Researchers from Check Point have discovered a flaw affecting eBay's platform that allows hackers to carry out phishing attacks against visitors.
Visitors can be tricked into opening a page on eBay that could expose them to phishing. This is possible because attackers could bypass code validation and execute malicious JavaScript on users through their browser or mobile app.
The attack scenario is very simple. Hackers can target eBay users by sending them a legitimate page containing malicious code. Using social engineering, users can be tricked into opening the page and triggering the execution of the code, which will lead to multiple attack scenarios from phishing to binary download.
If this flaw identified by Check Point is not patched, eBay customers will continue to be exposed and potential phishing attacks will lead to data theft.
Attackers would have to use JSFuck, a non-standard technique. Researchers discovered that although the platform prohibits users from using scripts and iFrames in their descriptions, the validation mechanism fails to detect the JSFuck code!
What is JSFuck?
JSFuck is an internal and educational programming style based on individual parts of JavaScript and uses only 6 characters, []()!+ to write and execute code. eBay does not filter it, allowing attackers to bypass the validation mechanism.
https://www.secnews.gr/100909/wordpress-%ce%b5%cf%80%ce%af%ce%b8%ce%b5%cf%83%ce%b7-%ce%b1%cf%80%cf%8c-whack-a-mole-ad-scam-malware/WordPress: Attack by whack-a-mole ad-scam malware
The bad news is that researchers reported the problem to the platform on December 15th and 2 weeks ago the company stated that it has no intention of fixing it!
Watch the videos that prove the platform's vulnerability:
[su_youtube url=”https://www.youtube.com/watch?v=m4vJxsoYGhY” width=”580″ height=”380″]
[su_youtube url=”https://www.youtube.com/watch?v=5AK0-p_c0kU” width=”580″ height=”380″]
