Ebay Requests its Customers to Change Passwords after Breach

Threatpost.com reported on 21st May, 2014 stating that the online retail and auction giant Ebay is requesting its customers to change their passwords because the server containing encrypted passwords and other non-financial information has been compromised due to cyberattacks.

Nytimes.com published news on 21st May, 2014 quoting Mark Carges, Chief Technology Officer of Ebay, as saying "We have discovered the breach this month (May 2014) when our internal security team noticed involvement of some employees in unusual activity on its corporate network."

According to news published by usatoday.com on 21st May, 2014, JD Sherry, Vice-President for Technology and Solutions of a computer security firm Trend Micro said that the hackers probably used a "spear phishing" attack to infiltrate Ebay's systems.

In a spear-phishing assault, cybercriminals send a chic email which seems to be from a reliable colleague and when the recipient clicks on the attached file clubbed with the email, it releases a tainted link or a payload and installs malicious software (malware) on the user's computer.

Sherry says that it's very silent and these are cautiously designed slow and low hits that try not to forewarn security of corporate computers.

Sherry added that such breaches remain buried for months permitting hackers to gather huge amounts of information.

According to Sherry, hackers might have collected information such as names, date of births, SSNs, passwords and addresses along with other important details.

Security experts warned that stolen information would make customers of Ebay easy targets for phishing attacks by sending e-mails luring victims into clicking on malicious links or directing them to login fake screens with their more valuable information like Social Security number.

The attack on Ebay demonstrates the vulnerability of even well-established sites having strong security teams with no history of data-breaches before.

Ft.com reported on 21st May, 2014 quoting Jaime Blasco, a Researcher of Cyber Security firm AlienVault as saying "I don't remember anything like this disclosed by Ebay."

Experts said that this incident should make all users alert not to just change their Ebay passwords but also change any passwords that matches this one.

» SPAMfighter News - 5/30/2014