eBay UK users warned of cross-site scripting attacks in listings

Online auction site falls victim to hackers who've tampered with listings to steal users' login details

eBay sign

eBay has reportedly fallen victim to hackers who altered listings to redirect users to spoof sites set up to steal their login details.

The online auction site has apparently fallen victim to a cross-site scripting attack, whereby hackers inject malicious JavaScript into product listings, which re-direct them to the fake sites.

According to a report on the BBC, the firm was alerted to the links on Wednesday night by eBay Power Seller and IT worker Paul Kerr from Clackmannanshire.

He claims the listing had been live for 35 minutes and, on reporting it to eBay, was assured it would be looked into straightaway.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"You can bet your bottom dollar that somebody's going to click on that and be redirected to a third-party site and they're going to enter their details and be compromised," he said.

However, the BBC said eBay only removed the links 12 hours later after a follow-up call by the broadcaster.

It also reported finding three suspicious links in total during its investigation, two of which redirected users, while the third was removed before it could be checked.

Even so, in a statement, eBay claimed the issue only affected a single item listed on the site.

"This report relates only to a single item listing' on eBay.co.uk whereby the users has included a link which redirects users away from the listing page," the spokesperson said.

"We take the safety of our marketplace very seriously and are removing the listing as it is in violation of our policy on third-party links."

Advertisement - Article continues below

The issue is the latest in a long line of tech issues to hit eBay this year, which have seen it suffer recurrent outages and a large-scale hack that resulted in millions of the site's users having their login details stolen. 

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/policy-legislation/data-governance/354496/brexit-security-talks-under-threat-after-uk-accused-of
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020
Visit/policy-legislation/data-protection/354492/currys-pc-world-parent-firm-hit-with-ps500k-fine-over
data protection

Currys PC World parent firm hit with £500k fine over historic data breach

9 Jan 2020
Visit/security/ransomware/354483/travelex-disruption-caused-by-devastating-ransomware-attack
ransomware

Travelex disruption caused by devastating ransomware attack

8 Jan 2020