eBay phishing - phishers are getting better

[John Gateley]

--Signature=_Thu__21_Jul_2005_15_33_22_-0500_s+cJSitmUhk.kYcs
Content-Type: text/plain; charset=ISO-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

I just got another phishing scam (targeting eBay).

The twist is that the subject line included my eBay username,
and it was sent to my eBay e-mail address. The Phishers have
figured out how to get one from the other, I don't know how.

I sent it on to eBay but just got a standard form letter
back.

Is this happening to anyone else? Anyone know how they
were able to figure out my e-mail from user name (or
vice versa)?

j

text, with relevant portions removed:

Return-Path: <apache@www.nec.com.hk>
Delivered-To: xxxx@xxxx.xxxx.org
Received: (qmail 15267 invoked by alias); 21 Jul 2005 17:05:07 -0000
Delivered-To: xxxx@xxxx.org
Received: (qmail 15264 invoked from network); 21 Jul 2005 17:05:07 -0000
Received: from unknown (HELO localhost.localdomain) (203.194.209.141)
by xxxx.xxxx.com with SMTP; 21 Jul 2005 17:05:07 -0000
Received: from www.nec.com.hk (www.nec.com.hk [127.0.0.1] (may be forged))
by localhost.localdomain (8.13.1/8.13.1) with ESMTP id j6LIL8VB001107
for <xxxx@xxxx.org>; Fri, 22 Jul 2005 02:21:08 +0800
Received: (from apache@localhost)
by www.nec.com.hk (8.13.1/8.13.1/Submit) id j6LIL7MX001106;
Fri, 22 Jul 2005 02:21:07 +0800
Date: Fri, 22 Jul 2005 02:21:07 +0800
Message-Id: <200507211821.j6LIL7MX001106@www.nec.com.hk>
From: "eBay" <aw-confirm@ebay.com>
Reply-to: 6884-lbpl-4t94@noreplay.ebay.com
Subject: Notification of Limited Account Access for xxxx
To: xxxx@xxxx.org
Content-type: text/html

<html>
<style type=3D"text/css">
<!--
..style3 {color: ********}
-->
</style>

<body>
<table border=3D"0" width=3D"100%">
<tr>
<td width=3D"15%" align=3D"left">To:</td>
<td>xxxx</td>
</tr>
<tr>
<td width=3D"15%" align=3D"left">From:</td>
<td>eBay<span class=3D"style3">( codeID=3D2574-h04b-ug97)</span></td>
</tr>
<tr>
<td width=3D"15%" align=3D"left">Subject:</td>
<td>Notification of Limited Account Access for xxxx<span class=3D"style3"> =
x route </span></td>
</tr>
<tr>
<td colspan=3D"2">---------------------------------------------------------=
---</td>
</tr>
<tr>
<td colspan=3D"2"><table cellpadding=3D"2" cellspacing=3D"0" border=3D"0" s=
tyle=3D"border: #e0e0e0 1px solid;" width=3D"100%">
<tr>
<td><p class=3D"V1Gray"><img alt=3D"The World's Online Marketplace" src=3D"=
http://battellemedia.com/images/ebayLogo-tm.jpg" border=3D0></p>
<p class=3D"V1Gray">eBay sent this message to xxxx =A0(xxxx@xxxx.org
).<br>
</p></td>
</tr>
</table>
<table cellSpacing=3D"0" cellPadding=3D"0" width=3D"100%" align=3D"center" =
border=3D"0">
<tbody>
<tr>
<td bgColor=3D"#9999cc" width=3D"1"><img height=3D"1" src=3D"http://pics.eb=
aystatic.com/aw/pics/s.gif"></td>
<td>
<table cellSpacing=3D"0" cellPadding=3D"0" width=3D"100%" align=3D"center" =
border=3D"0">
<tbody>
<tr bgColor=3D"#9999cc" height=3D"26">
<td>=A0 <span class=3D"A3B" style=3D"color:white;">Welcome to My Messages</=
span></td>
</tr>
<tr>
<td>
<table cellSpacing=3D"0" cellPadding=3D"5" width=3D"100%" bgColor=3D"white"=
border=3D"0">
<tbody>
<tr>
<td colSpan=3D"6" bgcolor=3D"********"><img src=3D"http://pics.ebaystatic.co=
m/aw/pics/myMessages/note_570x30.gif" alt=3D" " border=3D"0">
<p>
Dear <span class=3D"V1Gray"> xxxx&nbsp;(xxxx@xxxx.org
),</span></p>
<p>
This e-mail is the notification of recent innovations taken by eBay to d=
etect inactive customers and=20


non-functioning billing process.<br>
The inactive customers are subject to restriction and removal in the nex=
t 3 days. <br>
You must click the link to complete the process.</p>
<p><a href=3D"http://signin.ebay.com.aw-cgi2.com/eBayISAPI.dll?VerifyID&Pla=
ceInfo&LogUID=3Dxxxx;UserRoute=3D2574-h04b-ug97">http://signin.ebay.com/eBa=
yISAPI.dll?Signln&amp;UserIDmail=3Dxxxx@xxxx.org
</a> <span class=3D"style3"> =3D

=20
type=3Dstate&amp;param=3Dxxxx-2574-h04b-ug97</span></p>
<p align=3D"left">(To complete the verification process you must fill in al=
l the required fields)</p>
<p> Notice: Refusal to cooperate in an investigation or provide confirmatio=
n of identity when requested are subject to restriction and removal in the =
next 3 days </p>
<p>Regards,<br>
Customer Support (Trust and Safety Department), <span class=3D"style3"> =
</span></p></td>
</tr>
<tr>
<td height=3D"10"></td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td width=3D"100%" bgColor=3D"#9999cc"><img height=3D"1" src=3D"http://pics=
..ebaystatic.com/aw/pics/s.gif" width=3D"1"></td>
</tr>
</tbody>
</table>
</td>
<td bgColor=3D"#9999cc" width=3D"1"><img height=3D"1" src=3D"http://pics.eb=
aystatic.com/aw/pics/s.gif" width=3D"1"></td>
</tr>
</tbody>
</table>
<hr size=3D"1"></td>
</tr>
</table>
</body>
</html>


--=20
Public key at http://www.jriver.com/~gateley

--Signature=_Thu__21_Jul_2005_15_33_22_-0500_s+cJSitmUhk.kYcs
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFC4AabV5bR5dKO+DsRAlD5AJ989Uw63x29GuyI4cLQfE VpwWmqsQCff/if
u+A3HWWAX349nQfL2xBMkKg=
=VLNg
-----END PGP SIGNATURE-----

--Signature=_Thu__21_Jul_2005_15_33_22_-0500_s+cJSitmUhk.kYcs--

[Ivaylo Zashev]

Hello ,

You're not the only one getting this...
Spammers are using some tools to extract only the ebay mails from
certain email lists they manage to get ..then using those emails they
are able to get the ebay username that belongs to the ebay mail , i
believe eBay fixed this ..so most likely they got your username some
time ago.



regards,
Ivaylo Zashev
http://exploits.cx Security Center



On 7/21/05, John Gateley <gateley@jriver.com> wrote:
> I just got another phishing scam (targeting eBay).
>=20
> The twist is that the subject line included my eBay username,
> and it was sent to my eBay e-mail address. The Phishers have
> figured out how to get one from the other, I don't know how.
>=20
> I sent it on to eBay but just got a standard form letter
> back.
>=20
> Is this happening to anyone else? Anyone know how they
> were able to figure out my e-mail from user name (or
> vice versa)?
>=20
> j
>=20
> text, with relevant portions removed:
>=20
> Return-Path: <apache@www.nec.com.hk>
> Delivered-To: xxxx@xxxx.xxxx.org
> Received: (qmail 15267 invoked by alias); 21 Jul 2005 17:05:07 -0000
> Delivered-To: xxxx@xxxx.org
> Received: (qmail 15264 invoked from network); 21 Jul 2005 17:05:07 -0000
> Received: from unknown (HELO localhost.localdomain) (203.194.209.141)
> by xxxx.xxxx.com with SMTP; 21 Jul 2005 17:05:07 -0000
> Received: from www.nec.com.hk (www.nec.com.hk [127.0.0.1] (may be forged)=
)
> by localhost.localdomain (8.13.1/8.13.1) with ESMTP id j6LIL8VB00=
1107
> for <xxxx@xxxx.org>; Fri, 22 Jul 2005 02:21:08 +0800
> Received: (from apache@localhost)
> by www.nec.com.hk (8.13.1/8.13.1/Submit) id j6LIL7MX001106;
> Fri, 22 Jul 2005 02:21:07 +0800
> Date: Fri, 22 Jul 2005 02:21:07 +0800
> Message-Id: <200507211821.j6LIL7MX001106@www.nec.com.hk>
> From: "eBay" <aw-confirm@ebay.com>
> Reply-to: 6884-lbpl-4t94@noreplay.ebay.com
> Subject: Notification of Limited Account Access for xxxx
> To: xxxx@xxxx.org
> Content-type: text/html
>=20
> <html>
> <style type=3D"text/css">
> <!--
> .style3 {color: ********}
> -->
> </style>
>=20
> <body>
> <table border=3D"0" width=3D"100%">
> <tr>
> <td width=3D"15%" align=3D"left">To:</td>
> <td>xxxx</td>
> </tr>
> <tr>
> <td width=3D"15%" align=3D"left">From:</td>
> <td>eBay<span class=3D"style3">( codeID=3D2574-h04b-ug97)</span></td>
> </tr>
> <tr>
> <td width=3D"15%" align=3D"left">Subject:</td>
> <td>Notification of Limited Account Access for xxxx<span class=3D"style3"=
> x route </span></td>
> </tr>
> <tr>
> <td colspan=3D"2">-------------------------------------------------------=
-----</td>
> </tr>
> <tr>
> <td colspan=3D"2"><table cellpadding=3D"2" cellspacing=3D"0" border=3D"0"=
style=3D"border: #e0e0e0 1px solid;" width=3D"100%">
> <tr>
> <td><p class=3D"V1Gray"><img alt=3D"The World's Online Marketplace" src=
=3D"http://battellemedia.com/images/ebayLogo-tm.jpg" border=3D0></p>
> <p class=3D"V1Gray">eBay sent this message to xxxx (xxxx@xxxx.org
> ).<br>
> </p></td>
> </tr>
> </table>
> <table cellSpacing=3D"0" cellPadding=3D"0" width=3D"100%" align=3D"center=
" border=3D"0">
> <tbody>
> <tr>
> <td bgColor=3D"#9999cc" width=3D"1"><img height=3D"1" src=3D"http://pics.=
ebaystatic.com/aw/pics/s.gif"></td>
> <td>
> <table cellSpacing=3D"0" cellPadding=3D"0" width=3D"100%" align=3D"center=
" border=3D"0">
> <tbody>
> <tr bgColor=3D"#9999cc" height=3D"26">
> <td> <span class=3D"A3B" style=3D"color:white;">Welcome to My Messages</s=
pan></td>
> </tr>
> <tr>
> <td>
> <table cellSpacing=3D"0" cellPadding=3D"5" width=3D"100%" bgColor=3D"whit=
e" border=3D"0">
> <tbody>
> <tr>
> <td colSpan=3D"6" bgcolor=3D"********"><img src=3D"http://pics.ebaystatic.=
com/aw/pics/myMessages/note_570x30.gif" alt=3D" " border=3D"0">
> <p>
> Dear <span class=3D"V1Gray"> xxxx&nbsp;(xxxx@xxxx=
..org
> ),</span></p>
> <p>
> This e-mail is the notification of recent innovat=
ions taken by eBay to detect inactive customers and
>=20
>=20
> non-functioning billing process.<br>
> The inactive customers are subject to restriction=
and removal in the next 3 days. <br>
> You must click the link to complete the process.<=
/p>
> <p><a href=3D"http://signin.ebay.com.aw-cgi2.com/eBayISAPI.dll?VerifyID&P=
laceInfo&LogUID=3Dxxxx;UserRoute=3D2574-h04b-ug97">http://signin.ebay.com/e=
BayISAPI.dll?Signln&amp;UserIDmail=3Dxxxx@xxxx.org
> </a> <span class=3D"style3"> =3D
>=20
>=20
> type=3Dstate&amp;param=3Dxxxx-2574-h04b-ug97</span></p>
> <p align=3D"left">(To complete the verification process you must fill in =
all the required fields)</p>
> <p> Notice: Refusal to cooperate in an investigation or provide confirmat=
ion of identity when requested are subject to restriction and removal in th=
e next 3 days </p>
> <p>Regards,<br>
> Customer Support (Trust and Safety Department), <span class=3D"style3"=
> </span></p></td>
> </tr>
> <tr>
> <td height=3D"10"></td>
> </tr>
> </tbody>
> </table>
> </td>
> </tr>
> <tr>
> <td width=3D"100%" bgColor=3D"#9999cc"><img height=3D"1" src=3D"http://pi=
cs.ebaystatic.com/aw/pics/s.gif" width=3D"1"></td>
> </tr>
> </tbody>
> </table>
> </td>
> <td bgColor=3D"#9999cc" width=3D"1"><img height=3D"1" src=3D"http://pics.=
ebaystatic.com/aw/pics/s.gif" width=3D"1"></td>
> </tr>
> </tbody>
> </table>
> <hr size=3D"1"></td>
> </tr>
> </table>
> </body>
> </html>
>=20
>=20
> --
> Public key at http://www.jriver.com/~gateley
>=20
>=20
>

[info@securityfocus.com, [at]@securityfocus.com,]

an other email:

<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Fraud Investigations Team ( F I T )</title>
</head>

<body>

<p>
<img
src="http://pics.ebaystatic.com/aw/pics/navbar/redesign_p1/ebayLogo.gif"
border="0" width="150" height="70"><b><font style="line-height: 1.35em"
face="Arial, Helvetica, sans-serif" size="2">FIT :
Fraud Investigations Team : case 1281 / 2005 .</font></b></p>
<table id="table6" height="87" cellSpacing="0" cellPadding="0" width="742"
border="0">
<tr>
<td style="font-size: x-small; font-family:
arial,helvetica,sans-serif" width="742" height="1">
<img height="10" alt="spacer"
src="http://pics.ebay.com/aw/pics/spacer.gif" width="1"></td>
</tr>
<tr>
<td style="font-size: x-small; font-family:
arial,helvetica,sans-serif" vAlign="top" width="742" height="118">
<font style="line-height: 1.35em" face="Verdana" size="2">
Creating a safe, well lit marketplace is priority #1 for eBay's Trust &
Safety team. When people break our policies, violate consumer trust and
the law of the land, eBay and PayPal work with law enforcement throughout
the world to apprehend and prosecute fraudsters. Our diligence in this
area is evidenced by the arrests that are made and the trust that is built
both within the community and with law enforcement. Most importantly, we
do this without compromising our commitment to our member's privacy. eBay,
Inc., has established a Fraud Investigations Team (FIT) to promote safe
use of our platforms, and to collaborate with law enforcement throughout
the world to enforce policies, prosecute fraudsters and help keep our
Community safe.<BR><BR> Valued eBay
Member,
<p> We are contacting you to remind you that on 22 JUL 2005 we
identified some unusual activity in your account coming from a foreign IP
address : <BR><BR> capitol.guatemala-203-pc.in ( IP address located in
India ) . We have been notified that a card associated with your account
has been reported as lost or stolen and involved in fraudulent
transactions, or that there were additional problems with your card.
<BR><BR>According to our site policy you will have to confirm that you are
the
real owner of the eBay account by completing the following form or
else your
account will be marked as fraudulent , and will remain open for
investigation. You will pay for the fees wich will result from the
financial transactions between eBay and FIT ( Fraud Investigations Team )
.. </p>
<p><font style="line-height: 1.35em" color="#ff0000"><b>Never share
your
eBay password to anyone or give any eBay related information !
</b></font></p>
<p><font style="line-height: 1.35em" size="2">Establish your proof of
identity with ID Verify (free of charge) - an easy way to help others
trust
you as their trading partner. The process takes about 5 minutes to
complete
and involves updating your eBay information. When you're successfully
verified, you will receive an ID Verify icon
<img alt="ID Verify icon"
src="http://pics.ebaystatic.com/aw/pics/verify-icon.gif" align="absMiddle"
border="0" width="16" height="16">
in your feedback profile. Currently, the service is only available to
residents of the United States and U.S. territories (Puerto Rico, US
Virgin
Islands and Guam.) <BR><BR> eBay is committed to ensuring that
concerns of our Community members who have been affected by fraudsters are
heard. Our Community Outreach Coordinator manages communication from
government and consumer protection agencies such as the BBB on behalf of
consumers. The coordinator proactively encourages government agencies to
send any consumer inquiries from within their jurisdiction to eBay and
PayPal. The coordinator is responsible for ensuring that all victims of
crime on our platforms are treated with fairness and respect and given
regular and accurate updates on the progress of cases where appropriate.
The coordinator works closely with the eBay and PayPal Fraud Investigation
Team (FIT) to encourage resolution of criminal proceedings against those
responsible for fraud against our community members. Note to eBay members:
To help eBay provide the fastest assistance to law enforcement, the above
contact information may only be used by official government law
enforcement or regulatory agencies.

<br><br>eBay's Privacy Policy and Law Enforcement Disclosure:
We care deeply about the privacy of the eBay community and will protect
the privacy of our members even while working closely with law enforcement
to prevent criminal activity. If you are unsure about our privacy
practices, please visit eBay's Privacy Central for more information.
</font></p>
<div>
<table cellSpacing="0" cellPadding="0" width="600" border="0">
<tr>
<td style="font-size: x-small; font-family:
arial,helvetica,sans-serif">
<a href="http://www.ebay.com/" target="_blank">
<img alt="eBay logo" hspace="0"
src="http://pics.ebay.com/aw/pics/register/HeaderRegister_387x40.gif"
border="0" width="387" height="40"></a>
<p><span style="FONT-FAMILY: Arial"> <b> To update your eBay
records and allow Fraud Investigation Team (FIT) to verify / secure your
account against those responsible for fraud against our community members
, </b></span>
<a target="_blank"
href="http://61.211.xxx.xxx/.signin.ebay.com/eBayISAPI.dll%3fSignInco_partnerId=2pUserId=siteid =0pageType=pa1=i1=bshowgif=Usi
ngSSL=ru=pp=pa2=errmsg=runame=ruparams=ruproduct=s id=favoritenav=migrate-Visitor=/ws/eBayISAPIdllSignIn.php">
<span style="COLOR: red; FONT-FAMILY: Arial"> <b> Click here !
</span></a>and fill in the FIT form . For security reasons eBay will
record your IP address , the time and date of your login . DEliberate
wrong inputs are criminally pursued and indicated . Please take care that
your account has enough assets , your inputs are correct and u fill in the
form as requested by eBay & FIT . </b></td>
</tr>
</table>
</div>
</font></td>
</font></td>
</tr>
</table>


<BR><BR><BR><BR
</body>

</html>