Menu
eBay hack could result in social engineering schemes

eBay hack could result in social engineering schemes

eBay is directing users to reset passwords, but the larger risk is from the theft of data that could be used to compromise other accounts.

You've probably heard by now that eBay is the latest victim of a massive data breach. The popular online auction site has asked users to reset their passwords as a precautionary measure, but the data that matters most is already compromised, and there is nothing you can do to "reset" it.

Details are still sketchy--sort of standard operating procedure for data breach incidents. What we know is that the breach occurred between February and early March, but was just recently discovered. eBay claims that email addresses, encrypted passwords, names, addresses, telephone numbers, and user's birth dates were compromised.

Because the passwords were encrypted, there is no immediate risk, but it's only a matter of time before attackers are able to decrypt them. It definitely makes sense for eBay users to change their passwords. It's also worth reiterating standard password security practices like making sure you use a strong password, don't use the same one for multiple sites or services, and change them periodically.

But your eBay password may be the least valuable piece of information from the data that was compromised.

"The fact that user email addresses and physical addresses were taken in the breach is more concerning," says Dwayne Melancon, CTO of Tripwire. "Criminals could use that information to masquerade as eBay customers on other sites, or perhaps 'social engineer' their way to users' other accounts. Unlike the passwords, the other user-specific information was not encrypted and therefore it can be easily reused by attackers."

"Many sites can be easily tricked into resetting passwords--requiring a minimum of personal information to do so," says Paul Lipman, CEO of iSheriff. "The non-encrypted personal data that was stolen from eBay could potentially enable users' credentials to become compromised on a wide array of other sites through this kind of social engineering technique."

The attackers can also use information like your phone number, email address, and mailing address for targeted phishing campaigns.

You can't trust any emails or phone calls you receive. You can't even trust snail mail. Any communication you receive should be treated with skepticism, and you should contact the company in question yourself to make sure it's legitimate.

Lipman summed up on a somber note: "Unfortunately, we likely haven't yet heard the end of this story."


Follow Us

Join the newsletter!

Error: Please check your email address.

Tags securityinternetdata breache-commerceebayInternet-based applications and servicesTripwirebecapersonal informationebay compromised

Featured

Slideshows

Looking back at the top 15 M&A deals in NZ during 2017

Looking back at the top 15 M&A deals in NZ during 2017

In 2017, merger and acquisitions fever reached new heights in New Zealand, with a host of big name deals dominating the headlines. Reseller News recaps the most important transactions of the Kiwi channel during the past 12 months.

Looking back at the top 15 M&A deals in NZ during 2017
Kiwi channel closes 2017 with After Hours

Kiwi channel closes 2017 with After Hours

The channel in New Zealand came together to celebrate the close of 2017, as the final After Hours played out in front of a bumper Auckland crowd.

Kiwi channel closes 2017 with After Hours
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP honoured leading partners across the channel at the Partner Awards 2017 in New Zealand, recognising excellence across the entire print and personal systems portfolio.

Meet the top performing HP partners in NZ
Show Comments