« Test Your Scam Awareness | Main | Huge Spam Spike on 9 August 2007 »

August 09, 2007

One of the eBay phisher tactics is to send a message that tries to look like an official eBay message triggered by a participant in one of your eBay auctions. Legitimate eBay participants jealously guard their feedback ratings. The last thing they want to have happen is an unhappy buyer/seller leaving negative feedback.

In a new eBay phishing message I saw tonight, the phisher throws another log on the threat fire. The message is in the form of the official-looking "Question about Item" mailing that normally comes from eBay's messaging system. Of course, there are a couple of things wrong with the message to the trained eye:

• The entire message is in the form of an image downloaded from a hijacked web site.
• The message fails to address me by my eBay ID, saying, instead, "eBay sent this message to seller."
• The item number in the Subject: line doesn't even come close to matching the item number described in the "body" of the message.
• The link goes to a hijacked web site in the Balkans, not to eBay.

If you're not enough on the ball to recognize these failings, you may be terrified by the message body, which I transcribe here exactly as shown in the image:

Look, There are now 3 months since I paied for the item and I still didn't receive it. This is my last warning : unless you solve the problem the first thing I shall report you to ebay and second I shall go to the police .

I am loosing my patience... i will wait your reply !!!

That threat will certainly get some recipients to click on the link to view the item description. The link, as I said, is to a Serbian server, which redirects to not one, but two other servers, eventually landing you at a hijacked Romanian web site, showing the eBay login screen asking for username and password.

Interestingly, if you try to click the link in the message a second time, software planted by the phisher on the Serbian server will not redirect the link to the phony site, but, rather, to the real eBay site (the front page, not the login screen). This tactic, trying to trick (I suppose) antiphishing pholks, is not new (a few malware loading redirectors have been doing this for at least a year), but rather rare among phishing sites. It may be a new feature available in the phishing kits sold by master crooks.

Just another day in the life a social engineer.