In Jul of 2002 prior to the ebaY acquisition of PayPal TAG wrote,
TAG predicts that once ebaY owns PayPal, ebaY will require all sellers who sell on ebaY must offer PayPal's payment services. Since ebaY has a virtual monopoly in the OAI/OTI, we feel this will be a disaster. ebaY will monopolize the auction and trading market and will now monopolize the online payment system. They will be able to increase prices at will (as they have done with their auction and trading services, despite quarter over quarter record breaking profits). Because of their dominance, they will be able to both require use of PayPal and be able to raise PayPal fees unrestrainedly. They could have attempted this with their own payment system, Billpoint, but TAG feels they would not have dared to do so because they would have had PayPal to contend with, as a lawsuit would have surely ensued. If ebaY owns PayPal, who will there be to challenge them?
This scenario is rapidly becoming a reality. In ebaY's bid to Amazonize ebaY, since Amazon is growing and ebaY isn't, ebaY is forcing more and more sellers to offer ebaY owned PayPal as a payment option. In an even more ominous move, ebaY is now planning on prohibiting ebaY Australia sellers from offering any payment option other than PayPal. The plan is that by 21 May 2008 all AU sellers must offer PayPal as an option, and by 17 June 2008 Australian sellers may only accept PayPal as payment.
ebaY of course, couches this as a "safety" issue, but there is no independent proof that PayPal is any safer than any other payment alternative. Of course if ebaY was as safe as they claim to be (one one hundredth of one percent has been their claim of fraud on their site), then the whole safety argument is moot before it even starts. So they are lying about one or the other as both can't be true.
ebaY said in their announcement, "...those using PayPal were almost four times less likely to have a dispute over their purchase than people who paid with bank deposit. Plus, PayPal sellers were almost half as likely to experience an unpaid item as sellers who did not accept PayPal." Of course the comparison to checks, money orders, cash, merchant accounts etc are not even considered. ebaY can claim whatever they like, but without outside independent audits and confirmation on all types of payment systems, all ebaY's claims are invalid.
You can read the entire announcement HERE or (just in case it is changed or disappeared) HERE ebaY has its plans and sellers have theirs. There has been an outcry of outrage amongst ebaY Australia sellers about this policy change (and the same outcry should resound around ALL ebaY sites, as what happens in Australia will be instituted wherever ebaY can get away with it). Sellers are suggesting real and specific ACTION (as opposed to feel good futile petitions and boycotts), asking other users to complain to the Australian Competition and Consumer Commission which can squelch this move (depending on how susceptible they are to ebaY's "lobbying"). Since ebaY has to apply to the ACCC, for approval, ebaY users can post their comments on ebaY's application Application Complaints and Comments Sellers are moving their auctions to other sites such as OZ Auction , their own websites, and also suggesting political action.
Some posts on ebaY's boards, give advice and provide links to act against ebaY AU. Act against ebaY AU
=========================
Changes announced on eBay.com.au
MEMBERS ALL RING 1300302502 (ACCC) TODAY THEY ARE WORKING NOW!!!
sklhvo1758 (0 ) View Listings | Report 14-04-08 02:31 EST
MEMBERS ALL RING 1300302502 (ACCC) TODAY THEY ARE WORKING NOW AND THEY ARE VERY INTERESTED IN THIS MATTER NOW BECAUSE THERE ARE FLOODED WITH CALLS AND EMAILS FROM EBAY MEMBERS TODAY EVEN THIS MINUTE!!
From: lynne8670 (79 ) View Listings | Report
You've got to love Ebay(not) they make an announcement about changes 2mths out and they haven't even applied to the ACCC(which they have to do) so they can make the changes.
By making the announcement I'm sure Ebay thinks that all the complaints and anti Ebay sentiment will be over when they lodge their application with the ACCC and nobody will be bothered to comment on the application when it appears on the ACCC website http://www.accc.gov.au asking for submissions, which forms part of the process by the ACCC for granting Ebay permission to make the changes.
The best way to stop these changes is to complain to the ACCC by phone or email http://www.accc.gov.au/content/index.phtml/itemId/54217 and to watch the ACCC website for Ebays application and leave comments on that application and if the ACCC gets flooded with the same number or greater than have appeared in this forum then there may be a chance Ebay will be refused permission by the ACCC to implement the changes.
I like others will be leaving Ebay if the changes are made. As a buyer I Direct Bank Deposit for purchases in Aus as it is bad enough to have to wait up to 7days for delivery of purchases in Aus without having to wait an additional 5 to 7 days for funds to clear through Paypal, I only use Paypal for those rare occasions when I purchase overseas
FROM: the-bearoness (502 ) View Listings | Report
Here's a complaint already worded for those like myself who cannot think of the appropriate description of this new policy. [except naughty words ,that is ]
I can only give credit for this to an eBayer from Member to member help board that put it up the other day,thanks to you and sorry I've forgotten your user ID.
Okay guys,GO FOR IT!
********************************
I am filing a complaint over Ebay Australia's decision to restrict payment options and in doing so diminishing choices consumers have.
I believe that if Ebay takes the planned action this will constitute breaches of the Trade Practices ACT, PART IV--RESTRICTIVE TRADE PRACTICES , specifically s.45 & s. 4D.
In the whole, Australian buyers have a fear of handing over credit card details and bank details, which is the requirement when using paypal. There are also others that do not possess either and choose to send money orders.
These planned actions will significantly lessen choices consumers have in dealing with vendors on Ebay. Simultaneously it will force any sellers that do not currently accept paypal to do so or to close their operation on Ebay - essentially forcing them to breach s.45 of the TPA.
This is planned not to provide protection as they claim but to bolster their own bottom line.
There is no valid nor legal reason for Ebay to introduce this change as I currently have the choice to use paypal.
The ACCC has not acted against Ebay's carte blanche attitude in the past which has seen diminished competitiveness for Australians. I implore the ACCC to investigate and take the appropriate action. Signed by
henstoothbooks (4187 ) View Listings | Report 14-04-08 10:24 EST 4 of 15
ACCC is not the only the avenue to complain.
ASIC is also involved as PAYPAL owns an AFSL - This relates mostly to the delay of releasing funds etc however they are also concerned with consumer protection.
Complaints can be made at www.asic.gov.au
gralbow (2399 ) View Listings | Report 14-04-08 10:56 EST 5 of 15
Chris Bowen - Member for Prospect
Assistant Treasurer
Federal Minister for Competition Policy and Consumer Affairs
chris.bowen.mp@aph.gov.au
Parliament House Office
Suite M1 24
Parliament House
CANBERRA ACT 2600
Tel: 02 6277 7360
Fax: 02 6273 4125
Prospect Electoral Office:
115 The Crescent
Fairfield NSW 2165
Tel: (02) 9726 4100
Fax: (02) 9724 6115
Email:
chris.bowen.mp@aph.gov.au
Postal Address:
PO Box 802
Fairfield NSW 1860
=========================
ebaY needs to be pushed to the wall on this action. If they are legally a venue only, they should not be able to dictate to sellers what payment the seller can accept, as long as the payment method or provider is legal, and legitimate. This should be an issue that gets the attention of EVERY ebaY seller and buyer, no matter where the ebaY user is located or what ebaY site the seller or buyer utilizes. What happens on the ebaY AU and UK sites is bound to propagate to the other ebaY sites if ebaY can get away with it. What ebaY users should do NOW is contact consumer protection agencies, anti trust, and competitive governance agencies in their own countries, and pre-emptively ask the question about the legality of a similar move by ebaY in their own countries. In the US, ebaY users should contact their legislative representatives, the Dept of Justice and the Federal Trade Commission, and ask about what protections were put in place when ebaY was allowed to purchase PayPal, or request that some protections be enacted to prevent ebaY from implementing more restrictive trade practices, remove the ones already implemented, and continue to allow users choices in ebaY's virtual monopoly.
Other links of interest on this issue:
Aussies Flock to ebaY Rivals
Petition Against ebaY AU
US Dept Of Justice
Write to - antitrust@usdoj.gov
Federal Trade Commission Bureau of Competition
US House of Representatives - contact your Congressional Rep
US Senate - contact your Senator
Visit the TAG website
Wednesday, April 16, 2008
Saturday, October 27, 2007
A Solution to Get Fraudulent Listings Removed From ebaY FAST
ebaY has always lied about screening their listings to prevent fraud, prior to indexing them to the site. It was a good sounding PR story to cover their asses for their lousy indexing times but obviously false, since anyone outside ebaY can do a simple search of whatever is the scammer key word of the day, and finds hundreds and even thousands of fraud listings.
It is also obvious that ebaY will not now or ever hire the personnel they need to actually monitor their site, unless forced to by the courts or legislation.
Well we have come up with the solution for ebaY. (ebaY - when you read this please note the copyright - We would be glad if you implemented this idea, if you PAY us for it!)
In a nutshell - ebaY should pay their users a bounty for finding fraudulent listings.
To implement it -
1. Set up a live chat category where you have to log in, for reporting fraudulent listings (this is fraud only - not legit listings that might contain a violation of ebaY rules)
2. For every user ID an ebaY user turns in, that has visible fraudulent listing (redirects, overlays, hijacked accounts) ebaY pays the user (we suggest $25. but maybe they should start with $10, then increase as the incidence of fraud diminishes). If ebaY wanted to be really cheap, they could make the money a non expiring coupon only good for use on ebaY via PayPal (to buy items or pay seller fees) - in that way it would be fake money, not really costing ebaY much of anything in real dollars.
3. ebaY would "pay" every user who reports the user ID, and that would be valid until ebaY closes down the fraudulent listings posted by that ID so they were no longer visible on the site. This would motivate ebaY to use trained personnel for this special reporting board, who can recognize fraud when they see it, and close it down ASAP, rather than letting it run for hours, days, weeks, months, like they do now. The user reporting the items can take screenshots time stamped, of their chat and of the ID reported with items showing, to keep track of and prove they made a legit report - just in case ebaY tries to welch out.
4. At the end of the year ebaY could award a real money or stock bonus to the top fraud beaters - those who turned in the most accounts being used for fraud. Great PR.
This benefits ebaY in so many ways it is hard to fathom why they would not do it.
1. They already have the structure for reporting in place.
2. This would get the reports of such items off ebaY's chat/discussion boards, and probably off most of the off ebaY chat boards, as folks would have a reason to report them first BEFORE posting them in the public eye. If ebaY did this correctly, those listings would be gone - both before they could be seen AND before anyone could get taken.
3. Not only would the cost of this be minimal (paying a pittance to users rather than having to actually hire personnel), but they could use it as an actual example of both working with their community and actively combating fraud on their site - rather than just giving lip service to both. ebaY CLAIMS that fraud is less that one hundredth of one percent on their site - so just think how little this would cost them for so many tangible benefits.
4. This would clean up such fraudulent listings FAST. Currently ebaY tends to punish (threaten and suspend) users who report too much fraud, especially those who post about it on the ebaY chat boards. This generates lots of hostility, and is self defeating for ebaY, generating plenty of bad press. This idea eliminates all those negative factors.
ebaY - get moving! You know TAG's phone number, call and we can negotiate a price for this idea!
It is also obvious that ebaY will not now or ever hire the personnel they need to actually monitor their site, unless forced to by the courts or legislation.
Well we have come up with the solution for ebaY. (ebaY - when you read this please note the copyright - We would be glad if you implemented this idea, if you PAY us for it!)
In a nutshell - ebaY should pay their users a bounty for finding fraudulent listings.
To implement it -
1. Set up a live chat category where you have to log in, for reporting fraudulent listings (this is fraud only - not legit listings that might contain a violation of ebaY rules)
2. For every user ID an ebaY user turns in, that has visible fraudulent listing (redirects, overlays, hijacked accounts) ebaY pays the user (we suggest $25. but maybe they should start with $10, then increase as the incidence of fraud diminishes). If ebaY wanted to be really cheap, they could make the money a non expiring coupon only good for use on ebaY via PayPal (to buy items or pay seller fees) - in that way it would be fake money, not really costing ebaY much of anything in real dollars.
3. ebaY would "pay" every user who reports the user ID, and that would be valid until ebaY closes down the fraudulent listings posted by that ID so they were no longer visible on the site. This would motivate ebaY to use trained personnel for this special reporting board, who can recognize fraud when they see it, and close it down ASAP, rather than letting it run for hours, days, weeks, months, like they do now. The user reporting the items can take screenshots time stamped, of their chat and of the ID reported with items showing, to keep track of and prove they made a legit report - just in case ebaY tries to welch out.
4. At the end of the year ebaY could award a real money or stock bonus to the top fraud beaters - those who turned in the most accounts being used for fraud. Great PR.
This benefits ebaY in so many ways it is hard to fathom why they would not do it.
1. They already have the structure for reporting in place.
2. This would get the reports of such items off ebaY's chat/discussion boards, and probably off most of the off ebaY chat boards, as folks would have a reason to report them first BEFORE posting them in the public eye. If ebaY did this correctly, those listings would be gone - both before they could be seen AND before anyone could get taken.
3. Not only would the cost of this be minimal (paying a pittance to users rather than having to actually hire personnel), but they could use it as an actual example of both working with their community and actively combating fraud on their site - rather than just giving lip service to both. ebaY CLAIMS that fraud is less that one hundredth of one percent on their site - so just think how little this would cost them for so many tangible benefits.
4. This would clean up such fraudulent listings FAST. Currently ebaY tends to punish (threaten and suspend) users who report too much fraud, especially those who post about it on the ebaY chat boards. This generates lots of hostility, and is self defeating for ebaY, generating plenty of bad press. This idea eliminates all those negative factors.
ebaY - get moving! You know TAG's phone number, call and we can negotiate a price for this idea!
Wednesday, October 17, 2007
Looks as if ebaY is testing a customer service phone number being made available to "regular" users. The message shows up in My ebaY - The person who received this message it is a casual user of ebaY, buys and sells once in a while.
-------------------
Dear users name (user ID):
As one of our most loyal and active members, your membership status entitles you to a toll-free telephone number to contact eBay's customer service directly.
We're here to help if you need us, so the next time you need assistance from eBay, you can give us a call:
800-717-EBAY (800-717-3229)
This phone number is only for members like you who have been invited to
participate, so please be ready to provide your member ID when you call.
We appreciate your choice to use eBay and look forward to helping you make the most of your shopping experience. Please call us if you ever need a hand.
Sincerely,
eBay Customer Support
P.S. From time to time, if we notice you are having an issue with a transaction or a problem with your account, we may proactively try to reach you. Please help us provide the best possible service--make sure we have your correct contact phone number: www.ebay.com/UpdateContact
------------------
If you are not on their "list" they hang up on you.
Of course under the "will ebaY never learn" category, ebaY has a clickable link in the message that takes you to a redirected ebaY log in page. Is this an early holiday gift for the scammer set, who are sure to mimic the message for phishing? ebaY NEVER seems to learn from their prior mistakes. TAG guesses that ebaY feels their My ebaY and My Message system is secure, though those of us who follow ebaY know that NOTHING is secure on ebaY. ebaY opening another door for the scammers to exploit by putting a clickable link in what we are assuming (a dangerous thing to do) is a legitimate message, just facilitates the scammers.
-------------------
Dear users name (user ID):
As one of our most loyal and active members, your membership status entitles you to a toll-free telephone number to contact eBay's customer service directly.
We're here to help if you need us, so the next time you need assistance from eBay, you can give us a call:
800-717-EBAY (800-717-3229)
This phone number is only for members like you who have been invited to
participate, so please be ready to provide your member ID when you call.
We appreciate your choice to use eBay and look forward to helping you make the most of your shopping experience. Please call us if you ever need a hand.
Sincerely,
eBay Customer Support
P.S. From time to time, if we notice you are having an issue with a transaction or a problem with your account, we may proactively try to reach you. Please help us provide the best possible service--make sure we have your correct contact phone number: www.ebay.com/UpdateContact
------------------
If you are not on their "list" they hang up on you.
Of course under the "will ebaY never learn" category, ebaY has a clickable link in the message that takes you to a redirected ebaY log in page. Is this an early holiday gift for the scammer set, who are sure to mimic the message for phishing? ebaY NEVER seems to learn from their prior mistakes. TAG guesses that ebaY feels their My ebaY and My Message system is secure, though those of us who follow ebaY know that NOTHING is secure on ebaY. ebaY opening another door for the scammers to exploit by putting a clickable link in what we are assuming (a dangerous thing to do) is a legitimate message, just facilitates the scammers.
Wednesday, September 26, 2007
Has YOUR ebaY Account Been Compromised?
On Tuesday 25 Sep 2007 at 5:42 AM ebaY time, a hacker posted 29 to 50 pages of ebaY user information on the ebaY Trust and Safety discussion board (at approx 40 threads per page that is between 1100 and 2000 user IDs). The information was posted by using the user ID and account of the user whose information was posted, and included the ebaY user ID, email address, phone, name, street, city, state, zip, country, feedback info, what site they registered on, user status, powerseller status, payment method they used to pay ebaY, credit card number (with expiration date), credit card CVV2 code (the three digit security code on the back of the card), whether they are id verified, if they have an ebaY store and which site that is registered on, and if they are PayPal verified or not verified. The threads that contained the info also had a signature at the bottom of the post - SGI Inc. - emocnI gnitareneG rof snoituloS (Solutions for Generating Income spelled backwards) SGI Inc. is the company name used by Vladuz, a hacker who has demonstrated that he has the ability to access ebaY databases.
This first image shows the ebaY Trust and Safety discussion board thread list, with a detail of the thread listings.
The next image is the actual thread page you saw when clicking on the thread link from the previous image. We have masked parts of the info to protect the innocent.
Note the Vladuz signature on the bottom line
For more screen shots of the pages, please go to
TAG CHAT
After around 90 minutes of exposure, ebaY shut down the Trust and Safety board, occurring at around 7:15 AM, after trying to remove the thread posts at a time (the hacker was faster at posting than ebaY was at removing). One poster on the board discussing this incident, who saw the information, ran one of the credit card numbers posted through his merchant account verification, and it came back correct. Other posters said the CC info was not correct. Board posters got screenshots and compiled a list of user IDs so folks could check to see if their user ID was posted. When one board poster put the list on her ebaY Me page, ebaY removed the page and gave her a pink slap (an official violation notice with the threat of suspension).
We have a list of the IDs we have compiled from some of the screen shots we had access to and those lists posted by other folks on various boards (including ebaY's) around the net. You can view the list we compiled at this link. This list is NOT complete as it is believed there were over 1500 user IDs posted.
Compromised ID List
The first ebaY responses were posted on their discussion boards, and then removed, and were an obvious effort to cover themselves . Xavier's posts were removed soon after they were posted.
xman@ebay.com View Listings | Report 26-09-07 00:31 EST 58 of 61
Hi all, we're looking into why this happened however I've confirmed with the US teams that the credit card information was indeed false for all the accounts.
Looks like it only affected that 1 US Board but the engineers are diligently working to ensure this won't ever happen again.
Xavier
The eBay Team
-------------------
xman@ebay.com View Listings | Report 26-09-07 00:47 EST 82 of 88
The site wasn't actually hacked... it was a server issue where the system displayed the poster's information rather than the post itself. Being that the credit card information was on a different server, that info came up incorrect. It was not some hacker sitting there entering in someone's information and using a card generator.
Xavier
The eBay Team
---------------
Trust & Safety forums issue this morning
Posted by eBay Chatter on September 25, 2007 at 02:15 PM in General | Permalink
Some of our readers may have learned of an issue that occurred early this morning on one of our discussion forums. I've been talking with our Account Security and Legal teams, and I'd like to share some more details about this incident.
Very early this morning, a malicious fraudster posted on the Trust & Safety forum on eBay.com posing as approximately 1,200 eBay users. The fraudster made these posts in a way that was intended to appear as though he logged in with their accounts. The posts contained name and contact information, which appears to be valid, and could have been secured as part of an account take over.
The posts ALSO appeared to contain credit card information -- however, these credit cards are not associated with financial information on file for these users at eBay or PayPal. We're in the process of reaching out by phone to these members to, so that if the information is valid somehow -- regardless how this fraudster acquired the information -- these members can take the steps they need to take to protect themselves.
eBay and our forums vendor, LiveWorld, began taking steps to remedy the situation within an hour after it started. As things evolved behind the scenes, a decision was made to make the the Trust & Safety forum unavailable to our Community. It's still temporarily inaccessible, as the teams work on this issue.
I'll update this story later as we have more to share.
----------------
Various ebaY spokespersons also made statements to various press inquiries and calls to them by power sellers etc, that this was a hoax, that the information had been posted by a disgruntled user with access to the API, that the information was not valid, that the credit card numbers were not real and if they were real, they did not come from ebaY's database and were unrelated to info on ebaY. ebaY also said the information was real but had been phished from users off ebaY (this is ebaY's favorite excuse for security breaches even though it has been proven to be false on many occasions). What ebaY did not do (and still has not done) was post anything on the announcement board, informing users of the problem and warning them to watch their accounts and charge cards for possible breaches. Users have reported that ebaY has been making calls to those whose information was posted, to inform them of the breech. This is required by California law, whenever a breach of user information occurs.
With all the rumor, hearsay and damage control going on, there are still some hard facts that need to be looked at:
Fact 1 - Someone had the ability to post on ebaY's boards with the user ID and account of another person. This takes having an ebaY password for the account, or the ability to access and use accounts without passwords. This person was able to post threads at a rate of speed faster than ebaY's ability to remove the threads, leading them to have to shut down the Trust and Safety board completely.
Fact 2 - TAG had access to a small arbitrary sampling of the user account pages posted and checked what information we could against what is available to ebaY and PayPal users, and to those using the internet. Here is what we found:
*The User ID, email address, date registered, if they had a store or not, and feedback numbers registered/shown on ebaY matched 100% of the time
*The PayPal information as to the user having a verified account or not, was correct 83% of the users
*The ebaY ID verified information was correct 83% of the users
* When a reverse lookup online was used on the phone numbers to check name/addresses listed, 33% did not match the name or address, 50% were unlisted so were unavailable to check, and 17% were correct for the info shown
* When an address check was run using the white pages online with the name given, 66% of the information did not match, 17% were correct and 17% were listed as unavailable
We could not check the credit card numbers, and decided these people had probably been harassed enough about this, so we would not call them directly to ask them to verify. But, if you are one of the people whose accounts were posted and your credit card info does match that shown on the ebaY T&S board, and particularly if that information is the information used on ebaY's site, please feel free to contact us and let us know and we will update this information here.
Fact 3 - ebaY always chooses to lie, cover their back and waffle rather than coming out and telling the truth, whether that truth is that they just don't know what happened or how, or that their system had been compromised in some way (which it evidentially had been in at least some manner - see fact 1). They lie so readily and frequently that it is impossible to believe anything they say.
Fact 4 - evidence of problems with ebaY's system can be seen via the hundreds and thousands of scam listings posted on ebaY every day. Though the furor of reporting about this has fizzled out since the mass of Vladuz reporting earlier this year, the incidence of these listings is an every day occurrence on ebaY.
Since ebaY obviously does not know how deep this problem goes, it is possible that ALL user information on the ebaY site has been breached, so if you have ever used ebaY, and have any sensitive information recorded on the site - such as a credit card or bank account information - you need to monitor your accounts for possible problems. Unfortunately, ebaY is not the only site vulnerable, online or off, so regular checks of your credit card bills and bank accounts should now be a way of life, individuals MUST make this part of their usual routines. The other thing that is abundantly clear in all this, is that ebaY is NOT secure, even if we just consider the user ID email address factor that ebaY is so adamant about in their hiding user IDs from users, but obviously not from scammers, but then ebaY's lack of secure systems has been obvious since we first reported on the activities of Vladuz and the Chinese hackers, 11 months ago.
Assistance with this article needs to be credited to
Doc at EBAY MOTORS SUCKS - this is a good board to check for the day to day hacker listings on ebaY and especially for anything going on at ebaY Motors
The posters on the ebaY Seller Central Discussion Board
The posters on the ebaY AU Discussion Boards
And several ebaY users with the guts to posts User ID lists on and off ebaY, so they were available to all ebaY users despite ebaY's efforts to hide as much information as possible.
Want to assist TAG in continuing its work? Sign up for a voluntary subscription to TAGnotes, and provide support that will keep information coming to your email boxes and the lights on at our websites. To purchase a voluntary subscription, click on the button that follows.
This first image shows the ebaY Trust and Safety discussion board thread list, with a detail of the thread listings.
The next image is the actual thread page you saw when clicking on the thread link from the previous image. We have masked parts of the info to protect the innocent.
Note the Vladuz signature on the bottom line
For more screen shots of the pages, please go to
TAG CHAT
After around 90 minutes of exposure, ebaY shut down the Trust and Safety board, occurring at around 7:15 AM, after trying to remove the thread posts at a time (the hacker was faster at posting than ebaY was at removing). One poster on the board discussing this incident, who saw the information, ran one of the credit card numbers posted through his merchant account verification, and it came back correct. Other posters said the CC info was not correct. Board posters got screenshots and compiled a list of user IDs so folks could check to see if their user ID was posted. When one board poster put the list on her ebaY Me page, ebaY removed the page and gave her a pink slap (an official violation notice with the threat of suspension).
We have a list of the IDs we have compiled from some of the screen shots we had access to and those lists posted by other folks on various boards (including ebaY's) around the net. You can view the list we compiled at this link. This list is NOT complete as it is believed there were over 1500 user IDs posted.
Compromised ID List
The first ebaY responses were posted on their discussion boards, and then removed, and were an obvious effort to cover themselves . Xavier's posts were removed soon after they were posted.
xman@ebay.com View Listings | Report 26-09-07 00:31 EST 58 of 61
Hi all, we're looking into why this happened however I've confirmed with the US teams that the credit card information was indeed false for all the accounts.
Looks like it only affected that 1 US Board but the engineers are diligently working to ensure this won't ever happen again.
Xavier
The eBay Team
-------------------
xman@ebay.com View Listings | Report 26-09-07 00:47 EST 82 of 88
The site wasn't actually hacked... it was a server issue where the system displayed the poster's information rather than the post itself. Being that the credit card information was on a different server, that info came up incorrect. It was not some hacker sitting there entering in someone's information and using a card generator.
Xavier
The eBay Team
---------------
Trust & Safety forums issue this morning
Posted by eBay Chatter on September 25, 2007 at 02:15 PM in General | Permalink
Some of our readers may have learned of an issue that occurred early this morning on one of our discussion forums. I've been talking with our Account Security and Legal teams, and I'd like to share some more details about this incident.
Very early this morning, a malicious fraudster posted on the Trust & Safety forum on eBay.com posing as approximately 1,200 eBay users. The fraudster made these posts in a way that was intended to appear as though he logged in with their accounts. The posts contained name and contact information, which appears to be valid, and could have been secured as part of an account take over.
The posts ALSO appeared to contain credit card information -- however, these credit cards are not associated with financial information on file for these users at eBay or PayPal. We're in the process of reaching out by phone to these members to, so that if the information is valid somehow -- regardless how this fraudster acquired the information -- these members can take the steps they need to take to protect themselves.
eBay and our forums vendor, LiveWorld, began taking steps to remedy the situation within an hour after it started. As things evolved behind the scenes, a decision was made to make the the Trust & Safety forum unavailable to our Community. It's still temporarily inaccessible, as the teams work on this issue.
I'll update this story later as we have more to share.
----------------
Various ebaY spokespersons also made statements to various press inquiries and calls to them by power sellers etc, that this was a hoax, that the information had been posted by a disgruntled user with access to the API, that the information was not valid, that the credit card numbers were not real and if they were real, they did not come from ebaY's database and were unrelated to info on ebaY. ebaY also said the information was real but had been phished from users off ebaY (this is ebaY's favorite excuse for security breaches even though it has been proven to be false on many occasions). What ebaY did not do (and still has not done) was post anything on the announcement board, informing users of the problem and warning them to watch their accounts and charge cards for possible breaches. Users have reported that ebaY has been making calls to those whose information was posted, to inform them of the breech. This is required by California law, whenever a breach of user information occurs.
With all the rumor, hearsay and damage control going on, there are still some hard facts that need to be looked at:
Fact 1 - Someone had the ability to post on ebaY's boards with the user ID and account of another person. This takes having an ebaY password for the account, or the ability to access and use accounts without passwords. This person was able to post threads at a rate of speed faster than ebaY's ability to remove the threads, leading them to have to shut down the Trust and Safety board completely.
Fact 2 - TAG had access to a small arbitrary sampling of the user account pages posted and checked what information we could against what is available to ebaY and PayPal users, and to those using the internet. Here is what we found:
*The User ID, email address, date registered, if they had a store or not, and feedback numbers registered/shown on ebaY matched 100% of the time
*The PayPal information as to the user having a verified account or not, was correct 83% of the users
*The ebaY ID verified information was correct 83% of the users
* When a reverse lookup online was used on the phone numbers to check name/addresses listed, 33% did not match the name or address, 50% were unlisted so were unavailable to check, and 17% were correct for the info shown
* When an address check was run using the white pages online with the name given, 66% of the information did not match, 17% were correct and 17% were listed as unavailable
We could not check the credit card numbers, and decided these people had probably been harassed enough about this, so we would not call them directly to ask them to verify. But, if you are one of the people whose accounts were posted and your credit card info does match that shown on the ebaY T&S board, and particularly if that information is the information used on ebaY's site, please feel free to contact us and let us know and we will update this information here.
Fact 3 - ebaY always chooses to lie, cover their back and waffle rather than coming out and telling the truth, whether that truth is that they just don't know what happened or how, or that their system had been compromised in some way (which it evidentially had been in at least some manner - see fact 1). They lie so readily and frequently that it is impossible to believe anything they say.
Fact 4 - evidence of problems with ebaY's system can be seen via the hundreds and thousands of scam listings posted on ebaY every day. Though the furor of reporting about this has fizzled out since the mass of Vladuz reporting earlier this year, the incidence of these listings is an every day occurrence on ebaY.
Since ebaY obviously does not know how deep this problem goes, it is possible that ALL user information on the ebaY site has been breached, so if you have ever used ebaY, and have any sensitive information recorded on the site - such as a credit card or bank account information - you need to monitor your accounts for possible problems. Unfortunately, ebaY is not the only site vulnerable, online or off, so regular checks of your credit card bills and bank accounts should now be a way of life, individuals MUST make this part of their usual routines. The other thing that is abundantly clear in all this, is that ebaY is NOT secure, even if we just consider the user ID email address factor that ebaY is so adamant about in their hiding user IDs from users, but obviously not from scammers, but then ebaY's lack of secure systems has been obvious since we first reported on the activities of Vladuz and the Chinese hackers, 11 months ago.
Assistance with this article needs to be credited to
Doc at EBAY MOTORS SUCKS - this is a good board to check for the day to day hacker listings on ebaY and especially for anything going on at ebaY Motors
The posters on the ebaY Seller Central Discussion Board
The posters on the ebaY AU Discussion Boards
And several ebaY users with the guts to posts User ID lists on and off ebaY, so they were available to all ebaY users despite ebaY's efforts to hide as much information as possible.
Want to assist TAG in continuing its work? Sign up for a voluntary subscription to TAGnotes, and provide support that will keep information coming to your email boxes and the lights on at our websites. To purchase a voluntary subscription, click on the button that follows.
Tuesday, July 03, 2007
Consumer Reports Aug 07 on ebaY
CR did a report on ebaY for their August Issue. Though it obviously did not have all the right questions to ask, it did have some interesting results.
Read ebaY Report
HALF (yes that is 50%) of buyers, said they had been "deceived" by the seller in some way, from not as described to outright fraud.
40% (which gives ebaY a positive feedback rating of 60 out of 100%) said ebaY's customer service in providing help was fair (neutral) or poor (negative). Well that DEFINITELY puts ebaY in the suspended category according to their own system - much lower than the lowest 5% on their site! And that was just from buyers - can you imagine what it would have been from sellers?
Read ebaY Report
HALF (yes that is 50%) of buyers, said they had been "deceived" by the seller in some way, from not as described to outright fraud.
40% (which gives ebaY a positive feedback rating of 60 out of 100%) said ebaY's customer service in providing help was fair (neutral) or poor (negative). Well that DEFINITELY puts ebaY in the suspended category according to their own system - much lower than the lowest 5% on their site! And that was just from buyers - can you imagine what it would have been from sellers?
Wednesday, June 27, 2007
New Online Auction & Trading Industry Discussion Board
Join up to freely discuss the industry on our chat/discussion board at www.tagchat-oai.com
ebaY Hypocrisy Reaches New High
In the aftermath of ebaY Live in Boston, ebaY has implemented a plan they feel will improve the "buyer experience" on ebaY. Whilst the general idea behind this plan may not be too faulty - though it IS in contradiction to ebaY's venue only policy in their user agreement - as always, ebaY's implementation is obscene.
What ebaY is doing is suspending some sellers who have complaints from buyers. ebaY is not looking at the complaints to see if they are legitimate, just giving the seller a 7 to 14 day suspension with the threat of permanent suspension if the seller does not go back and fix the problems, and refrain from having further problems. So, if the complaint is from a deadbeat buyer, who did not receive the item because they did not pay for it, this counts against the seller. If the complaint is from a thief who refuses to return the item but still wants a full refund, this counts against the seller. If the complaint is about a flaw in an item, even if the flaw was stated in the description, the complaint still counts against the seller. If the complaint is from a buyer, who tries to use the rating or complaint system to blackmail the seller into selling them something at a ridiculously low price, the complaint still counts against the seller. If the complaint is from a buyer, who wants the seller to do something illegal, such as falsify customs forms, the complaint counts against the seller. This is obscene, and should definitely be investigated as grounds for a class action lawsuit against ebaY, or at the least an investigation from State Attorney Generals.
ebaY says "eBay will consider the circumstances of an alleged policy violation and the user's trading record before taking action." and "If a complaint can't be proven with certainty, eBay may take no action." Both statements are lies, as ebaY does no investigating and ignores emails from sellers trying to explain the situation. ebaY also says, "Further, sellers are expected to perform in a manner that results in a consistently high level of buyer satisfaction. If a seller's interactions with the eBay Community create unacceptable levels of buyer dissatisfaction, that seller has violated this policy." As with many ebaY policies (written and unwritten) what is considered an acceptable level is kept a double super secret, because the knowledge might lead to seller abuse of the system (huh?). In truth the reason ebaY keeps such information secret is so that there is no one standard everyone has to follow, but ebaY can assign an arbitrary figure to suit their needs. As always, there is noone at ebaY the seller can contact to get such issues resolved. ebaY ignores emails, sends canned automated answers, and as usual, slams the door in the seller's face, even if ebaY is completely wrong in their action.
There are many many large sellers, whose accounts far exceed these arbitrary negative ratings, yet those accounts remain active and untouched by ebaY. The sellers we have been hearing from report that they are told they are in the "lowest 2% of buyer satisfaction" or have a 5% negative rating in the last X number of days (with X also varying to fit ebaY's needs).
Of course the ultimate hypocrisy lies in ebaY's satisfaction rating from their customers, the sellers. TAG wagers that ebaY's rating would be lucky to exceed 50% satisfaction, and definitely would not be close to 95% satisfactory. ebaY should shut itself down, based on its own standard, but then hypocrisy and lies are what ebaY, the company, is all about.
What ebaY is doing is suspending some sellers who have complaints from buyers. ebaY is not looking at the complaints to see if they are legitimate, just giving the seller a 7 to 14 day suspension with the threat of permanent suspension if the seller does not go back and fix the problems, and refrain from having further problems. So, if the complaint is from a deadbeat buyer, who did not receive the item because they did not pay for it, this counts against the seller. If the complaint is from a thief who refuses to return the item but still wants a full refund, this counts against the seller. If the complaint is about a flaw in an item, even if the flaw was stated in the description, the complaint still counts against the seller. If the complaint is from a buyer, who tries to use the rating or complaint system to blackmail the seller into selling them something at a ridiculously low price, the complaint still counts against the seller. If the complaint is from a buyer, who wants the seller to do something illegal, such as falsify customs forms, the complaint counts against the seller. This is obscene, and should definitely be investigated as grounds for a class action lawsuit against ebaY, or at the least an investigation from State Attorney Generals.
ebaY says "eBay will consider the circumstances of an alleged policy violation and the user's trading record before taking action." and "If a complaint can't be proven with certainty, eBay may take no action." Both statements are lies, as ebaY does no investigating and ignores emails from sellers trying to explain the situation. ebaY also says, "Further, sellers are expected to perform in a manner that results in a consistently high level of buyer satisfaction. If a seller's interactions with the eBay Community create unacceptable levels of buyer dissatisfaction, that seller has violated this policy." As with many ebaY policies (written and unwritten) what is considered an acceptable level is kept a double super secret, because the knowledge might lead to seller abuse of the system (huh?). In truth the reason ebaY keeps such information secret is so that there is no one standard everyone has to follow, but ebaY can assign an arbitrary figure to suit their needs. As always, there is noone at ebaY the seller can contact to get such issues resolved. ebaY ignores emails, sends canned automated answers, and as usual, slams the door in the seller's face, even if ebaY is completely wrong in their action.
There are many many large sellers, whose accounts far exceed these arbitrary negative ratings, yet those accounts remain active and untouched by ebaY. The sellers we have been hearing from report that they are told they are in the "lowest 2% of buyer satisfaction" or have a 5% negative rating in the last X number of days (with X also varying to fit ebaY's needs).
Of course the ultimate hypocrisy lies in ebaY's satisfaction rating from their customers, the sellers. TAG wagers that ebaY's rating would be lucky to exceed 50% satisfaction, and definitely would not be close to 95% satisfactory. ebaY should shut itself down, based on its own standard, but then hypocrisy and lies are what ebaY, the company, is all about.
Thursday, March 15, 2007
Is ebaY Holding the Smoking Gun?
The Preponderence of the Facts Show That ebaY is Holding The Smoking Gun
14 March 2007
It must be pretty obvious to our readers that TAG has been convinced for quite a while that ebaY is lying when they say Vladuz - and by extrapolation the Chinese hijacker/counterfeiters - has no access to ebaY other than through the phishing that takes place off ebaY. Only ebaY knows the whole truth, and all TAG, being on the outside can do, is use our 10 year intimate knowledge of ebaY and theorize on what we can observe. ebaY says that their site is secure and that no one has accessed their back end, as TAG has theorized. They told TAG that it is a FACT that no one has direct access to ebaY,
" We can hopefully address your 'concerns about the Vladuz problem' with the facts below."
" There is no way of gaining access to our internal networks without a securid token issued by IT."
"At no point did he have access to our corporate networks, tools, financial databases, or desktops, and at no point was any user information exposed."
"No one can access a user account without a password"
We already know, for a FACT (a real one not an ebaY corprobabblespeak one) that the following fact is a lie,
" Some messages were published on a community board on the eBay.de (Germany) web site by a person who gained access to a small number of employee email accounts."
since Vladuz posted on the boards today, using ebaY employee accounts, for the fourth time since he was shut out of that "small number of employee email accounts." Can there be so many gullible ebaY employees falling for phishing scams, and doing so whilst this massive attack against the ebaY site is going on?
What is most interesting about today's postings however, is that the account hijacks appear to have finally provided the smoking gun, with ebaY's fingerprints on it. Possibly irrefutable proof that ebaY is lying, that their site has been compromised, and that the back door is wide open.
Today, one of the accounts Vladuz, under the User ID Vladuz-Unleashed, used, is an account for an ebaY employee, kelbel@ebay.com
kelbel@ebay.com has what appears to be a test ebaY shop
Though kelbel@ebay.com has only one (1) feedback from another ebaY employee, kelbel has a power seller logo.
It is fairly obvious that kelbel@ebay.com is not a real person, but an account created by ebaY to run whatever various tests and experiments they feel they need. ebaY has lots of things they test, so this is just another one of them. BUT, if there is no real person named kelbel@ebay.com HOW did that non-existent person fall for a phishing scheme that allowed "his" information to be added to a phishing database? And if the account was hijacked without such access, then ebaY is lying about all of their alleged facts, and about phishing being the road to access to all these hijacked accounts, ebaY's and everyone else's.
At what point does ebaY's lies become criminal activity? At what point do they become liable for what is going on? They might already be violating the California law that requires them to contact California account holders when their ebaY accounts are compromised through access to ebaY's servers. What other laws are they breaking? Customer trust is eroding fast; will stockholder trust be far behind?
14 March 2007
It must be pretty obvious to our readers that TAG has been convinced for quite a while that ebaY is lying when they say Vladuz - and by extrapolation the Chinese hijacker/counterfeiters - has no access to ebaY other than through the phishing that takes place off ebaY. Only ebaY knows the whole truth, and all TAG, being on the outside can do, is use our 10 year intimate knowledge of ebaY and theorize on what we can observe. ebaY says that their site is secure and that no one has accessed their back end, as TAG has theorized. They told TAG that it is a FACT that no one has direct access to ebaY,
" We can hopefully address your 'concerns about the Vladuz problem' with the facts below."
" There is no way of gaining access to our internal networks without a securid token issued by IT."
"At no point did he have access to our corporate networks, tools, financial databases, or desktops, and at no point was any user information exposed."
"No one can access a user account without a password"
We already know, for a FACT (a real one not an ebaY corprobabblespeak one) that the following fact is a lie,
" Some messages were published on a community board on the eBay.de (Germany) web site by a person who gained access to a small number of employee email accounts."
since Vladuz posted on the boards today, using ebaY employee accounts, for the fourth time since he was shut out of that "small number of employee email accounts." Can there be so many gullible ebaY employees falling for phishing scams, and doing so whilst this massive attack against the ebaY site is going on?
What is most interesting about today's postings however, is that the account hijacks appear to have finally provided the smoking gun, with ebaY's fingerprints on it. Possibly irrefutable proof that ebaY is lying, that their site has been compromised, and that the back door is wide open.
Today, one of the accounts Vladuz, under the User ID Vladuz-Unleashed, used, is an account for an ebaY employee, kelbel@ebay.com
kelbel@ebay.com has what appears to be a test ebaY shop
Though kelbel@ebay.com has only one (1) feedback from another ebaY employee, kelbel has a power seller logo.
It is fairly obvious that kelbel@ebay.com is not a real person, but an account created by ebaY to run whatever various tests and experiments they feel they need. ebaY has lots of things they test, so this is just another one of them. BUT, if there is no real person named kelbel@ebay.com HOW did that non-existent person fall for a phishing scheme that allowed "his" information to be added to a phishing database? And if the account was hijacked without such access, then ebaY is lying about all of their alleged facts, and about phishing being the road to access to all these hijacked accounts, ebaY's and everyone else's.
At what point does ebaY's lies become criminal activity? At what point do they become liable for what is going on? They might already be violating the California law that requires them to contact California account holders when their ebaY accounts are compromised through access to ebaY's servers. What other laws are they breaking? Customer trust is eroding fast; will stockholder trust be far behind?
Tuesday, March 13, 2007
Whitman Fiddles as ebaY Burns
13 Mar 2007
Whilst Meg Whitman stood and played her fiddle at the Visa Security Summit, confidence in ebaY's security continued to burn to the ground. Adding fuel to the fire is Vladuz, defeating every ebaY effort to keep him from posting as an ebaY employee on ebaY's boards.
Meg Whitman blamed everyone but ebaY for the huge security hole that has made ebaY the plaything of Chinese hijackers, selling their counterfeit merchandise to the markets ebaY attempted, and failed, to deny them. Meg Whitman blamed Microsoft, Yahoo, the victims of the hijacks, Vladuz and probably The Auction Guild, for the flaws that are no doubt the fault of ebaY's bloated, patched, corrupt and insecure coding. She thinks every other company but ebaY, should spend their dollars, hire personnel, fix their security, and build tools for ebaY to use for free, so that ebaY users can't get scammed, and user confidence in ebaY continue to turn to ash. She does not mention, and definitely wont implement, even the most basic things that ebaY could do to assist themselves in curtailing their own problems (more on this later). Meg Whitman does not want to spend a penny, as that might adversely affect ebaY's ability to continually fool potential ebaY stock buyers that ebaY is a good investment, and a safe and fun place to sell and buy merchandise. There should be no misconception. ebaY is not safe and secure, has not been able to secure their own site, and potential investors should not waste their money on ebaY stock, until ebaY demonstrates the ability to secure the site.
ebaY keeps saying that Vladuz had a one time access to an employee account that contained old screenshots, and that ebaY shut his access down. Yet for the third time since he was allegedly shut down, Vladuz again posted to the ebaY Germany and US boards today, with an ebaY employee account.
A search of the ID yielded the following screenshots, showing the poster's profile and user ID history.
In and of itself, access to ebaY employee accounts is possibly not important. But the fact that ebaY can't secure even their own employee accounts is definitely indicative of more serious security flaws. These other security flaws are being demonstrated by Chinese counterfeiters listing upwards of 3 million items each and every day on ebaY, using fresh cherry picked accounts each time. The counterfeiters are also receiving payment through PayPal, and TAG wonders if ebaY continues to allow this, since this is the only money ebaY is earning on the transactions. Since the listings are on hijacked accounts, ebaY is not making anything in listing or final value fees, but PayPal takes its cut before the money is sent to the account holder.
Other indications of security flaws are the ability to override ebaY's listing parameters. Scammers and counterfeiters have been able to list items with titles longer than ebaY allows, add information to running legitimate listings, list items on NARU (no longer a registered user - closed or suspended accounts), list items on accounts that are only set up for buying, (buyer and seller accounts require different financial information) access accounts without having the password, and the ability to sell hundreds of items on accounts that don't meet the criteria for use of certain functions such as Buy It Now. In addition the listings appear to index in search immediately, and long before normal listings do. All these are indicators that the scammers and counterfeiters have a level of access and the ability to manipulate the ebaY system far beyond what they would have if they had only hijacked a regular users account via a stolen password using phishing. ebaY needs to explain how these things are happening, if all the blame is to fall on ebaY users.
This is a screenshot of an active listing on a NARU account. Unfortunately we did not get a screenshot of the sellers list of 205 items on this NARU account.
There are things ebaY could do right now to cut way back on these problems, without actually fixing their bloated, patched, corrupt and insecure kludge coding. These would only be stopgap measures until real fixes were put in place. Of course to do this, they would have to hire personnel and spend money, which at ebaY appears to be a crime of the first order, and a thing they wont do until their hand is forced.
1. Delete all accounts that have been inactive for a year. That is DELETE, as in remove totally from the database, not put into some accessible hole that the scammers can access. If they don't want to just delete inactive accounts, then send an email to the account holder asking the holder to go through their normal links to confirm they still want the account. Account holders should have to confirm unused accounts annually.
2. Require every account to be funded, either by cash, check or credit card. Even a minimal deposit of five or ten dollars for each account registered would cut down on the millions of superfluous accounts that are just sitting around waiting for the scammers to use them. Delete every account not funded (see1. for what delete means) This would also help cut down on some other problems, such as accounts registered for deadbeat bidders to use to wreak havoc on sellers they don't like or just or the fun of it.
3. Require a secure password consisting of letters, numbers and characters. This is such a basic security feature it amazes TAG that ebaY does not require it.
4. Require that sellers of items that are normally counterfeited be bonded. This is probably a good idea for all sellers who habitually sell high ticket items, including ebaY Motors. Reasonable limits could be set, so that anyone selling over X dollars a month of these items must be bonded.
5. Eliminate 1 day listing, and possibly 3 day listings. There is no reason for these to exist, and though Buy It Now and store listings amount to the same thing, they at least have some restrictions in place. Of course it appears the scammers have the ability to subvert all restrictions, but getting rid of all 1 day listings might filter some of the garbage out.
It would behoove Meg Whitman to implement these stop gap measure, expending her employee's energy on these measures as opposed to deleting postings and threads about the problems, suspending users who talk about the problems, lying about the extent of the security hole, and adding sites that publicize these issue, such as The Auction Guild and Falle-Internet.de, to the blacklists on sites such as AOL, Yahoo and the phishreport.net organization. And if ebaY actually plans to continue to be a marketplace, they need to hire some programmers and rebuild the entire program infrastructure from scratch, so that holes such as that exploited by the Vladuz's of the world are closed.
If you want to read more about these issues, and get the latest as it happens, keep your eye on these sites:
ebaY Motors Sucks
FireMeg
Falle-Internet
Articles at -
http://redtape.msnbc.com/2007/03/how_far_has_vla.html
http://www.eweek.com/article2/0,1895,2100808,00.asp
http://www.eweek.com/slideshow/0,1206,a=202474,00.asp
Information for this article came from -
http://news.zdnet.com/2100-1009_22-6165628.html?tag=nl.e550
And from several TAGnotes subscribers and information providers who choose to remain anonymous, but whose efforts we appreciate immensely
Whilst Meg Whitman stood and played her fiddle at the Visa Security Summit, confidence in ebaY's security continued to burn to the ground. Adding fuel to the fire is Vladuz, defeating every ebaY effort to keep him from posting as an ebaY employee on ebaY's boards.
Meg Whitman blamed everyone but ebaY for the huge security hole that has made ebaY the plaything of Chinese hijackers, selling their counterfeit merchandise to the markets ebaY attempted, and failed, to deny them. Meg Whitman blamed Microsoft, Yahoo, the victims of the hijacks, Vladuz and probably The Auction Guild, for the flaws that are no doubt the fault of ebaY's bloated, patched, corrupt and insecure coding. She thinks every other company but ebaY, should spend their dollars, hire personnel, fix their security, and build tools for ebaY to use for free, so that ebaY users can't get scammed, and user confidence in ebaY continue to turn to ash. She does not mention, and definitely wont implement, even the most basic things that ebaY could do to assist themselves in curtailing their own problems (more on this later). Meg Whitman does not want to spend a penny, as that might adversely affect ebaY's ability to continually fool potential ebaY stock buyers that ebaY is a good investment, and a safe and fun place to sell and buy merchandise. There should be no misconception. ebaY is not safe and secure, has not been able to secure their own site, and potential investors should not waste their money on ebaY stock, until ebaY demonstrates the ability to secure the site.
ebaY keeps saying that Vladuz had a one time access to an employee account that contained old screenshots, and that ebaY shut his access down. Yet for the third time since he was allegedly shut down, Vladuz again posted to the ebaY Germany and US boards today, with an ebaY employee account.
A search of the ID yielded the following screenshots, showing the poster's profile and user ID history.
In and of itself, access to ebaY employee accounts is possibly not important. But the fact that ebaY can't secure even their own employee accounts is definitely indicative of more serious security flaws. These other security flaws are being demonstrated by Chinese counterfeiters listing upwards of 3 million items each and every day on ebaY, using fresh cherry picked accounts each time. The counterfeiters are also receiving payment through PayPal, and TAG wonders if ebaY continues to allow this, since this is the only money ebaY is earning on the transactions. Since the listings are on hijacked accounts, ebaY is not making anything in listing or final value fees, but PayPal takes its cut before the money is sent to the account holder.
Other indications of security flaws are the ability to override ebaY's listing parameters. Scammers and counterfeiters have been able to list items with titles longer than ebaY allows, add information to running legitimate listings, list items on NARU (no longer a registered user - closed or suspended accounts), list items on accounts that are only set up for buying, (buyer and seller accounts require different financial information) access accounts without having the password, and the ability to sell hundreds of items on accounts that don't meet the criteria for use of certain functions such as Buy It Now. In addition the listings appear to index in search immediately, and long before normal listings do. All these are indicators that the scammers and counterfeiters have a level of access and the ability to manipulate the ebaY system far beyond what they would have if they had only hijacked a regular users account via a stolen password using phishing. ebaY needs to explain how these things are happening, if all the blame is to fall on ebaY users.
This is a screenshot of an active listing on a NARU account. Unfortunately we did not get a screenshot of the sellers list of 205 items on this NARU account.
There are things ebaY could do right now to cut way back on these problems, without actually fixing their bloated, patched, corrupt and insecure kludge coding. These would only be stopgap measures until real fixes were put in place. Of course to do this, they would have to hire personnel and spend money, which at ebaY appears to be a crime of the first order, and a thing they wont do until their hand is forced.
1. Delete all accounts that have been inactive for a year. That is DELETE, as in remove totally from the database, not put into some accessible hole that the scammers can access. If they don't want to just delete inactive accounts, then send an email to the account holder asking the holder to go through their normal links to confirm they still want the account. Account holders should have to confirm unused accounts annually.
2. Require every account to be funded, either by cash, check or credit card. Even a minimal deposit of five or ten dollars for each account registered would cut down on the millions of superfluous accounts that are just sitting around waiting for the scammers to use them. Delete every account not funded (see1. for what delete means) This would also help cut down on some other problems, such as accounts registered for deadbeat bidders to use to wreak havoc on sellers they don't like or just or the fun of it.
3. Require a secure password consisting of letters, numbers and characters. This is such a basic security feature it amazes TAG that ebaY does not require it.
4. Require that sellers of items that are normally counterfeited be bonded. This is probably a good idea for all sellers who habitually sell high ticket items, including ebaY Motors. Reasonable limits could be set, so that anyone selling over X dollars a month of these items must be bonded.
5. Eliminate 1 day listing, and possibly 3 day listings. There is no reason for these to exist, and though Buy It Now and store listings amount to the same thing, they at least have some restrictions in place. Of course it appears the scammers have the ability to subvert all restrictions, but getting rid of all 1 day listings might filter some of the garbage out.
It would behoove Meg Whitman to implement these stop gap measure, expending her employee's energy on these measures as opposed to deleting postings and threads about the problems, suspending users who talk about the problems, lying about the extent of the security hole, and adding sites that publicize these issue, such as The Auction Guild and Falle-Internet.de, to the blacklists on sites such as AOL, Yahoo and the phishreport.net organization. And if ebaY actually plans to continue to be a marketplace, they need to hire some programmers and rebuild the entire program infrastructure from scratch, so that holes such as that exploited by the Vladuz's of the world are closed.
If you want to read more about these issues, and get the latest as it happens, keep your eye on these sites:
ebaY Motors Sucks
FireMeg
Falle-Internet
Articles at -
http://redtape.msnbc.com/2007/03/how_far_has_vla.html
http://www.eweek.com/article2/0,1895,2100808,00.asp
http://www.eweek.com/slideshow/0,1206,a=202474,00.asp
Information for this article came from -
http://news.zdnet.com/2100-1009_22-6165628.html?tag=nl.e550
And from several TAGnotes subscribers and information providers who choose to remain anonymous, but whose efforts we appreciate immensely
Friday, February 23, 2007
ebaY Tries Intimidation
24 Feb 2007
For all of you that are following the Vladuz story, TAG has commented several times on how ebaY seems to be expending more energy on keeping the information hidden from the public, than on doing anything about the problem. Here is some proof that this is so.
Though the various Vladuz threads on ebaY US and ebaY UK are removed promptly, for a while, the Vladuz threads on the ebaY DE boards were allowed to remain. TAG referenced those threads in some of articles on the TAG website, and back in Jan, when Vladuz visited the TAG website, he/she was made aware of those ebaY DE threads, and went there for a visit. Vladuz spent some time posting on the ebaY DE boards, and when those threads started to attract lots of international attention, ebaY shut those threads down also. What ebaY also discovered is that there is a German website named Falle-Internet that is providing information about fraud, and scams online and in particular about ebaY DE. There are also several threads about Vladuz on the site.
On 19 Feb 07, TAG received an email from one of the folks who is a contributor to the Falle site, and included mail that the company that hosts their server received from ebaY. An excerpt from the correspondence follows:
From: snoyce@ebay.com
We have just learned that your service is being used to violate eBay Inc.'s trademarks and/or copyrights. Specifically, it appears that a xxxx user is hosting a page at 88.198.157.106 - http://www.falle-internet.de/de/html/pr_vlad.htm which uses our trademarks inappropriately.
While we believe that the above information gives your company more than a sufficient basis for disabling the page immediately, out of caution we note that your user's unauthorized reproduction of eBay's trademark and copyrighted materials violates federal law, and places an independent legal obligation on your company to remove the offending page(s) immediately upon receiving notice from eBay, the owner of the copyrighted materials. Accordingly, the information below serves as eBay's notice of infringement pursuant to the Digital Millennium Copyright Act, 17 U.S.C. Section 512 (c)(3)(A):
I, the undersigned, CERTIFY UNDER PENALTY OF PERJURY that I am the agent authorized to act on behalf of the owner of certain intellectual property rights, said owner being named eBay Inc. I have a good faith belief that the website located at URL http://www.falle-internet.de/de/html/pr_vlad.htm has its copyright in each page of its website and associated source code.
Please act expeditiously to remove or disable access to the material or items claimed to be infringing.
We sincerely appreciate your immediate attention to this important matter. We would also appreciate if you would take steps to confirm the accuracy of any contact information that your user may have provided to you in establishing the account. Should you have any accurate information that could assist eBay and law enforcement in tracking this individual, we greatly appreciate your assistance, as we know that you do not condone the use of your services for such criminal purposes.
Finally, please be advised that we have referred this issue to the Federal Bureau of Investigation for their investigation. The F.B.I. has requested that we convey to you in this message their request that you preserve for 90 days all records relating to this web site, including all associated accounts, computer logs, files, IP addresses, telephone numbers, subscriber and user records, communications, and all programs and files on storage media in regard to all Internet connection information, pursuant to 18 U.S.C. ? 2703(f). While we do not act as an agent of the FBI in conveying this request, we do intend to fully cooperate with their investigation, and encourage you to do so as well.
-------------------
Well, anyone receiving such an email would be bound to feel threatened, at least until they looked a little closer. Fortunately the server host receiving this intimidating email did not overreact and take the site down, but instead contacted the Falle folks. The Falle folks did take down the referenced page, but only until they could get more information from ebaY as to exactly what ebaY was objecting. There was nothing on the site that should have caused a problem, and nothing that was not also on the TAG site and other sites such as ebaY Motors Sucks.
On closer inspection of ebaY's threats, the whole thing looks foolish and silly. To start with, the FBI has no jurisdiction in Germany. In addition, the Digital Millennium Copyright Act, 17 U.S.C. Section 512 (c)(3)(A) is a US code, not a German one. To our legally untrained eyes, it does not appear that ebaY has a legal leg to stand on, and TAG wonders if this letter would fall under intimidation and harassment by ebaY. What possible criminal activity Falle could have committed, remains a complete mystery to even a fervent imagination.
Another thing that happened to the Falle-Internet site, and also to the TAG site, is that both our sites are now showing up on various toolbars as fraudulent sites. The following image shows up if you go to the auctionguild.com site (and also the Falle-Internet site) and use the Opera browser and toolbar. It says, "This site has been found on Opera's blacklist of suspected fraud sites. Exchanging sensitive or confidential information with this site could put you at risk for identity theft and/or financial fraud."
Isn't it an interesting coincidence, that some mysterious organization has decided to report sites as being fraudulent that are publishing information that could have a negative impact on ebaY's stock price? Since the TAG site has been around since 1999, has never been designated as a fraudulent site before, asks for no sensitive information of any kind, and you don't even have to accept a cookie to use the site, how the folks at Opera can justify this warning, is beyond us. One assumes that they would need to get such a blacklist request from someone with influence, to blacklist a site without even checking the site in question.
We will try to contact Opera to see if they can get this reviewed and fixed, and would also greatly appreciate if any of you out there who use the Opera browser and toolbar, report to Opera that this fraudulent site designation is false and should be removed. Also, please check the auctionguild.com site the Falle-Internet.de site, and even the ebaymotorssucks.com site to see if they show up as fraudulent, using any other toolbars you might use, and let us know, and also let the toolbar site know that any fraud designation is false.
For all of you that are following the Vladuz story, TAG has commented several times on how ebaY seems to be expending more energy on keeping the information hidden from the public, than on doing anything about the problem. Here is some proof that this is so.
Though the various Vladuz threads on ebaY US and ebaY UK are removed promptly, for a while, the Vladuz threads on the ebaY DE boards were allowed to remain. TAG referenced those threads in some of articles on the TAG website, and back in Jan, when Vladuz visited the TAG website, he/she was made aware of those ebaY DE threads, and went there for a visit. Vladuz spent some time posting on the ebaY DE boards, and when those threads started to attract lots of international attention, ebaY shut those threads down also. What ebaY also discovered is that there is a German website named Falle-Internet that is providing information about fraud, and scams online and in particular about ebaY DE. There are also several threads about Vladuz on the site.
On 19 Feb 07, TAG received an email from one of the folks who is a contributor to the Falle site, and included mail that the company that hosts their server received from ebaY. An excerpt from the correspondence follows:
From: snoyce@ebay.com
We have just learned that your service is being used to violate eBay Inc.'s trademarks and/or copyrights. Specifically, it appears that a xxxx user is hosting a page at 88.198.157.106 - http://www.falle-internet.de/de/html/pr_vlad.htm
While we believe that the above information gives your company more than a sufficient basis for disabling the page immediately, out of caution we note that your user's unauthorized reproduction of eBay's trademark and copyrighted materials violates federal law, and places an independent legal obligation on your company to remove the offending page(s) immediately upon receiving notice from eBay, the owner of the copyrighted materials. Accordingly, the information below serves as eBay's notice of infringement pursuant to the Digital Millennium Copyright Act, 17 U.S.C. Section 512 (c)(3)(A):
I, the undersigned, CERTIFY UNDER PENALTY OF PERJURY that I am the agent authorized to act on behalf of the owner of certain intellectual property rights, said owner being named eBay Inc. I have a good faith belief that the website located at URL http://www.falle-internet.de/de/html/pr_vlad.htm
Please act expeditiously to remove or disable access to the material or items claimed to be infringing.
We sincerely appreciate your immediate attention to this important matter. We would also appreciate if you would take steps to confirm the accuracy of any contact information that your user may have provided to you in establishing the account. Should you have any accurate information that could assist eBay and law enforcement in tracking this individual, we greatly appreciate your assistance, as we know that you do not condone the use of your services for such criminal purposes.
Finally, please be advised that we have referred this issue to the Federal Bureau of Investigation for their investigation. The F.B.I. has requested that we convey to you in this message their request that you preserve for 90 days all records relating to this web site, including all associated accounts, computer logs, files, IP addresses, telephone numbers, subscriber and user records, communications, and all programs and files on storage media in regard to all Internet connection information, pursuant to 18 U.S.C. ? 2703(f). While we do not act as an agent of the FBI in conveying this request, we do intend to fully cooperate with their investigation, and encourage you to do so as well.
-------------------
Well, anyone receiving such an email would be bound to feel threatened, at least until they looked a little closer. Fortunately the server host receiving this intimidating email did not overreact and take the site down, but instead contacted the Falle folks. The Falle folks did take down the referenced page, but only until they could get more information from ebaY as to exactly what ebaY was objecting. There was nothing on the site that should have caused a problem, and nothing that was not also on the TAG site and other sites such as ebaY Motors Sucks.
On closer inspection of ebaY's threats, the whole thing looks foolish and silly. To start with, the FBI has no jurisdiction in Germany. In addition, the Digital Millennium Copyright Act, 17 U.S.C. Section 512 (c)(3)(A) is a US code, not a German one. To our legally untrained eyes, it does not appear that ebaY has a legal leg to stand on, and TAG wonders if this letter would fall under intimidation and harassment by ebaY. What possible criminal activity Falle could have committed, remains a complete mystery to even a fervent imagination.
Another thing that happened to the Falle-Internet site, and also to the TAG site, is that both our sites are now showing up on various toolbars as fraudulent sites. The following image shows up if you go to the auctionguild.com site (and also the Falle-Internet site) and use the Opera browser and toolbar. It says, "This site has been found on Opera's blacklist of suspected fraud sites. Exchanging sensitive or confidential information with this site could put you at risk for identity theft and/or financial fraud."
Isn't it an interesting coincidence, that some mysterious organization has decided to report sites as being fraudulent that are publishing information that could have a negative impact on ebaY's stock price? Since the TAG site has been around since 1999, has never been designated as a fraudulent site before, asks for no sensitive information of any kind, and you don't even have to accept a cookie to use the site, how the folks at Opera can justify this warning, is beyond us. One assumes that they would need to get such a blacklist request from someone with influence, to blacklist a site without even checking the site in question.
We will try to contact Opera to see if they can get this reviewed and fixed, and would also greatly appreciate if any of you out there who use the Opera browser and toolbar, report to Opera that this fraudulent site designation is false and should be removed. Also, please check the auctionguild.com site the Falle-Internet.de site, and even the ebaymotorssucks.com site to see if they show up as fraudulent, using any other toolbars you might use, and let us know, and also let the toolbar site know that any fraud designation is false.
ebaY on Vladuz, Deny and Lie
23 Feb 2007
TAG has been deeply concerned over the completely open ebaY back end, which has allowed the hackers and the counterfeiters complete access to unlimited ebaY accounts and listings. All ebaY has done, so far as we can tell, is to disappear threads on their site discussing the subject, and attempt to intimidate and threaten websites that have recorded the incidents, and provided access to this information to the public.
On the first of February, TAG wrote to Rob Chesnut, Senior Vice President of Trust and Safety at ebaY, in a futile attempt to get some reassurance that ebaY was actually doing something to close this hole. We referenced the articles on the TAG website we have written on this subject and asked what we consider the most basic question:
If as ebaY claims, the Vladuz back door program does not exist, then HOW are the Chinese counterfeit sellers hijacking thousands of accounts and using those accounts to sell their merchandise and get their payment through PayPal, all without needing passwords on those accounts?
Unfortunately Rob did not see his way clear to respond - on or off the record - and instead shunted the email off to a new and inexperienced ebaY PR person. We can just imagine how the folks at ebaY were probably laughing in their coffee cups about sticking this ingénue with responding to bid bad TAG.
The email we received said:
I have to say we were rather disappointed that you didn't try and contact us prior to writing the piece as when we read your article we have noticed it contains many inaccuracies.
We can hopefully address your 'concerns about the Vladuz problem' with the facts below. Once you've had a look at these, it would be great if we can chat about whether you will amend your current article.
- Some messages were published on a community board on the eBay.de (Germany) web site by a person who gained access to a small number of employee email accounts.
- Our corporate email system operates on an entirely separate database and server system than those that store customer information.
- At no point did he have access to our corporate networks, tools, financial databases, or desktops, and at no point was any user information exposed.
There is no way of gaining access to our internal networks without a securid token issued by IT.
- By policy, our Customer Support Reps cannot store or include any personal data of any user in their email account.
- We take these incidents very seriously, and we are working closely with US and International authorities to investigate it further.
We responded with:
Are you just a PR person or do you actually understand how ebaY works? I have been intimately acquainted with the ebaY system since 1997 and been writing about it since 1999. How long have you been with them?
Since ebaY usually refuses to talk to me, I rarely contact them in the first place. On the very rare occasions I have talked to someone at ebaY on the record, all I have gotten is information that is less than the truth, definitely less than the whole truth, and usually just corprospeak babble. ebaY lies so frequently, it is hard to tell the rare time they might actually be speaking the truth.
This is simple – give me a realistic explanation of how the Chinese hackers have unlimited access to US ebaY accounts so that they can cherry pick the ones they want, in alphabetical order, with specific profiles, without the need for passwords, with the ability to redirect PayPal payments to themselves, with the ability to change information within actively running legitimate listings, and I MIGHT believe what you have to say about there being no access to your corporate networks, tools, financial database or desktops.
How much of this information is available because of the tools Vladuz is selling, remains to be seen, but the research I have done does point to Chinese hackers being aware of the Vladuz tools. One could theorize that they have used his tools and improved on them, so that they now have their unlimited access to ebaY user accounts.
Now admittedly, this is not exactly friendly or diplomatic, but it was bluntly honest, our normal mode of communication.
ebaY's Public Relations response was:
I must say that I was quite surprised by your response to us. As a new member to the eBay PR team, I was in good faith trying to reach out and build a new relationship with you, because we as a team were hoping to engage with you in the same manner we do with all other journalists and bloggers. We wanted to create a successful working relationship based on honesty, trust and mutual respect. But, it's obvious from the tone of your email below that you do not wish to start a productive and positive working relationship with us, which is a shame.
I have already provided you with the facts for the story you have already published. As I mentioned before, we would expect you to amend your story to reflect the accurate facts, however, I shall leave that to your own judgment about what is most valuable for your readers to know.
Given your apparent disinterest in helping your readers by developing a productive relationship with us that is based on the qualities we value, we have decided it would not benefit any of us to continue the effort with future responses to any of your inquiries.
We tried again and responded with:
In the past I have tried friendly discourse with ebaY, and have received no valid answers to my questions. In the past I have been aggressive and have received no valid answers to my questions. My approach has made no difference in getting valid answers out of ebaY. There is also a history of ebaY acting in a bad faith way against me – so there is a good reason why my attitude is not one based on mutual respect.
I would be happy to open a new channel and start fresh with you, if you would give me valid answers to my valid questions.
In my email to Rob I did not ask about Vladuz hijacking pink accounts to play games on the German boards. This is a non-issue as far as I am concerned, except that it demonstrates additional vulnerabilities. What I did ask about was the FACT that Chinese hackers have unlimited access to US ebaY accounts so that they can cherry pick the ones they want, in alphabetical order, with specific profiles, without the need for passwords, with the ability to redirect PayPal payments to themselves, and with the ability to change information within actively running legitimate listings.
This is happening every day and I have records of dozens of screenshots of this activity on ebaY. Can you please address this very important issue?
At present, all the facts I have do not in any way agree with the things you say are facts. The evidence is to the contrary. There is not evidence, for instance, that even though ebaY might end listings on these hijacked accounts, they have any way to prevent the items from being listed again, or can in any way limit the 1 to 2 million or so listings a day being posted by these Chinese hijackers.
It would be wonderful if ebaY were to turn over a new leaf and develop a relationship with their community that was based on honesty, truth and mutual respect. As the person who has been writing about ebaY the longest, with a firmly established position in the industry as being forthright, trustworthy, and ethical, if you could actually develop a rapport with me, where honesty and openness ruled, it would be a great accomplishment indeed. This would reflect well on you, and on ebaY, and I challenge you to change the current climate between TAG and ebaY, and in turn with the entire industry.
Needless to say, the ebaY PR wonk did not respond. We were amused by the phrase that said, " I have already provided you with the facts for the story you have already published. As I mentioned before, we would expect you to amend your story to reflect the accurate facts"
Of course ebaY did not in any way discuss the issue of the nearly 2 million listings daily on hijacked accounts. The listings that are relisted as fast as ebaY can remove them - sometimes 3 or 4 times a day. This image is a pictorial view of what is happening on ebaY every day.
They did not discuss the ongoing fake second chance offers that continue to be sent to bidders on high priced items, despite ebaY's now hiding the bidder IDs. ebaY did not discuss that Vladuz has posted on several ebaY chat boards using ebaY employee IDs or creating his/her own ebaY employee IDs, such as his latest posting on the ebaY DE board
In fact all ebaY has done is deny and lie.
They say Vladuz, "...gained access to a small number of employee email accounts" when it is obvious that Vladuz can access whatever ebaY employee accounts, whenever he/she wants, on whichever ebaY site he/she chooses. They say, "...no one can access an ebaY account without a password" though we have proved this is not true. ebaY says, "...the hijacked accounts are due to people responding to phishing email", though we have proved this also is not always true, and can not be true where hundreds of accounts are cherry picked, in alphabetical order, and new accounts are used day after day. ebaY denies that anyone has access to their back end, and refuses to acknowledge or provide a single answer as to how the counterfeiters are using these hundreds of hand picked hijacked accounts to sell millions of counterfeit items, and get paid via PayPal through ebaY. TAG is convinced that if ebaY could fix this open back end problem, they would have already done so. The only logical conclusion is that they can't.
Surely it is time for ebaY to come clean on this, and reassure those who use ebaY that they know about the problems and are working on fixing them. They should set up a special team to monitor their own site to prevent these listings from even indexing on the site. As we said in our final email to that ebaY PR person, " It would be wonderful if ebaY were to turn over a new leaf and develop a relationship with their community that was based on honesty, truth and mutual respect."
Don't worry; we are not holding our breath whilst waiting for this change.
TAG has been deeply concerned over the completely open ebaY back end, which has allowed the hackers and the counterfeiters complete access to unlimited ebaY accounts and listings. All ebaY has done, so far as we can tell, is to disappear threads on their site discussing the subject, and attempt to intimidate and threaten websites that have recorded the incidents, and provided access to this information to the public.
On the first of February, TAG wrote to Rob Chesnut, Senior Vice President of Trust and Safety at ebaY, in a futile attempt to get some reassurance that ebaY was actually doing something to close this hole. We referenced the articles on the TAG website we have written on this subject and asked what we consider the most basic question:
If as ebaY claims, the Vladuz back door program does not exist, then HOW are the Chinese counterfeit sellers hijacking thousands of accounts and using those accounts to sell their merchandise and get their payment through PayPal, all without needing passwords on those accounts?
Unfortunately Rob did not see his way clear to respond - on or off the record - and instead shunted the email off to a new and inexperienced ebaY PR person. We can just imagine how the folks at ebaY were probably laughing in their coffee cups about sticking this ingénue with responding to bid bad TAG.
The email we received said:
I have to say we were rather disappointed that you didn't try and contact us prior to writing the piece as when we read your article we have noticed it contains many inaccuracies.
We can hopefully address your 'concerns about the Vladuz problem' with the facts below. Once you've had a look at these, it would be great if we can chat about whether you will amend your current article.
- Some messages were published on a community board on the eBay.de (Germany) web site by a person who gained access to a small number of employee email accounts.
- Our corporate email system operates on an entirely separate database and server system than those that store customer information.
- At no point did he have access to our corporate networks, tools, financial databases, or desktops, and at no point was any user information exposed.
There is no way of gaining access to our internal networks without a securid token issued by IT.
- By policy, our Customer Support Reps cannot store or include any personal data of any user in their email account.
- We take these incidents very seriously, and we are working closely with US and International authorities to investigate it further.
We responded with:
Are you just a PR person or do you actually understand how ebaY works? I have been intimately acquainted with the ebaY system since 1997 and been writing about it since 1999. How long have you been with them?
Since ebaY usually refuses to talk to me, I rarely contact them in the first place. On the very rare occasions I have talked to someone at ebaY on the record, all I have gotten is information that is less than the truth, definitely less than the whole truth, and usually just corprospeak babble. ebaY lies so frequently, it is hard to tell the rare time they might actually be speaking the truth.
This is simple – give me a realistic explanation of how the Chinese hackers have unlimited access to US ebaY accounts so that they can cherry pick the ones they want, in alphabetical order, with specific profiles, without the need for passwords, with the ability to redirect PayPal payments to themselves, with the ability to change information within actively running legitimate listings, and I MIGHT believe what you have to say about there being no access to your corporate networks, tools, financial database or desktops.
How much of this information is available because of the tools Vladuz is selling, remains to be seen, but the research I have done does point to Chinese hackers being aware of the Vladuz tools. One could theorize that they have used his tools and improved on them, so that they now have their unlimited access to ebaY user accounts.
Now admittedly, this is not exactly friendly or diplomatic, but it was bluntly honest, our normal mode of communication.
ebaY's Public Relations response was:
I must say that I was quite surprised by your response to us. As a new member to the eBay PR team, I was in good faith trying to reach out and build a new relationship with you, because we as a team were hoping to engage with you in the same manner we do with all other journalists and bloggers. We wanted to create a successful working relationship based on honesty, trust and mutual respect. But, it's obvious from the tone of your email below that you do not wish to start a productive and positive working relationship with us, which is a shame.
I have already provided you with the facts for the story you have already published. As I mentioned before, we would expect you to amend your story to reflect the accurate facts, however, I shall leave that to your own judgment about what is most valuable for your readers to know.
Given your apparent disinterest in helping your readers by developing a productive relationship with us that is based on the qualities we value, we have decided it would not benefit any of us to continue the effort with future responses to any of your inquiries.
We tried again and responded with:
In the past I have tried friendly discourse with ebaY, and have received no valid answers to my questions. In the past I have been aggressive and have received no valid answers to my questions. My approach has made no difference in getting valid answers out of ebaY. There is also a history of ebaY acting in a bad faith way against me – so there is a good reason why my attitude is not one based on mutual respect.
I would be happy to open a new channel and start fresh with you, if you would give me valid answers to my valid questions.
In my email to Rob I did not ask about Vladuz hijacking pink accounts to play games on the German boards. This is a non-issue as far as I am concerned, except that it demonstrates additional vulnerabilities. What I did ask about was the FACT that Chinese hackers have unlimited access to US ebaY accounts so that they can cherry pick the ones they want, in alphabetical order, with specific profiles, without the need for passwords, with the ability to redirect PayPal payments to themselves, and with the ability to change information within actively running legitimate listings.
This is happening every day and I have records of dozens of screenshots of this activity on ebaY. Can you please address this very important issue?
At present, all the facts I have do not in any way agree with the things you say are facts. The evidence is to the contrary. There is not evidence, for instance, that even though ebaY might end listings on these hijacked accounts, they have any way to prevent the items from being listed again, or can in any way limit the 1 to 2 million or so listings a day being posted by these Chinese hijackers.
It would be wonderful if ebaY were to turn over a new leaf and develop a relationship with their community that was based on honesty, truth and mutual respect. As the person who has been writing about ebaY the longest, with a firmly established position in the industry as being forthright, trustworthy, and ethical, if you could actually develop a rapport with me, where honesty and openness ruled, it would be a great accomplishment indeed. This would reflect well on you, and on ebaY, and I challenge you to change the current climate between TAG and ebaY, and in turn with the entire industry.
Needless to say, the ebaY PR wonk did not respond. We were amused by the phrase that said, " I have already provided you with the facts for the story you have already published. As I mentioned before, we would expect you to amend your story to reflect the accurate facts"
Of course ebaY did not in any way discuss the issue of the nearly 2 million listings daily on hijacked accounts. The listings that are relisted as fast as ebaY can remove them - sometimes 3 or 4 times a day. This image is a pictorial view of what is happening on ebaY every day.
They did not discuss the ongoing fake second chance offers that continue to be sent to bidders on high priced items, despite ebaY's now hiding the bidder IDs. ebaY did not discuss that Vladuz has posted on several ebaY chat boards using ebaY employee IDs or creating his/her own ebaY employee IDs, such as his latest posting on the ebaY DE board
In fact all ebaY has done is deny and lie.
They say Vladuz, "...gained access to a small number of employee email accounts" when it is obvious that Vladuz can access whatever ebaY employee accounts, whenever he/she wants, on whichever ebaY site he/she chooses. They say, "...no one can access an ebaY account without a password" though we have proved this is not true. ebaY says, "...the hijacked accounts are due to people responding to phishing email", though we have proved this also is not always true, and can not be true where hundreds of accounts are cherry picked, in alphabetical order, and new accounts are used day after day. ebaY denies that anyone has access to their back end, and refuses to acknowledge or provide a single answer as to how the counterfeiters are using these hundreds of hand picked hijacked accounts to sell millions of counterfeit items, and get paid via PayPal through ebaY. TAG is convinced that if ebaY could fix this open back end problem, they would have already done so. The only logical conclusion is that they can't.
Surely it is time for ebaY to come clean on this, and reassure those who use ebaY that they know about the problems and are working on fixing them. They should set up a special team to monitor their own site to prevent these listings from even indexing on the site. As we said in our final email to that ebaY PR person, " It would be wonderful if ebaY were to turn over a new leaf and develop a relationship with their community that was based on honesty, truth and mutual respect."
Don't worry; we are not holding our breath whilst waiting for this change.
Friday, February 02, 2007
The Scammers Are Now In Control of ebaY
1 Feb 2007
Also see
ebay Insider Hijack Scam? and ebay's Back Door Wide Open & Letting Scammers In
And
ebaY Motors Hijacked
Those of us who have watched ebaY from a users perspective, for many years, have seen an every increasing ability for scammers to manipulate the site. In the last year, this access has gone from being outside manipulation of flaws and stolen personal information, to complete inside control.
These are the facts:
Every day thousands of listings from China selling brand name counterfeit goods are listed using hijacked accounts. These are usually 1 day listings, the accounts used fit a standard profile and are often accessed in alphabetical order. These listings are for brand name clothing, DVDs, sunglasses, and expand into other categories regularly. The scammer does not need a password to access these accounts.
ebaY Motors has ever increasing fraudulent listings. There are redirects from ebaY search results, manipulation of information in valid running listings, and ever more sophisticated cons, in addition to the all American fraud, found in some used car salesmen, that has been a caricature in our society since the advent of the automobile.
There is a brilliant hacker/codewriter who uses the moniker Vladuz, who makes ebaY his specialty. He has been writing ebaY hacks since 2003, as far as we can trace. This individual recently sent us a link to his latest hack, a tool that he posted on Firefox's plug ins. There have been several screen shots of ebaY's control utilities database posted on the net, on ebaY and off, all with a visible Vladuz watermark on the pages. Vladuz made the posts on ebaY, as far as TAG can tell.
ebaY knows about this problem, and has been removing any threads that appear on their site about it. They just removed a long running thread on ebaY DE, one on which Vladuz has posted on under various guises, including hacked ebaY pink accounts. At the end of December, TAG contacted ebaY through their Trust and Safety live support, and specifically told them what was going on. ebaY cannot say they did not know.
Here is what we have theorized based on all we have seen, and the facts we have:
Vladuz appears to have written a program that gives the scammers complete access to what we are calling ebaY's back end. This back end is the control utilities database used by ebaY, to track everything on their site, that contains all information about ebaY employees and its users. The following images are samples of what Vladuz has made available to the scammer marketplace.
The scammers who have purchased, or otherwise acquired the Vladuz access programs, appear to be able to manipulate the account information of every registered user ID on ebaY. They can monitor in real time what is happening in an account, read email sent through ebaY's system and respond to it through ebaY's system, change any parameter in the user ID account, so, for example, they can receive the PayPal payments the legitimate account holder would have otherwise received. They can add or remove information on a currently running listing without the legitimate account holder knowing it, and conduct business as they please; using all the hijacked accounts they please. No password access is needed. In the article ebay Insider Hijack Scam? we theorized that this was being done by an ebaY insider, as that was the only thing that could explain what we were observing. What we did not realize, and what even TAG found hard to believe, was that the scammers now had insider access, not by working for ebaY, but by using the program built by Vladuz.
Also see
ebay Insider Hijack Scam? and ebay's Back Door Wide Open & Letting Scammers In
And
ebaY Motors Hijacked
Those of us who have watched ebaY from a users perspective, for many years, have seen an every increasing ability for scammers to manipulate the site. In the last year, this access has gone from being outside manipulation of flaws and stolen personal information, to complete inside control.
These are the facts:
Every day thousands of listings from China selling brand name counterfeit goods are listed using hijacked accounts. These are usually 1 day listings, the accounts used fit a standard profile and are often accessed in alphabetical order. These listings are for brand name clothing, DVDs, sunglasses, and expand into other categories regularly. The scammer does not need a password to access these accounts.
ebaY Motors has ever increasing fraudulent listings. There are redirects from ebaY search results, manipulation of information in valid running listings, and ever more sophisticated cons, in addition to the all American fraud, found in some used car salesmen, that has been a caricature in our society since the advent of the automobile.
There is a brilliant hacker/codewriter who uses the moniker Vladuz, who makes ebaY his specialty. He has been writing ebaY hacks since 2003, as far as we can trace. This individual recently sent us a link to his latest hack, a tool that he posted on Firefox's plug ins. There have been several screen shots of ebaY's control utilities database posted on the net, on ebaY and off, all with a visible Vladuz watermark on the pages. Vladuz made the posts on ebaY, as far as TAG can tell.
ebaY knows about this problem, and has been removing any threads that appear on their site about it. They just removed a long running thread on ebaY DE, one on which Vladuz has posted on under various guises, including hacked ebaY pink accounts. At the end of December, TAG contacted ebaY through their Trust and Safety live support, and specifically told them what was going on. ebaY cannot say they did not know.
Here is what we have theorized based on all we have seen, and the facts we have:
Vladuz appears to have written a program that gives the scammers complete access to what we are calling ebaY's back end. This back end is the control utilities database used by ebaY, to track everything on their site, that contains all information about ebaY employees and its users. The following images are samples of what Vladuz has made available to the scammer marketplace.
The scammers who have purchased, or otherwise acquired the Vladuz access programs, appear to be able to manipulate the account information of every registered user ID on ebaY. They can monitor in real time what is happening in an account, read email sent through ebaY's system and respond to it through ebaY's system, change any parameter in the user ID account, so, for example, they can receive the PayPal payments the legitimate account holder would have otherwise received. They can add or remove information on a currently running listing without the legitimate account holder knowing it, and conduct business as they please; using all the hijacked accounts they please. No password access is needed. In the article ebay Insider Hijack Scam? we theorized that this was being done by an ebaY insider, as that was the only thing that could explain what we were observing. What we did not realize, and what even TAG found hard to believe, was that the scammers now had insider access, not by working for ebaY, but by using the program built by Vladuz.
Friday, December 29, 2006
EBAY'S BACK DOOR WIDE OPEN & LETTING SCAMMERS IN
************************************************************
EBAY'S BACK DOOR WIDE OPEN & LETTING SCAMMERS IN
************************************************************
There is a scammer's tool floating around the web that has been offered for sale to several ebaY users. This tool allows a scammer to access ALL user info through a utility ebaY uses to track all user information.
If you look at this link, you will see a page with ebaY seller information overlaid with the scammers SCO Helper program that allows the scammer to send second chance offers through ebaY's own system, to potential victims who have bid on the legitimate seller's items.
http://corriganb.com/sco.jpg
View Scam Tool Sample
Vladuz appears to be the person who wrote the program to break into the part of ebaY where all user information resides, and where it can be manipulated. He/She also appears to have authored "utilities" to exploit this open back door - such as the SCO Helper, that allows scammers to exploit second chance offers. As far as we can figure from online research, Vladuz is the online handle of a Romanian programmer/hacker, whose name pops up in relation to various scammer sites.
It is very possible that this ebaY function is what is being used by the scammers to post the BAPE auctions, and monitor email queries, replies and payments so they can reroute them. It is obvious that this information is readily accessible to the scammers, and that ebaY has not done anything to close the back door being used by the scammers.
For everyone wondering how scammers on ebaY manage to hijack accounts at will, this is the answer. ebaY says the scammers are getting the info due to ebaY users falling for phishing scams. That explanation let ebaY off the hook, but TAG never believed it, as it never made sense. In light of the BAPE scams - see this article -
BAPE Scam
it was definitely NOT falling for a phishing scam that exposed the user information of "Jack" or other tech savvy users who have contacted us since, with the same story. In the article we said that it appeared to have to be an insider with access to inside ebaY information. We now conclude that it may not be an ebaY insider, but instead an outsider, with complete access to all user account inside information.
If this is as it appears, ebaY is and has been aware of this wide open back door, and can't or won't do anything about it. We will update this on our website as more information becomes available.
Class action suit anyone?
An interesting note, is that since the earthquake on 26 Dec in Asia, cut off internet access to China and other Asian countries, the number of scams on ebaY has dropped drastically, as is easy to see by searching for BAPE Hoody listings.
Another note of interest is a reference to this tool that appeared on a Chinese Blog. The translation is done via the Google page translator, and as such is not the greatest - but it gives a good idea of what is going on. We have edited out a vulgar word or two - but the rest is as it appeared. Please take note of the dates!
====================
Ebay fishing website procedures
Author : indifference boys Date : 2006-03-30
Small size of the Chinese University :
Classification tool backdoor procedure : "br/> Linux operating platforms :
Tools size : 29,103 Bytes
MD5 5de7108546dfdaeb6d06fb3e02ad2af4 documents :
Source : fac@frauda.net tools
Ebay fishing website procedures "br/>Readme file
Copyright 2004 vladuz
Fac@frauda.net
-----------------------------------------------------
=
Updates : 1.6 : - WORKS WITH REGISTER_GLOBALS OFF!
- Checks if cvv2. cc and pin are numeric only if they are long enough and in lenght. (3 cvv2 min. pin min 4 min 16 cc)
- After script deletes cookie completed tasks
=
Ebay scam turns v1.6 FINAL~ This scam is in many ways.
It does the following :
Http://www.basd-action.net/initiatives/index.php : identical login/sign-in page of 22,500 (the new one)
Index2.php : 1 : if _ _ _ user password are invalid. it will show the identical '[invalid. try again 'of England.
2 : if user/pass are valid. cc/cvv2/exp/real echo ask for the name and current address.
3 : it can check if a user/pass are valid or not.
Index3.php : 1 : Send email and redirect my home to 22,500
2 : Verify if all fields are filled in corectly.
-----------------------------------------------------
You must have the following installed (this turns on Yahoo hosting files work (paid one))
1. Libcurl installed with PHP.
2. Some brain to configure it.
-----------------------------------------------------
Configuration :
Open your password setup and index2.php
Open index3.php and setup your subject and email address.
Your email is where you get the emails with user/pass/cc/cvv2/name/exp-date/ip/date/time
Subject is the email subject
Your password is used for email verification or manual checks. For example, if you setuped your password as "vladuz" and you want to do a manual check for the user "a" pass with "b" you have to type this in the government payments are capped : index2.php?user=a&pass=b&pwd=vladuz
On manual verification (when using pwd=) Invalid! the file will either return or, if valid. it will return the user and pass (for copy/paste hehe)
Simple enough?
Well go there and the [expletives deleted]!
-----------------------------------------------------
For ANY fac@frauda.net scam email me and I 'll do it in 30 hours max.
Study it, and refrain from doing bad things!
Member of the document only allows downloading! Download the registration |
===================
EBAY'S BACK DOOR WIDE OPEN & LETTING SCAMMERS IN
************************************************************
There is a scammer's tool floating around the web that has been offered for sale to several ebaY users. This tool allows a scammer to access ALL user info through a utility ebaY uses to track all user information.
If you look at this link, you will see a page with ebaY seller information overlaid with the scammers SCO Helper program that allows the scammer to send second chance offers through ebaY's own system, to potential victims who have bid on the legitimate seller's items.
http://corriganb.com/sco.jpg
View Scam Tool Sample
Vladuz appears to be the person who wrote the program to break into the part of ebaY where all user information resides, and where it can be manipulated. He/She also appears to have authored "utilities" to exploit this open back door - such as the SCO Helper, that allows scammers to exploit second chance offers. As far as we can figure from online research, Vladuz is the online handle of a Romanian programmer/hacker, whose name pops up in relation to various scammer sites.
It is very possible that this ebaY function is what is being used by the scammers to post the BAPE auctions, and monitor email queries, replies and payments so they can reroute them. It is obvious that this information is readily accessible to the scammers, and that ebaY has not done anything to close the back door being used by the scammers.
For everyone wondering how scammers on ebaY manage to hijack accounts at will, this is the answer. ebaY says the scammers are getting the info due to ebaY users falling for phishing scams. That explanation let ebaY off the hook, but TAG never believed it, as it never made sense. In light of the BAPE scams - see this article -
BAPE Scam
it was definitely NOT falling for a phishing scam that exposed the user information of "Jack" or other tech savvy users who have contacted us since, with the same story. In the article we said that it appeared to have to be an insider with access to inside ebaY information. We now conclude that it may not be an ebaY insider, but instead an outsider, with complete access to all user account inside information.
If this is as it appears, ebaY is and has been aware of this wide open back door, and can't or won't do anything about it. We will update this on our website as more information becomes available.
Class action suit anyone?
An interesting note, is that since the earthquake on 26 Dec in Asia, cut off internet access to China and other Asian countries, the number of scams on ebaY has dropped drastically, as is easy to see by searching for BAPE Hoody listings.
Another note of interest is a reference to this tool that appeared on a Chinese Blog. The translation is done via the Google page translator, and as such is not the greatest - but it gives a good idea of what is going on. We have edited out a vulgar word or two - but the rest is as it appeared. Please take note of the dates!
====================
Ebay fishing website procedures
Author : indifference boys Date : 2006-03-30
Small size of the Chinese University :
Classification tool backdoor procedure : "br/> Linux operating platforms :
Tools size : 29,103 Bytes
MD5 5de7108546dfdaeb6d06fb3e02ad2af4 documents :
Source : fac@frauda.net tools
Ebay fishing website procedures "br/>Readme file
Copyright 2004 vladuz
Fac@frauda.net
-----------------------------------------------------
=
Updates : 1.6 : - WORKS WITH REGISTER_GLOBALS OFF!
- Checks if cvv2. cc and pin are numeric only if they are long enough and in lenght. (3 cvv2 min. pin min 4 min 16 cc)
- After script deletes cookie completed tasks
=
Ebay scam turns v1.6 FINAL~ This scam is in many ways.
It does the following :
Http://www.basd-action.net/initiatives/index.php : identical login/sign-in page of 22,500 (the new one)
Index2.php : 1 : if _ _ _ user password are invalid. it will show the identical '[invalid. try again 'of England.
2 : if user/pass are valid. cc/cvv2/exp/real echo ask for the name and current address.
3 : it can check if a user/pass are valid or not.
Index3.php : 1 : Send email and redirect my home to 22,500
2 : Verify if all fields are filled in corectly.
-----------------------------------------------------
You must have the following installed (this turns on Yahoo hosting files work (paid one))
1. Libcurl installed with PHP.
2. Some brain to configure it.
-----------------------------------------------------
Configuration :
Open your password setup and index2.php
Open index3.php and setup your subject and email address.
Your email is where you get the emails with user/pass/cc/cvv2/name/exp-date/ip/date/time
Subject is the email subject
Your password is used for email verification or manual checks. For example, if you setuped your password as "vladuz" and you want to do a manual check for the user "a" pass with "b" you have to type this in the government payments are capped : index2.php?user=a&pass=b&pwd=vladuz
On manual verification (when using pwd=) Invalid! the file will either return or, if valid. it will return the user and pass (for copy/paste hehe)
Simple enough?
Well go there and the [expletives deleted]!
-----------------------------------------------------
For ANY fac@frauda.net scam email me and I 'll do it in 30 hours max.
Study it, and refrain from doing bad things!
Member of the document only allows downloading! Download the registration |
===================
Sunday, December 17, 2006
ebaY Insider Hijack Scam?
ebaY Insider Hijack Scam?
Sat 16 Dec 06
On Tuesday 12 Dec 2006 we received an email from a subscriber, describing how his ebaY selling account had been hijacked, and was being used to sell BAPE Hoody shirts. There were many interesting elements of this hijacking, different from those we have seen in the past. Upon seeing items he had not listed, the legitimate account holder, let's call him Jack, removed the listings and changed his password on the account. In addition he found that all his email notification preferences had been set to NO. He set them back to YES. By lunch time, the fake items were back, so this time using a work computer, Jack changed his ebaY password again. This made no difference and the items reappeared.
Jack's home computer is firewalled and has a full complement of detection software installed and active. He is a savvy user well versed in phishing, and has not responded in a long time to any ebaY "second chance" offers. He has not logged in to ebaY via any channel but his own links, and he has not filled in any pop up sign in request. Jack's work computer is on a very secure system, as he works in an industry where online security is paramount. He did not fall for a scam, have his computer invaded, have his identity stolen or compromised.
In trying to analyze what was going on, it appeared that the hijacker or hijackers had to have access to accounts independent of passwords, and have the ability to set account parameters so the legit account holder would not know what was going on. If this is so, it either points to someone working inside ebaY, or to a security hole so big, you can drive a tractor trailer through it. Neither situation is tolerable.
Searching ebaY for BAPE Hoody, brought up 140 pages of one day listings. All the one day listings were on hijacked accounts, and the hijacked accounts were used in groups by the first letter, so accounts with very high (usually 100%) feedback, starting with the letters G, H, I, J were in great evidence. The accounts were US accounts, but in reading the description, certain phrases would indicate that English was not the scammers first language. A check of the feedback would show the legitimate account holder as being a buyer only, or a seller of items not including designer clothing, or any clothing for that matter. Many accounts had been inactive for many months or years.
We did a buy it now on one item that was evidently on a hijacked account. We pulled the account holder's contact info, and it all appeared legitimate via a white pages check. We checked their email address against their PayPal address on PayPal, and that too appeared legitimate. The scammer never contacted us for payment, so we don't know how that part of the scam would have worked. Other emails with questions sent to the scammers by the folks helping us with this investigation, yielded answers such as "yes, if you buy two items ,you only pay them with 150USD .thanks" and "to you address total pay only US160.00" again suggesting that English was not their first language, and that the scammer had access to emails sent through the ebaY system. We tried another two BINs, but never heard from the scammer, despite repeated requests for payment information. The net result is, we don't know how the scammer worked this so that they received the payment rather than the legitimate account holder. We did eventually receive an email from the legitimate account holder on the last two BINs we did, saying their account was hijacked and not to make payment.
These items continued to be listed every day, with ebaY only shutting down a small percentage of them. If this is an ebaY insider job, TAG is baffled as to why they haven't tracked this to the source and shut it down.
As a matter of interest, some of the images have been tracked to this source whose domain is registered in Beijing, China - -
http://www.xhxh246.com/Product.asp?BigClassName=BAPESTASHOES
http://www.xhxh246.com/index.asp
This story is ongoing, so we will update it as we find more information.
Sat 16 Dec 06
On Tuesday 12 Dec 2006 we received an email from a subscriber, describing how his ebaY selling account had been hijacked, and was being used to sell BAPE Hoody shirts. There were many interesting elements of this hijacking, different from those we have seen in the past. Upon seeing items he had not listed, the legitimate account holder, let's call him Jack, removed the listings and changed his password on the account. In addition he found that all his email notification preferences had been set to NO. He set them back to YES. By lunch time, the fake items were back, so this time using a work computer, Jack changed his ebaY password again. This made no difference and the items reappeared.
Jack's home computer is firewalled and has a full complement of detection software installed and active. He is a savvy user well versed in phishing, and has not responded in a long time to any ebaY "second chance" offers. He has not logged in to ebaY via any channel but his own links, and he has not filled in any pop up sign in request. Jack's work computer is on a very secure system, as he works in an industry where online security is paramount. He did not fall for a scam, have his computer invaded, have his identity stolen or compromised.
In trying to analyze what was going on, it appeared that the hijacker or hijackers had to have access to accounts independent of passwords, and have the ability to set account parameters so the legit account holder would not know what was going on. If this is so, it either points to someone working inside ebaY, or to a security hole so big, you can drive a tractor trailer through it. Neither situation is tolerable.
Searching ebaY for BAPE Hoody, brought up 140 pages of one day listings. All the one day listings were on hijacked accounts, and the hijacked accounts were used in groups by the first letter, so accounts with very high (usually 100%) feedback, starting with the letters G, H, I, J were in great evidence. The accounts were US accounts, but in reading the description, certain phrases would indicate that English was not the scammers first language. A check of the feedback would show the legitimate account holder as being a buyer only, or a seller of items not including designer clothing, or any clothing for that matter. Many accounts had been inactive for many months or years.
We did a buy it now on one item that was evidently on a hijacked account. We pulled the account holder's contact info, and it all appeared legitimate via a white pages check. We checked their email address against their PayPal address on PayPal, and that too appeared legitimate. The scammer never contacted us for payment, so we don't know how that part of the scam would have worked. Other emails with questions sent to the scammers by the folks helping us with this investigation, yielded answers such as "yes, if you buy two items ,you only pay them with 150USD .thanks" and "to you address total pay only US160.00" again suggesting that English was not their first language, and that the scammer had access to emails sent through the ebaY system. We tried another two BINs, but never heard from the scammer, despite repeated requests for payment information. The net result is, we don't know how the scammer worked this so that they received the payment rather than the legitimate account holder. We did eventually receive an email from the legitimate account holder on the last two BINs we did, saying their account was hijacked and not to make payment.
These items continued to be listed every day, with ebaY only shutting down a small percentage of them. If this is an ebaY insider job, TAG is baffled as to why they haven't tracked this to the source and shut it down.
As a matter of interest, some of the images have been tracked to this source whose domain is registered in Beijing, China - -
http://www.xhxh246.com/Product.asp?BigClassName=BAPESTASHOES
http://www.xhxh246.com/index.asp
This story is ongoing, so we will update it as we find more information.
Sunday, October 22, 2006
ebaY Motors Hijacked
22 Oct 2006
CORRECTION 7 NOVEMBER 2006
After more research we have found that being logged in to ebaY is not what allows the scammer to tap into your ebaY account information. Though the redirect is direct from ebaY, once you try to purchase the item you get a screen asking you to log in again - even though you were already logged in to ebaY. This second log in is actually on the scammers site, and by loggin in you are giving them all the information you need for the scammer to access everything on your ebaY account that you can access.
We have also found that even ebaY's own image service is being used by the scammers to execute the redirect.
On the 4th of October 2006 a buyer who had been scammed on ebaY Motors using a second chance offer and had previously reported the scam to ebaY, was told that ebaY was not responsible, quoth the email, " Please keep in mind that we do include information on the messages sent through our system as well as on our site that state items should not be purchased outside of the eBay platform and should not be paid for using Western Union." The problem is, that as far as the buyer knew, the purchase WAS made on the ebaY platform, by going to ebaY, through the buyers normal links - NOT an email link - logging on to ebaY - NOT a third party site - and clicking on the second chance offer on ebaY's listing page. When the page opened, the buyer then clicked Buy It Now, his personal information was populated into a confirm shipping address page with his name and address from ebaY's servers, and when he got to the Pay Now page he was given the option of Western Union Wire Transfer, which (unfortunately) he used.
Now all of you who read TAGnotes and visit our website know that it is never safe to pay a stranger for a purchase with WU, but not everyone knows that. What ebaY has always told users is that as long as you come to ebaY directly, and log in to ebaY directly, and complete the sale on ebaY, you are safe. This is no longer true. This buyer did come to ebaY and log in to ebaY, but due to a security hole the size of Niagara Falls in ebaY's coding, was automatically redirected from the ebaY link he clicked on, to a third party scam site, where he was robbed of his money. This redirect happened so fast he never saw it happen.
ebaY has known about this problem at least since 4 October, and of course posted no warnings about it, much less fixed it. On 22 October, an associate of the subscriber who informed TAG of this scam was able to use the same process and "buy" a fake vehicle from a scammer still using the same security hole. The buyer searched ebaY, found an item, clicked on the ebaY search result link, was taken to a page that looked identical to an ebaY listing, used Buy It Now, had their personal information populated automatically into a confirm address section and was taken to a Pay Now screen. To check that the personal information populated into the form came from the ebaY site, they first went to their ebaY account and changed some of their personal information to fake info, and the form populated with the fake info from ebaY, the only place in the world the info existed.
From what we have been told (but not witnessed) this redirect scam is also being used for second chance offers. The buyer follows ebaY's rule of going directly to the ebaY site to respond to a second chance offer, and not use a link in an email, logs into ebaY, goes to the second chance offer, and is redirected to a scam site where their money is stolen. The implication here is that My ebaY is also compromised, but we have not seen actual evidence of this yet, though it is also possible that the second chance offer message is only appearing on the closed View Item page.
Needless to say, all the accounts used were hijacked accounts, and ebaY's claim that these accounts are hijacked from information gained via external phishing scams is getting very old and less believable all the time. TAG has always said that ebaY must be considered as the prime suspect as the source for finding the buyer email addresses, so the buyer can be contacted by the second chance scammer on items the buyer bid on but for which they did not have the high bid. In light of this major security breach, TAG wonders if any information is secure on ebaY.
Right now we have only seen this redirect happening in ebaY Motors, but that does not mean it is not happening on other parts of ebaY. TAG has observed at least 3 variations of this scam, making it likely that the scammer/hackers who figured this out, shared the information with other scammers. We are sure to see more and more of this unless ebaY manages to plug this security breach.
One Tech Guru theorized that this might have been caused by ebaY's band aid fix for their broken search issues. ebaY search is broken, and to "fix" it ebaY is using a javascript redirect from the broken search result (bad) to a usable search result (good). Unfortunately this might be the open door that is taking a buyer from a legitimate search result (good), to a scammers redirect page (bad) using the same javascript code ebaY has bandaged and patched their problems with.
TAG feels ebaY should be responsible to reimburse every buyer who lost money to these scams, since these items were found and reached through legitimate ebaY links, directly from the ebaY site. TAG also recommends that NO purchases be made on ebaY Motors until this huge security gap is fixed. As a temporary work around, TAG further recommends that all users turn off /disable javascript in their browser settings for all of ebaY.Com.
The following images are from an item we found on ebaY today.
The first shows the listing from ebaY's search result
The second shows the item listed on the sellers ebaY item list
The third shows the URL reached when clicking on the link from ebaY's search result page and the item appearing on the ebaY site
The fourth shows the URL now redirected to the scammers site
Much information and assistance with this article came from The Folks at:
EBAY MOTORS SUCKS
And from other TAG subscribers and Gurus
Our thanks to all at Margaritaville for their invaluable assistance and advice.
CORRECTION 7 NOVEMBER 2006
After more research we have found that being logged in to ebaY is not what allows the scammer to tap into your ebaY account information. Though the redirect is direct from ebaY, once you try to purchase the item you get a screen asking you to log in again - even though you were already logged in to ebaY. This second log in is actually on the scammers site, and by loggin in you are giving them all the information you need for the scammer to access everything on your ebaY account that you can access.
We have also found that even ebaY's own image service is being used by the scammers to execute the redirect.
On the 4th of October 2006 a buyer who had been scammed on ebaY Motors using a second chance offer and had previously reported the scam to ebaY, was told that ebaY was not responsible, quoth the email, " Please keep in mind that we do include information on the messages sent through our system as well as on our site that state items should not be purchased outside of the eBay platform and should not be paid for using Western Union." The problem is, that as far as the buyer knew, the purchase WAS made on the ebaY platform, by going to ebaY, through the buyers normal links - NOT an email link - logging on to ebaY - NOT a third party site - and clicking on the second chance offer on ebaY's listing page. When the page opened, the buyer then clicked Buy It Now, his personal information was populated into a confirm shipping address page with his name and address from ebaY's servers, and when he got to the Pay Now page he was given the option of Western Union Wire Transfer, which (unfortunately) he used.
Now all of you who read TAGnotes and visit our website know that it is never safe to pay a stranger for a purchase with WU, but not everyone knows that. What ebaY has always told users is that as long as you come to ebaY directly, and log in to ebaY directly, and complete the sale on ebaY, you are safe. This is no longer true. This buyer did come to ebaY and log in to ebaY, but due to a security hole the size of Niagara Falls in ebaY's coding, was automatically redirected from the ebaY link he clicked on, to a third party scam site, where he was robbed of his money. This redirect happened so fast he never saw it happen.
ebaY has known about this problem at least since 4 October, and of course posted no warnings about it, much less fixed it. On 22 October, an associate of the subscriber who informed TAG of this scam was able to use the same process and "buy" a fake vehicle from a scammer still using the same security hole. The buyer searched ebaY, found an item, clicked on the ebaY search result link, was taken to a page that looked identical to an ebaY listing, used Buy It Now, had their personal information populated automatically into a confirm address section and was taken to a Pay Now screen. To check that the personal information populated into the form came from the ebaY site, they first went to their ebaY account and changed some of their personal information to fake info, and the form populated with the fake info from ebaY, the only place in the world the info existed.
From what we have been told (but not witnessed) this redirect scam is also being used for second chance offers. The buyer follows ebaY's rule of going directly to the ebaY site to respond to a second chance offer, and not use a link in an email, logs into ebaY, goes to the second chance offer, and is redirected to a scam site where their money is stolen. The implication here is that My ebaY is also compromised, but we have not seen actual evidence of this yet, though it is also possible that the second chance offer message is only appearing on the closed View Item page.
Needless to say, all the accounts used were hijacked accounts, and ebaY's claim that these accounts are hijacked from information gained via external phishing scams is getting very old and less believable all the time. TAG has always said that ebaY must be considered as the prime suspect as the source for finding the buyer email addresses, so the buyer can be contacted by the second chance scammer on items the buyer bid on but for which they did not have the high bid. In light of this major security breach, TAG wonders if any information is secure on ebaY.
Right now we have only seen this redirect happening in ebaY Motors, but that does not mean it is not happening on other parts of ebaY. TAG has observed at least 3 variations of this scam, making it likely that the scammer/hackers who figured this out, shared the information with other scammers. We are sure to see more and more of this unless ebaY manages to plug this security breach.
One Tech Guru theorized that this might have been caused by ebaY's band aid fix for their broken search issues. ebaY search is broken, and to "fix" it ebaY is using a javascript redirect from the broken search result (bad) to a usable search result (good). Unfortunately this might be the open door that is taking a buyer from a legitimate search result (good), to a scammers redirect page (bad) using the same javascript code ebaY has bandaged and patched their problems with.
TAG feels ebaY should be responsible to reimburse every buyer who lost money to these scams, since these items were found and reached through legitimate ebaY links, directly from the ebaY site. TAG also recommends that NO purchases be made on ebaY Motors until this huge security gap is fixed. As a temporary work around, TAG further recommends that all users turn off /disable javascript in their browser settings for all of ebaY.Com.
The following images are from an item we found on ebaY today.
The first shows the listing from ebaY's search result
The second shows the item listed on the sellers ebaY item list
The third shows the URL reached when clicking on the link from ebaY's search result page and the item appearing on the ebaY site
The fourth shows the URL now redirected to the scammers site
Much information and assistance with this article came from The Folks at:
EBAY MOTORS SUCKS
And from other TAG subscribers and Gurus
Our thanks to all at Margaritaville for their invaluable assistance and advice.
Sunday, March 05, 2006
The Unannounced ebaY Fee Increases
The Unannounced ebaY Fee Increases
2 Mar 2006
Revised 5 Mar 2006 to add information about the unannounced store fee increase
[Editors Note: We decided to leave both these articles posted so the changes we made would be clearly available for comparison. We found out about the store price increase when a reader emailed us after reading the original 2 March article posted on this blog]
On 18 January 2006, Bill Cobb, president of ebaY North America, announced a price increase for ebaY US. Of course, in the normal ebaY way, it was announced as fee adjustments, made to appear as if it was a minor increase, and that some fee decreases would mitigate the fact that ebaY has increased their fees every year, despite year over year record breaking profitability. As always, the business community looks at this and says that ebaY is justified in charging whatever the market will bear, but it once again puts the lie to ebaY's propaganda about being community based.
The fee increase went into effect on 22 Feb 06. The way the new fees were structured, ebaY reduced the fee on items listed at 99 cents or less from 25 cents to 20 cents, and increased the final value fee on the most common ending price level, an additional one quarter percent (.25%). They made some features free, including picture show and sales reports plus, and reduced fees for the second and third tiers of picture manager (all pretty worthless features, much less expensive and more reliably found from third party service providers). In addition, Bill Cobb said, "There are no changes for eBay Stores fees.", which you will see further along in this article, was a blatant lie on Mr Cobb's part. Despite the unannounced fee increases made to the store listing fees, TAG also expects an increase in store subscription fees, probably in the May/June time frame.
You can see the fee increase announcement at -http://www2.ebay.com/aw/core/200601181327302.html
What ebaY failed to mention, was that there were fee increases they did not tell their sellers about. TAG wonders if these fee increases, which probably border on the illegal, and violated ebaY's own user agreement, were even too sleazy for ebaY to mention in public, or if ebaY felt they could slip them in without anyone noticing. Once word got out and they were questioned about it, they would have probably used their old, "it has always been that way, we just didn't enforce it" line, or some other excuses, complete lies all, that seller's have the invoices to prove. Fortunately erudite TAG subscribers did notice the fee increases, and let us know about them.
There are two sets of ebaY increases, that ebaY failed to mention, or blatantly lied about. The first increase ebaY forget to mention, comes into play when a seller revises a listing to decrease the price of the item in that listing. In the past if the seller decreased the price of a listing, so that it took the listing into a lower fee category, ebaY would refund the difference. Just as, if the seller increased the price of a listing, ebaY would add the extra fee to the seller's bill. Now what ebaY is doing, is not refunding the difference in fees, in the case of a decreased price, but is still adding the increased fee when an item is revised to increase the price. This also probably applies to the reserve fee, when the change to the fee is based on a lowered reserve price. ebaY explicitly mentions, " Reduce the start price of your item. (You will not receive credit for the difference in your insertion fees.)" but does not address other fees, such as listing duration fees, or other items you might revise. See the revise your listing info at -
http://pages.ebay.com/help/sell/edit_listing.html
For example, if you look at the fee schedule at -
http://pages.ebay.com/help/sell/fees.html
If you start a listing at $59.99, the insertion fee would be $2.40. You then later revise it to $49.99. ebaY will not refund the $1.20 difference, they will keep it. But if you start an item at $49.99, you will be charged $1.20, and then later revise that to $59.99, ebaY will charge you the extra $1.20 to bring the listing fee up to $2.40.
The only place you can see this fee change is on the revise your listing page. But since that page is included in the user agreement by default (as are all ebaY's little back doors hiding information), ebaY will claim you agreed to this change by using their site. TAG argues that this is an illegal rule, keeping fees they are not entitled to, but until someone successfully sues them over this issue, or media attention shames them into a change, it will be the ebaY law.
The second fee increases were made in the stores, by removing the 60, 90 and 120 day listing durations. The only option now open to store users is 30 day and Good till Cancelled (GTC). All the listing upgrade fees are now charged every 30 days, and that change causes increases that range up to 300% (depending on duration) for those who previously used 60/90/120 day durations. The fee increases are shown as follows:
Gallery was 1 cent for 120 days and now costs 1 cent each 30 day period
Listing Designer (see note) was 10 cents for 120 days, and now cost 10 cents for each 30 day period.
(Note) No charge for listing designer for Blackthorne Basic, Blackthorne Pro, or Selling Manager Pro subscribers.
Highlight was $11 for 120 days, and now costs $5 each 30 day period.
Featured in Search was $34.95 for 120 days, and now costs $19.95 each 30 day period
Additional pictures were 45 cents for 120 days, and now costs 15 cents each 30 day period
Supersize pictures were $1.50 for 120 days, and now costs 75 cents each 30 day period
Picture Pack was $3.01 for 120 days, and now costs 76 cents each 30 day period
There is one price reduction, and that is for the Picture Show which was 55 cents for 120 days, and is now free
You can see the old stores fee schedule at - http://snipurl.com/n723
And the current store fees at - http://pages.ebay.com/help/sell/storefees.html
Once again ebaY shows how willingly and blatantly it lies. When the President of North America, can post that there are no fee increases in stores, when there were increases, it shows how deeply corrupt ebaY and its management is.
2 Mar 2006
Revised 5 Mar 2006 to add information about the unannounced store fee increase
[Editors Note: We decided to leave both these articles posted so the changes we made would be clearly available for comparison. We found out about the store price increase when a reader emailed us after reading the original 2 March article posted on this blog]
On 18 January 2006, Bill Cobb, president of ebaY North America, announced a price increase for ebaY US. Of course, in the normal ebaY way, it was announced as fee adjustments, made to appear as if it was a minor increase, and that some fee decreases would mitigate the fact that ebaY has increased their fees every year, despite year over year record breaking profitability. As always, the business community looks at this and says that ebaY is justified in charging whatever the market will bear, but it once again puts the lie to ebaY's propaganda about being community based.
The fee increase went into effect on 22 Feb 06. The way the new fees were structured, ebaY reduced the fee on items listed at 99 cents or less from 25 cents to 20 cents, and increased the final value fee on the most common ending price level, an additional one quarter percent (.25%). They made some features free, including picture show and sales reports plus, and reduced fees for the second and third tiers of picture manager (all pretty worthless features, much less expensive and more reliably found from third party service providers). In addition, Bill Cobb said, "There are no changes for eBay Stores fees.", which you will see further along in this article, was a blatant lie on Mr Cobb's part. Despite the unannounced fee increases made to the store listing fees, TAG also expects an increase in store subscription fees, probably in the May/June time frame.
You can see the fee increase announcement at -http://www2.ebay.com/aw/core/200601181327302.html
What ebaY failed to mention, was that there were fee increases they did not tell their sellers about. TAG wonders if these fee increases, which probably border on the illegal, and violated ebaY's own user agreement, were even too sleazy for ebaY to mention in public, or if ebaY felt they could slip them in without anyone noticing. Once word got out and they were questioned about it, they would have probably used their old, "it has always been that way, we just didn't enforce it" line, or some other excuses, complete lies all, that seller's have the invoices to prove. Fortunately erudite TAG subscribers did notice the fee increases, and let us know about them.
There are two sets of ebaY increases, that ebaY failed to mention, or blatantly lied about. The first increase ebaY forget to mention, comes into play when a seller revises a listing to decrease the price of the item in that listing. In the past if the seller decreased the price of a listing, so that it took the listing into a lower fee category, ebaY would refund the difference. Just as, if the seller increased the price of a listing, ebaY would add the extra fee to the seller's bill. Now what ebaY is doing, is not refunding the difference in fees, in the case of a decreased price, but is still adding the increased fee when an item is revised to increase the price. This also probably applies to the reserve fee, when the change to the fee is based on a lowered reserve price. ebaY explicitly mentions, " Reduce the start price of your item. (You will not receive credit for the difference in your insertion fees.)" but does not address other fees, such as listing duration fees, or other items you might revise. See the revise your listing info at -
http://pages.ebay.com/help/sell/edit_listing.html
For example, if you look at the fee schedule at -
http://pages.ebay.com/help/sell/fees.html
If you start a listing at $59.99, the insertion fee would be $2.40. You then later revise it to $49.99. ebaY will not refund the $1.20 difference, they will keep it. But if you start an item at $49.99, you will be charged $1.20, and then later revise that to $59.99, ebaY will charge you the extra $1.20 to bring the listing fee up to $2.40.
The only place you can see this fee change is on the revise your listing page. But since that page is included in the user agreement by default (as are all ebaY's little back doors hiding information), ebaY will claim you agreed to this change by using their site. TAG argues that this is an illegal rule, keeping fees they are not entitled to, but until someone successfully sues them over this issue, or media attention shames them into a change, it will be the ebaY law.
The second fee increases were made in the stores, by removing the 60, 90 and 120 day listing durations. The only option now open to store users is 30 day and Good till Cancelled (GTC). All the listing upgrade fees are now charged every 30 days, and that change causes increases that range up to 300% (depending on duration) for those who previously used 60/90/120 day durations. The fee increases are shown as follows:
Gallery was 1 cent for 120 days and now costs 1 cent each 30 day period
Listing Designer (see note) was 10 cents for 120 days, and now cost 10 cents for each 30 day period.
(Note) No charge for listing designer for Blackthorne Basic, Blackthorne Pro, or Selling Manager Pro subscribers.
Highlight was $11 for 120 days, and now costs $5 each 30 day period.
Featured in Search was $34.95 for 120 days, and now costs $19.95 each 30 day period
Additional pictures were 45 cents for 120 days, and now costs 15 cents each 30 day period
Supersize pictures were $1.50 for 120 days, and now costs 75 cents each 30 day period
Picture Pack was $3.01 for 120 days, and now costs 76 cents each 30 day period
There is one price reduction, and that is for the Picture Show which was 55 cents for 120 days, and is now free
You can see the old stores fee schedule at - http://snipurl.com/n723
And the current store fees at - http://pages.ebay.com/help/sell/storefees.html
Once again ebaY shows how willingly and blatantly it lies. When the President of North America, can post that there are no fee increases in stores, when there were increases, it shows how deeply corrupt ebaY and its management is.
Thursday, March 02, 2006
The Unannounced ebaY Fee Increase
The Unannounced ebaY Fee Increase
2 Mar 2006
On 18 January 2006, Bill Cobb, president of ebaY North America, announced a price increase for ebaY US. Of course, in the normal ebaY way, it was announced as fee adjustments, made to appear as if it was a minor increase, and that some fee decreases would mitigate the fact that ebaY has increased their fees every year, despite year over year record breaking profitability. As always, the business community looks at this and says that ebaY is justified in charging whatever the market will bear, but it once again puts the lie to ebaY's propaganda about being community based.
The fee increase went into effect on 22 Feb 06. The way the new fees were structured, ebaY reduced the fee on items listed at 99 cents or less from 25 cents to 20 cents, and increased the final value fee on the most common ending price level, an additional one quarter percent (.25%). They made some features free, including picture show and sales reports plus, and reduced fees for the second and third tiers of picture manager (all pretty worthless features, much less expensive and more reliably found from third party service providers). And though they did not increase the store fees, TAG does expect an increase in store fees, probably in the May/June time frame.
What ebaY failed to mention, was that there was a fee increase they did not tell their sellers about. TAG wonders if this fee increase, which probably borders on the illegal, was even too sleazy for ebaY to mention in public, or if ebaY felt they could slip it in without anyone noticing. Once word got out and they were questioned about it, they would have probably used their old, "it has always been that way, we just didn't enforce it" line, a complete lie that seller's have the invoices to prove. Fortunately an erudite TAG subscriber did notice, and let us know about it.
The increase ebaY forget to mention, comes into play when a seller revises a listing to decrease the price of the item in that listing. In the past if the seller decreased the price of a listing, so that it took the listing into a lower fee category, ebaY would refund the difference. Just as, if the seller increased the price of a listing, ebaY would add the extra fee to the seller's bill. Now what ebaY is doing, is not refunding the difference in fees, in the case of a decreased price, but is still adding the increased fee when an item is revised to increase the price. This also probably applies to the reserve fee, when the change to the fee is based on a lowered reserve price. ebaY explicitly mentions, " Reduce the start price of your item. (You will not receive credit for the difference in your insertion fees.)" but does not address other fees, such as listing duration fees, or other items you might revise. See the revise your listing info at -
http://pages.ebay.com/help/sell/edit_listing.html
For example, if you look at the fee schedule at -
http://pages.ebay.com/help/sell/fees.html
If you start a listing at $59.99, the insertion fee would be $2.40. You then later revise it to $49.99. ebaY will not refund the $1.20 difference, they will keep it. But if you start an item at $49.99, you will be charged $1.20, and then later revise that to $59.99, ebaY will charge you the extra $1.20 to bring the listing fee up to $2.40.
The only place you can see this fee change is on the revise your listing page. But since that page is included in the user agreement by default (as are all ebaY's little back door hidden information), ebaY will claim you agreed to this change by using their site. TAG argues that this is an illegal rule, keeping fees they are not entitled to, but until someone successfully sues them over this issue, or media attention shames them into a change, it will be the ebaY law.
Want more information on the Online Auction and Trading Industry? Go to -
http://www.auctionguild.com
2 Mar 2006
On 18 January 2006, Bill Cobb, president of ebaY North America, announced a price increase for ebaY US. Of course, in the normal ebaY way, it was announced as fee adjustments, made to appear as if it was a minor increase, and that some fee decreases would mitigate the fact that ebaY has increased their fees every year, despite year over year record breaking profitability. As always, the business community looks at this and says that ebaY is justified in charging whatever the market will bear, but it once again puts the lie to ebaY's propaganda about being community based.
The fee increase went into effect on 22 Feb 06. The way the new fees were structured, ebaY reduced the fee on items listed at 99 cents or less from 25 cents to 20 cents, and increased the final value fee on the most common ending price level, an additional one quarter percent (.25%). They made some features free, including picture show and sales reports plus, and reduced fees for the second and third tiers of picture manager (all pretty worthless features, much less expensive and more reliably found from third party service providers). And though they did not increase the store fees, TAG does expect an increase in store fees, probably in the May/June time frame.
What ebaY failed to mention, was that there was a fee increase they did not tell their sellers about. TAG wonders if this fee increase, which probably borders on the illegal, was even too sleazy for ebaY to mention in public, or if ebaY felt they could slip it in without anyone noticing. Once word got out and they were questioned about it, they would have probably used their old, "it has always been that way, we just didn't enforce it" line, a complete lie that seller's have the invoices to prove. Fortunately an erudite TAG subscriber did notice, and let us know about it.
The increase ebaY forget to mention, comes into play when a seller revises a listing to decrease the price of the item in that listing. In the past if the seller decreased the price of a listing, so that it took the listing into a lower fee category, ebaY would refund the difference. Just as, if the seller increased the price of a listing, ebaY would add the extra fee to the seller's bill. Now what ebaY is doing, is not refunding the difference in fees, in the case of a decreased price, but is still adding the increased fee when an item is revised to increase the price. This also probably applies to the reserve fee, when the change to the fee is based on a lowered reserve price. ebaY explicitly mentions, " Reduce the start price of your item. (You will not receive credit for the difference in your insertion fees.)" but does not address other fees, such as listing duration fees, or other items you might revise. See the revise your listing info at -
http://pages.ebay.com/help/sell/edit_listing.html
For example, if you look at the fee schedule at -
http://pages.ebay.com/help/sell/fees.html
If you start a listing at $59.99, the insertion fee would be $2.40. You then later revise it to $49.99. ebaY will not refund the $1.20 difference, they will keep it. But if you start an item at $49.99, you will be charged $1.20, and then later revise that to $59.99, ebaY will charge you the extra $1.20 to bring the listing fee up to $2.40.
The only place you can see this fee change is on the revise your listing page. But since that page is included in the user agreement by default (as are all ebaY's little back door hidden information), ebaY will claim you agreed to this change by using their site. TAG argues that this is an illegal rule, keeping fees they are not entitled to, but until someone successfully sues them over this issue, or media attention shames them into a change, it will be the ebaY law.
Want more information on the Online Auction and Trading Industry? Go to -
http://www.auctionguild.com
Saturday, January 28, 2006
ebaY = Convicted Thief
ebaY = Convicted Thief
28 Jan 2006
ebaY has been convicted by a court of law for theft. In the polite parlance of white collar business crime, instead of stealing, it is called patent infringement. But theft is when one person knowingly and illegally takes something that does not belong to them, and that is what ebaY did, and for which they have been convicted, guilty as charged.
When Pierre Omyidar first opened AuctionWeb's site on 5 Sep 1995, he allegedly had spent a weekend thinking up the programming code that allowed the auctioning of items on his site. If we give him the benefit of the doubt, we can assume that he failed to do what any inventor of a commercial product should do, and that is check to see if anyone had invented, and patented, the idea first. If Pierre had checked, he would have seen an auction process patent filed in April 1995 by someone named Thomas Woolston, and his company MercExchange. In 1995, it was not as easy as it is today to do such a search, so we give Pierre the benefit of the doubt that he did not know (or care - he was working for General Magic at the time, and probably subject to an invention agreement with them for anything patentable) of the patents existence, but the success of AuctionWeb, which changed to the name ebaY in 1997, would make knowledge of such patents important to the company.
With the growth of ebaY, and the company going public, auction and trading sites started to sprout like mung beans at a vegetarian restaurant. Moves made by ebaY in 1999, adding advertising banners tied to search, interfering with the auction ads already paid for by sellers, along with fee increases, caused seller rebellions and gave birth to a movement called the Million Auction March. This movement moved 2 million listings to Yahoo Auctions, making it a possible contender of note (action on Yahoo's part soon destroyed this advantage). This along with other's wanting to cash in on what appeared to be a goldmine, might have been the impetus for ebaY to get serious about researching the status of patents and see what kind of control they could get on the industry. It was early in 2000 that ebaY contacted Mr Woolston to see if they could buy the several auction and instant buy patents he had invented and registered, some before AuctionWeb/ebaY's launch, and some since.
Negotiations quickly broke down, very unsurprising given ebaY's arrogant attitude, and ebaY dared Mr. Woolston to sue them. Made of stern material, forged in the fire of service in the military and with the CIA, Mr Woolston, an inventor, electrical engineer and patent attorney, did just that. So far Mr Woolston and his company MercExchange, has won against ebaY in federal district court in 2003 for patent numbers 5,845,265 and 6,085,176, the instant buy patent (what ebaY calls buy it now) and a search patent that directly affects Half.Com. The district court would not let Mr Woolston sue for the auction process patent, and would not let him file an injunction against ebaY, shutting down the functions used by ebaY in the violated patents. The case then went to the U.S. Court of Appeals for the Federal Circuit (case 03-1600,-1616). This court ruled in 2005 and upheld ebaY's conviction on the instant buy patent, (5,845,265), said Mr Woolston could sue on the auction process patent (6,202,051), and allowed an injunction against ebaY to stop their willful infringement of Mr Woolston's patents,. This conviction is final as only the Supreme Court of the United States could overturn it, but ebaY chose not to seek such a losing appeal. Instead ebaY filed an appeal to the Supreme Court, (docket 05-130) to try to stop the injunction ordered by the US Court of Appeals. The Supreme Court will hear arguments in March of 2006.
In the interim, ebaY has tried to insult, discredit and isolate Mr Woolston. ebaY has successfully demanded that the Patents and Trademark Office (PTO) review all Mr Woolston's patents ( a common acquiescence on the apart of the PTO in such disputes). So far the PTO has confirmed the validity of Mr Woolston's auction process patent (number 6,202,051), but TAG has no confirmation on the status of 5,845,265 or 6,085,176. ebaY has represented Mr Woolston as a liar, denying that ebaY ever negotiated with him for his patents, and claiming that Mr Woolston changed his patents to cover what ebaY was doing after the fact. As recently as the fall of 2005, when Mr Woolston and some other personnel from MercExchange were invited to attend a non-ebaY run conference of online sellers, ebaY President, Bill Cobb, threatened the folks running the conference that if the folks from MercExchange remained at the conference, he and the ebaY team would leave. The sellers running the conference did what they felt they had to, given ebaY's immature spoiled brat that thinks it is god attitude, and asked the MercExchange folks to leave. The MercExchange folks, being grown ups, left the conference without a fuss, leaving conference attendees to shake their heads at ebaY's adolescent behavior.
Information Sources
USPTO Patent Number Search -
http://patft.uspto.gov/netahtml/srchnum.htm
Supreme Court MercEx vs ebaY Docket
http://www.supremecourtus.gov/docket/05-130.htm
US Court of Appeals decision PDF download
http://www.auctionguild.com/03-1600.pdf
Various people at MercExchange
ebaY SEC filings
28 Jan 2006
ebaY has been convicted by a court of law for theft. In the polite parlance of white collar business crime, instead of stealing, it is called patent infringement. But theft is when one person knowingly and illegally takes something that does not belong to them, and that is what ebaY did, and for which they have been convicted, guilty as charged.
When Pierre Omyidar first opened AuctionWeb's site on 5 Sep 1995, he allegedly had spent a weekend thinking up the programming code that allowed the auctioning of items on his site. If we give him the benefit of the doubt, we can assume that he failed to do what any inventor of a commercial product should do, and that is check to see if anyone had invented, and patented, the idea first. If Pierre had checked, he would have seen an auction process patent filed in April 1995 by someone named Thomas Woolston, and his company MercExchange. In 1995, it was not as easy as it is today to do such a search, so we give Pierre the benefit of the doubt that he did not know (or care - he was working for General Magic at the time, and probably subject to an invention agreement with them for anything patentable) of the patents existence, but the success of AuctionWeb, which changed to the name ebaY in 1997, would make knowledge of such patents important to the company.
With the growth of ebaY, and the company going public, auction and trading sites started to sprout like mung beans at a vegetarian restaurant. Moves made by ebaY in 1999, adding advertising banners tied to search, interfering with the auction ads already paid for by sellers, along with fee increases, caused seller rebellions and gave birth to a movement called the Million Auction March. This movement moved 2 million listings to Yahoo Auctions, making it a possible contender of note (action on Yahoo's part soon destroyed this advantage). This along with other's wanting to cash in on what appeared to be a goldmine, might have been the impetus for ebaY to get serious about researching the status of patents and see what kind of control they could get on the industry. It was early in 2000 that ebaY contacted Mr Woolston to see if they could buy the several auction and instant buy patents he had invented and registered, some before AuctionWeb/ebaY's launch, and some since.
Negotiations quickly broke down, very unsurprising given ebaY's arrogant attitude, and ebaY dared Mr. Woolston to sue them. Made of stern material, forged in the fire of service in the military and with the CIA, Mr Woolston, an inventor, electrical engineer and patent attorney, did just that. So far Mr Woolston and his company MercExchange, has won against ebaY in federal district court in 2003 for patent numbers 5,845,265 and 6,085,176, the instant buy patent (what ebaY calls buy it now) and a search patent that directly affects Half.Com. The district court would not let Mr Woolston sue for the auction process patent, and would not let him file an injunction against ebaY, shutting down the functions used by ebaY in the violated patents. The case then went to the U.S. Court of Appeals for the Federal Circuit (case 03-1600,-1616). This court ruled in 2005 and upheld ebaY's conviction on the instant buy patent, (5,845,265), said Mr Woolston could sue on the auction process patent (6,202,051), and allowed an injunction against ebaY to stop their willful infringement of Mr Woolston's patents,. This conviction is final as only the Supreme Court of the United States could overturn it, but ebaY chose not to seek such a losing appeal. Instead ebaY filed an appeal to the Supreme Court, (docket 05-130) to try to stop the injunction ordered by the US Court of Appeals. The Supreme Court will hear arguments in March of 2006.
In the interim, ebaY has tried to insult, discredit and isolate Mr Woolston. ebaY has successfully demanded that the Patents and Trademark Office (PTO) review all Mr Woolston's patents ( a common acquiescence on the apart of the PTO in such disputes). So far the PTO has confirmed the validity of Mr Woolston's auction process patent (number 6,202,051), but TAG has no confirmation on the status of 5,845,265 or 6,085,176. ebaY has represented Mr Woolston as a liar, denying that ebaY ever negotiated with him for his patents, and claiming that Mr Woolston changed his patents to cover what ebaY was doing after the fact. As recently as the fall of 2005, when Mr Woolston and some other personnel from MercExchange were invited to attend a non-ebaY run conference of online sellers, ebaY President, Bill Cobb, threatened the folks running the conference that if the folks from MercExchange remained at the conference, he and the ebaY team would leave. The sellers running the conference did what they felt they had to, given ebaY's immature spoiled brat that thinks it is god attitude, and asked the MercExchange folks to leave. The MercExchange folks, being grown ups, left the conference without a fuss, leaving conference attendees to shake their heads at ebaY's adolescent behavior.
Information Sources
USPTO Patent Number Search -
http://patft.uspto.gov/netahtml/srchnum.htm
Supreme Court MercEx vs ebaY Docket
http://www.supremecourtus.gov/docket/05-130.htm
US Court of Appeals decision PDF download
http://www.auctionguild.com/03-1600.pdf
Various people at MercExchange
ebaY SEC filings
Subscribe to:
Posts (Atom)
