil. I don't believe that JD is evil. Somehow someone got the idea that eBay would care more about the community than its own financial health. That will never happen.
Grow up. If it works for you, fine; if not, then shut up and move on. Be responsible for your own situation and stop blaming someone else.
We each gave up years of our time and advice I personally would have charged clients tens of thousands of dollars for...all to HELP my fellow sellers. But we were met with petty jealously from the more unbalanced eBay'ers who always knew better yet accomplished nothing.
I finally left when there was too much of a difference of opinion between myself and one individual who was running the program.
I will tell you I gave them the Health Insurance thing for Power Sellers and argued that they were asking sellers to commit themselves full time to selling and eBay had the resources to help organize a group insurance program. eBay LOVED the idea...unfortunately the INSURANCE INDUSTRY refused to come up with a real health insurance program. Still the options which came the ashes of a well intentioned program, which eBay genuinely put a LOT of man hours into trying to develop, but what rose was at least a very decent Rx discount program that saves me over $400/mo on medications and even more if I was willing to take some of the more dangerous meds to help slow down the progression of my primary health issue...Meg overstated the scope of the program at eBay Live 1 but at the time she was unaware of the final denial from the insurance carriers...still there is value in the program. I take pride in knowing I was a motivating voice behind something to potentially help millions of people save even more millions on many aspects of their health care needs.
Another personal feature of the site that was exclusively mine and I gave it to the lead programmer free because I was never going to be able to develop feature on a site as my serious programming days were behind me and I had a parent who needed me as her caregiver. And that feature is the Best Offer, I designed it, talked to Mark about it and eBay made a few changes but developed one of the most used features on the site...and no I never was paid or asked for compensation. But eBay added it after my disagreement with the then coordinator of Voices...and it was over something very stupid on my part but I am a stubborn bastard when I am in the mood...and boy was I in the mood...hehehe...
We came up with the idea of annual convention type events moved around the country...this because eBay Live. It would have worked had eBay held the community together with real mods rather than farming it all out...big error on their part...
You also have no idea who many ideas we stopped cold in their tracks during conference calls. You should have been a fly one the wall when we gave a top to bottom dressing-down to UPS VP's when they were trying to gain exclusive access to eBay sellers of all other carriers. Sellers in antiques and collectibles can tell you that UPS might be the single worst carrier in terms of delivery, obtaining signatures as paid for (drives can just drop boxes even if a sig is required when the area is designated as a drop and go area...this would destroy the needed signature for PP Seller Protection.) We pointed out that there was no such thing as a one size fits all.
We were strongly influential in getting sellers to be required in revealing all fees in their listings. Shipping, handling and insurance. Our compromise was in lieu of limits which are impractical because a seller in NY has higher staff overhead than one on small town USA. So, our suggestion was a compromise (eBay was against revealing or limiting...) but we pushed and argued very cogently for simple declaration of any fees. before us there was no rule and sellers often raised fees if items sold under value.
We fought with PayPal when they tried to take away the 1.5% cash back for using the PP Debit card...they wanted to eliminate ALL cashback programs...I for one told PayPal directly that should they remove that program I would not use their service...I am no large seller, but I had an ace in the hole as did every member of our group, we had the ear of the community on the eBay Boards, each of us in a different board. While we alone might not have saved the program, we planted the seed of doubt that cutting the program would potentially wreck eBay's recently acquired PayPal. Again earning millions of funds for millions of sellers...but we were "yes men/women".
I am sure there will be those who know exactly who I am from my comments...and those people will also know I honest to a fault...and I take crap from nobody, and every member of our group was the same way, each in their own way. Two of us were more vocal but the others were just as resolute unwilling to compromise beyond a certain point where sellers and/or buyers would be harmed.
I have the utmost respect for my fellow members in our Voices group...we worked hard for everyone of us, we did nothing in a self serving fashion...but there were those out there who felt because we were legally bound to not disclose these things we were 'assimilated'. I personally put my eBay account at risk in standing up for what I though was right...yet I say cowards with posting ID's bitching like 8yr old school girls about us, eBay and the lack of decent tinfoil for their hats.
I guess you can say I stopped caring. I stopped caring about eBay as a company as well as my fellow eBay'ers...now a decade later, I care only for my buyers and give them the best of the best in service and respect. Something the whiners have not clue about...
I have a personal list of eBay execs who I have the utmost respect for...the believed in the small community the level playing field and all the things which eBay was...but unfortunately, they lost the battle.
I will point out two....Maynard Webb and Bill Cobb. Yeah, many of the whiners thing those two were just horrible people...having actually looked them in the eye, spent hours in person with them and one the phones, they are honest and decent people. There are easily 50-100 people at eBay I still remember that had the best intentions. Sadly, the decisions from the very top, did some serious damage. I also know the people who believed in the community, they either gave up hope to feed their families or left eBay.
After our eBay group basically the program was changed and significantly watered down. Still that does not mean the members were in it just for themselves and to say they were part of eBay...those sorts were actually weeded out pretty early.
No matter what the antagonists say, I know what I did personally and what my group did as a whole...and we did GOOD.
The single regret I had was we were unable to convince eBay to move eBay Live Listings out of the core or at least into their own sub area in each category. but eventually we were proven right because many remained vocal and kept pointing out the ethically questionable aspects of Live Auction format and their mixing in with regular listings.
I know this was not well written but I needed to express that in our early groups there were a couple special teams (we really became a team and ours was as cohesive a team as I have ever worked with, and we never knew each other before Voices, well I knew one member of my group and she was one of the stellar members who was in it for us ALL not herself...
I also have bent, but likely not broken my NDA but after a decade since I signed it, I feel things have changed enough to live with someone "peeing in the cheerios" a bit in order to set a few things straight.
I know the anger will come back..it always does, but if you examine the eBay ID's of those people you will find proof of their lack of stability revealed in how they deal with customers.
Ina knows me and knows who I am...and I know w/o her watching eBay for us, we would be caught even more off guard...
Mostly anonymous posts are not truly satisfying, and at this juncture all three of you* may be wondering who are these eBay Voices. While it's possible to piece together a list (as we choose to understand it), that's never happening here. Other than the basic privacy issues involved, that would be just plain rude.
* We jest. It's really four.
For brevity we will stick to speaking of a few members made openly public by eBay. In April 2003.
eBay's "Voices" program...
by Daphne, eBay Staff Member
April 2003
According to The Chatter article since 1999, "Several times a year, eight to ten members are flown to eBay's corporate office in San Jose, California. They are chosen from all levels of eBay's buying and selling community -- from Shooting Stars and PowerSellers, to mom-and-pop sellers, and all levels of buyers." Followed by, " regular conference calls and email discussions".
The writer goes on to say, "Participants sign non-disclosure agreements" and "This confidentiality makes Voices groups a powerful tool". Then Daphne discloses three names.
It's definitely interesting about what became of these three eBay Voices members.
Today seller DrexelAntiques (2175) (member since Nov-12-98) remains an active buyer on eBay, but their last eBay sale feedback was August 29 2003. They have a brick and mortar store.
Today seller Gatorpack (32761) (member since Jan-22-99) neither buys nor sells on this account. The account remains active with an impressive positive feedback of 32,761. Their last eBay sale feedback is dated October 12 2007. They're currently selling online at Gatorpack.com.
Today Giraffer (3020) (member since Jan-19-99) is a "Retired Member eBay's Voice of the Community 10". By eBay Corporate standards they are a small seller. The account remains active in sales and purchases. Giraffer is an active poster on the eBay Discussion Boards. Giraffer is as exuberant about eBay now as she was in 2003.
"any Voices member who thought the group had any real power is just kidding themselves"
former_voice
.
With this small sample showing two out of three eBay Voices sellers gone from eBay, we have to wonder how relevant is eBay Voices to the participants? And do 100 eBay Voices have any relevance to the millions of eBay buyers and the 50+ million active sellers on eBay?
Or is eBay Voices all 'baaaaa' humbug.
.
"You will let me know when those lambs stop screaming, won't you?"
Hannibal Lecter MD, Silence of the Lambs (1991)
/*
Technorati Profile
EventHorizon1984 Log
//
Posted at 23:35 in Commentary, eBay, eBay Customer Service | Permalink | Comments (0) | TrackBack (0)
Tags: AuctionBytes, brecklundin, Business Week, clact, drexelantiques, eBay, eBay Senior Manager, eBay Senior Manager of Seller Development, focus group, former_Voice, Garnor Morantes, gatorpack, giraffer, Is eBay Phasing out Voices Focus-Group Program, Marty, Mary Marczak, Meg Sewell, Morantes, Nancy Leckron, Randy, responsible for Voices, Shoot The Focus Group, Still a Voice, Using Focus Groups For Evaluation, What Me Worry
| Reblog (0)