eBay UK users warned of cross-site scripting attacks in listings

Online auction site falls victim to hackers who've tampered with listings to steal users' login details

eBay sign

eBay has reportedly fallen victim to hackers who altered listings to redirect users to spoof sites set up to steal their login details.

The online auction site has apparently fallen victim to a cross-site scripting attack, whereby hackers inject malicious JavaScript into product listings, which re-direct them to the fake sites.

According to a report on the BBC, the firm was alerted to the links on Wednesday night by eBay Power Seller and IT worker Paul Kerr from Clackmannanshire.

He claims the listing had been live for 35 minutes and, on reporting it to eBay, was assured it would be looked into straightaway.

"You can bet your bottom dollar that somebody's going to click on that and be redirected to a third-party site and they're going to enter their details and be compromised," he said.

However, the BBC said eBay only removed the links 12 hours later after a follow-up call by the broadcaster.

It also reported finding three suspicious links in total during its investigation, two of which redirected users, while the third was removed before it could be checked.

Even so, in a statement, eBay claimed the issue only affected a single item listed on the site.

"This report relates only to a single item listing' on eBay.co.uk whereby the users has included a link which redirects users away from the listing page," the spokesperson said.

"We take the safety of our marketplace very seriously and are removing the listing as it is in violation of our policy on third-party links."

The issue is the latest in a long line of tech issues to hit eBay this year, which have seen it suffer recurrent outages and a large-scale hack that resulted in millions of the site's users having their login details stolen. 

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Recommended

Your essential guide to internet security
Security

Your essential guide to internet security

23 Sep 2020
How to enable private browsing on any device
privacy

How to enable private browsing on any device

22 Sep 2020
Third-party apps are tracking your WhatsApp activity
social media

Third-party apps are tracking your WhatsApp activity

21 Sep 2020
Ransomwiz lets you test your security with simulated ransomware
ransomware

Ransomwiz lets you test your security with simulated ransomware

21 Sep 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
Windows Server flaw sparks emergency US gov warning
vulnerability

Windows Server flaw sparks emergency US gov warning

21 Sep 2020