Date:         Tue, 4 Dec 2007 21:31:20 -0700
Reply-To:     "Gary Lee www.vwrack.com" <gary2a@TELUS.NET>
Sender:       Vanagon Mailing List <vanagon@gerry.vanagon.com>
From:         "Gary Lee www.vwrack.com" <gary2a@TELUS.NET>
Subject:      Re: Buying Vans on e-Bay
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed

 >When the hackers and crooks can hijack ebay listings, overlay them
 >with fraudulent links that redirect to dummy cover sites that allow
 >crooks to rip people off for #20K I would and I would say reasonably
 >so, conclude that ebay has a security problem.

eBay's site was not "hacked" to hijack the account.  An ebay user
unwittingly divulged their password to the crook.
The crook then logged into the users account and set up a three day
"buy it now" sale for $17K for a 2006 bmw valued at $65K.  It was not
an auction.
The buyer paid for the car by wiring the money directly to the
crook.  The buyer paid the crook directly, not through paypal.  The
crook had some story about getting a divorce and needing to liquidate
assets quickly.

 >It is the weakness in ebay security that allows this to happen.

It's more a weakness of human nature, imho.  Who would reasonably
expect to actually be able to buy that type of car for that cheap?
Remember, it was not an auction but a fixed price sale.  If it sounds
to good to be true......... you know the rest.

A hacker exploits weaknesses in a web site.  A phisher exploits human
weaknesses (greed, naivete or just not knowing better).  If eBay's
site was ever hacked, eBay would be at fault.  If a phisher is able
to get you to divulge your password, who's fault is that?  I'm not
saying that I've never slipped up.
A couple months ago I logged into my ebay account incorrectly,
fortunately I realized immediately and changed my password right away.

For it's part, eBay should do more to educate people about how to log
into their eBay accounts securely.  NEVER log into your ebay account
through a link.
Thats how the crooks get your password.

Never reply to ebay email that arrives directly in your email inbox.
Carefully type www.ebay.com into your browser, then log into your
account, then go to "your messages", then reply.

Gary