Best phishing I've ever seen!

[cgallery]

Had a customer drop-off her notebook. Said IE was crashing a lot. My wife ran it for an hour or two w/o incident. I decided to give it a shot.

I ran for about an hour and didn't notice anything suspect. Was looking at eBay auctions and wanted to look up some auction history (which requires an SSL-encrypted signin). The images below show what came-up after I entered my user name and password.

I ran back to my machine to change my password on my eBay account as quickly as I could.

I have the hard drive out of the problem notebook now, scanning it w/ corporate Symantec, McAfee, etc.. Wonder what I'll find. AVG, BTW, is giving it a thumbs-up. And there is nothing funny in hosts.

What is very strange is how this was injected. It would seem as something is running in the stack injecting this garbage when you visit sites that ask for security information. Very well done.

[JSUPreston]

Man, that is nasty. Usually when I see a machine that FUBARed, I fdisk. Seems like everytime I clean up one that gets that kind of infection, it never runs quite right again.

You probably already know this, but I'd also run Trend Micro's online scanner. I have also had a lot of luck with SuperAntiSpyware lately. Seems to catch some stuff AdAware misses. I haven't been pleased with Spybot S&D for a while now.

[germdoc]

Don't know if it's quite as good as this Phishing, but it looks pretty convincing...

[Uncle Cracker]

What I find amazing is how somebody with such obvious resourcefulness can perpetrate an elaborate hoax, and still get enough grammar wrong to invalidate the desired authentic look of the scam.

[cgallery]

What I find amazing is how somebody with such obvious resourcefulness can perpetrate an elaborate hoax, and still get enough grammar wrong to invalidate the desired authentic look of the scam.

True. In this case, had they not used words like "fraudsters," and perhaps only asked for my CC information (saying, for instance, that my CC on file had expired), they may have not raised my suspicion.

But you're right, the technical achievement is there. The grammatical problems will get fixed in time.

[Uncle Cracker]

There is also "We have noticed an increasing fraudulent activity..." and "Please enter as more information as possible...", not to mention the copyright date of 2005...

[OpaDC]

I'm not an ebay person so I don't know how it works. But I do know that a link within a legitimate website should NOT come back with something like that. Especially an SSL page that should be verified by Verisign or someone. Looks to me like ebay has been hacked and their main page hijacked. If you haven't already, you should contact ebay to let them know what is going on.

[Schleeper]

I AM an eBay seller (ID johnnyk,) and I get this stuff all the time. In addition to the lousy spelling and grammar, what really gives it away is the fact that it's a "Dear user" message. Communications from eBay are addressed using your name and ID. Also, they're verifiable using eBay's version of Private Messaging. When they show up, I don't click on any of the hyperlinks; I simply forward them to spoof@ebay.com.

In addition to the ones that say your account's been compromised (requiring immediate action to avoid account suspension,) there are the bogus messages from "buyers," asking why you haven't sent the item they paid for. They don't say what the item is; there's only an item number (which you can click on, of course.)

I'm with you, UC. Why do people choose to funnel their talents and efforts in that direction?

[BobSch]

Ant time I get anything that asks me for financial data, I always clear my browser's cache and manually type in the homepage URL such as ebay.com or amazon.com etc. and navigate from there. It's too easy to display a fake address — it can LOOK like a valid addy, but it's not.

[germdoc]

I'm with you, UC. Why do people choose to funnel their talents and efforts in that direction?

$$$$$$$$$$$

[chopnhack]

Sounds like a Nigerian 409!

[jgrobler]

For websites that I have registered for, like Ebay, nowadays I usually will first enter an incorrect password, if the site accepts it, you know it's a phishing scam. (After I almost step into one myself a few months ago)

[cgallery]

Well, I "chatted" w/ eBay this evening. I explained that I had been browsing the sight w/o incident for several minutes. It was only when I did an advanced search and selected "Completed listings" that I had a problem. That, I entered my user name and password, and then the phishing screen came up.

After explaining all of that to the first guy ("Alex"), he thought I should talk w/ someone in security. So I got to "chat" with "Oz" (which I thought was a pretty good handle for someone with his job description).

Anyway, he had me go over it about ten times, then said there had been no compromise in their security, but that they will look into it.

So who knows. So far Symantec hasn't found anything on that machine's drive. Nor AVG. Trend is running now.

[Schleeper]

Well, I "chatted" w/ eBay this evening. I explained that I had been browsing the sight w/o incident for several minutes. It was only when I did an advanced search and selected "Completed listings" that I had a problem. That, I entered my user name and password, and then the phishing screen came up.

After explaining all of that to the first guy ("Alex"), he thought I should talk w/ someone in security. So I got to "chat" with "Oz" (which I thought was a pretty good handle for someone with his job description).

Anyway, he had me go over it about ten times, then said there had been no compromise in their security, but that they will look into it.

So who knows. So far Symantec hasn't found anything on that machine's drive. Nor AVG. Trend is running now.

I totally misread your initial post on this. I thought you had clicked on a link in an email, which brought you to the phishing screens.

You obviously have more experience in dealing with this type of thing than I do. Just out of curiosity, have you or the gnomes at eBay been able to duplicate what happened before? Do you remember what the subject and search criteria of your search was?

[cgallery]

I totally misread your initial post on this. I thought you had clicked on a link in an email, which brought you to the phishing screens.

You obviously have more experience in dealing with this type of thing than I do. Just out of curiosity, have you or the gnomes at eBay been able to duplicate what happened before? Do you remember what the subject and search criteria of your search was?

I'm working on that this weekend. I'll put the hard drive back into the machine and look at the history of what I was doing yesterday.