eBay user data for sale?

by troy1987 • 12 years ago

94 106 12 years ago

kanzure• 12 years ago

Ha! That's cute. The joke is that anyone can send any relevant transaction hash that they see straight by email. Obviously, if they were serious, they would offer a unique Bitcoin address to each prospective buyer.

Doji• 12 years ago

Not to mention some kind of escrow.

aortenzi• 12 years ago

Wouldn't be hard for him to follow up with "to prove it was you, sign X with the sending private key" if there are multiple claims.

hughes• 12 years ago

Hacking as a spectator sport: we get to watch the blockchain for buyers![0]

[0] https://blockchain.info/address/1e4aLP3jKD9wRAcSRNVb7VHbd7Kb...

rwmj2• 12 years ago

Or at least for people gullible enough to send $1000 speculatively to a random person on the internet.

pyalot2• 12 years ago

Clearly there's some unsolved problem there. Somebody come up with some proof of data algorithm and associated blockchain...

aqme28• 12 years ago

Protocol question:

What's to stop me from emailing one of those txn-ids to KbcdPfA@hushmail.com and stealing the dump?

nwh4• 12 years ago

Nothing. People make this mistake when doing legitimate things too. You're meant to make a new address for every single client. The response could be that they only send to unique TXID that haven't been used before, but you can always race it out by sending the email first.

glomph• 12 years ago

Smart sellers would require you to sign your message with the bitcoin address that paid.

ForHackernews4• 12 years ago

I have an eBay account, but I haven't used it in years, and I doubt I remember the password.

How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

andrewmunsell• 12 years ago

There aren't any plain text passwords, but there are email addresses, physical addresses, phone numbers, and DOBs.

rwmj2• 12 years ago

It's the DoB which is the giveaway (that this is fake). eBay doesn't collect date of birth, but does collect lots of other authentication information.

EDIT: I stand corrected, see the reply by sp332 below.

iaskwhy• 12 years ago

As with any other hacked company, assume the worst: everything was leaked as plaintext.

aetherson• 12 years ago

Reports indicated that the passwords were encrypted, but I do not believe they've mentioned what the encryption scheme is.

Plaintext uniquely identifying information like Date of Birth was included, however.

thefreeman2• 12 years ago

Judging by the prefix to one of the link pasted hashes, looks like PBKDF2 with sha256?

cauterize• 12 years ago

I've had an eBay account for 10+ years. I thought a "hey, we screwed up, please change your password" type email would be nice.

seabee• 12 years ago

They did force a password reset on everyone trying to log in yesterday; even if they already reset their password when they first heard the news, effectively locking them out for the evening because their password reset system was understandably overwhelmed with requests. Thanks eBay!

nkozyra2• 12 years ago

My guess would be this is less about passwords (which - wild guess here - are probably fairly well-secured) and more about ancillary user meta data.

bsimpson• 12 years ago

I guess I'm going to have to change my birthdate.

sp3323• 12 years ago

eBay didn't say what kind of encryption they had, only that they were encrypted. Personally I'm more concerned about the personal information in the leaked data that wasn't protected at all! So sure, change your password, but it won't change the fact that someone got your name, email address, physical address, phone number, and date of birth.

nkozyra2• 12 years ago

On the plus side, think of how nice it will be to get a happy birthday phone call from a hacker.

hellbreakslose• 12 years ago

sp332 to be honest here, I am pretty sure if you search your real life name on the internet you will definitely find somewhere that you can buy the information you just mentioned. I am not trying to be mean here, I am just trying to let you know in case you didn't know.

Plus you already have your email publicly displayed here ... and i found some weird stuff about amateur ... xxx movies when i googled you T_T

Mithaldu• 12 years ago

The passwords look like this:

    pbkdf2_sha256$12000$zhMKabMgayvK$iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc=

I do not know how much time it would take to bruteforce these. Can any experienced HNers weigh in?

thefreeman2• 12 years ago

I am not an expert by any means, but I believe pbkdf2 is a recommended key stretching function for a hashing method (which looks to be sha256). http://en.wikipedia.org/wiki/PBKDF2

I think cracking difficulty depends on how many "iterations" they use though.

phpnode• 12 years ago

it's going to be computationally difficult but not impossible to break an individual password, but breaking all of them is unlikely in our (solar system's) lifetime.

However, if you were targeting a specific user and they didn't use a particularly strong password, it's possible that you could brute force it.

surreal• 12 years ago

Looks to me like the $ signs are acting as delimiters, and that that hash is made up of:

cipher/hash: pbkdf2_sha256

cost factor: 12000

salt: zhMKabMgayvK

hash: iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc=

This exact technique (pretty much) is described here: http://exyr.org/2011/hashing-passwords/. It's a decent, secure way to hash passwords.

Cost factor of 12000 seems solid to me (depends on the hardware they're running on but I'd say brute forcing your way through that would be pretty impossible)

unfunco• 12 years ago

    <algorithm>$<cost>$<salt>/<encrypted_password>

It's more than I expected from eBay, I think because of the likes of LinkedIn and their user credential leak, I expected bad habits from larger companies.

Rainbow tables can't be used against the passwords, so each one will need to be computed individually to either find the result or a collision. That's likely why the seller is only asking for $1000.

seefoma• 12 years ago

This is actually about as good as it gets for password hashes, so kudos to eBay.

Since these are salted and require 12000 iterations, cracking individual passwords will be quite time consuming. The preferred method in this case, though, is to go after low hanging fruit.

The way one would do this is to try something like the 500 most common passwords against all entries in the table. This won't take very long (compared to trying to brute force a bunch of individual passwords), and will probably yield a ton of passwords.

kej• 12 years ago

From the linked sample data, passwords are pbkdf2-sha256 while name/address/phone/birth date are clear text.

rmc• 12 years ago

properly salted hashs can still harm many peple. You could still run a brute force on the top 10k most common passwords and with ~150m averge computer users, you're going to get a few. And you have their email address. There's a good chance they're using the same password for email. Now you have their email.

mischanix• 12 years ago

With user-individual salts and assuming 100ms for a password trial, 100ms * 150e6 * 10e3 is approximately 4750 years, and while this can be done in parallel, it's not exactly a small amount of resources you'd have to devote to get these relatively simple passwords.

ForHackernews4• 12 years ago

Yeah, that's true. Due respect, but I'm not really worried about those other users, only me. Because I'm a human and I'm selfish.

daveove2• 12 years ago

Just reset my password and was greeted by this message: To protect the security and privacy of our customers, we’re asking all eBay users to reset their passwords on or after May 21, 2014. If you already reset your password and forgot it, please follow the reset process below. Learn more

kerridge0• 12 years ago

quick somebody automatically send thousands of "spam" claim emails whenever a payment is made!

Eye_of_Mordor• 12 years ago

Why didn't they sell it on eBay?

nofinator• 12 years ago

EXCELLENT SELLER!!1 FAST SHIPPING! WOULD BUY FROM HACKER AGAIN!!1 A++++++++++++!

davidw• 12 years ago

1.453 bitcoin. Reference to the fall of Constantinople, or patternicity at work?

rubinelli• 12 years ago

Yeah, sounds like numerical apophenia to me.

RaSoJo• 12 years ago

Great catch there. http://en.wikipedia.org/wiki/1453

"It is sometimes cited as the notional end of the Middle Ages by historians..."

coldcode• 12 years ago

All personally identifiable data should be stored in a non usable form. You'd think people by now would know that eventually your data will leave your protection.

bsaul• 12 years ago

But then, why store them ?

TkTech• 12 years ago

I believe that he's implying they would be hashed just like your password and used solely for verification with another system (like transaction authorization).

tomp2• 12 years ago

Why the ":s"? Are they supposed to offer it for free?

Jokes aside, this, hopefully followed by a (class-action?) lawsuit, is the only way that the companies will learn how to properly store user data. The engineers have been talking about "best practices" for a very long time, but it appears managers only understand the language of money.

akerl_3• 12 years ago

Let's not attempt to justify profiting from stolen personal data. This isn't a glorious mission to save the world from poor security practices, this is somebody trying to make money selling people's personal information.

tomp2• 12 years ago

You're a brilliant hacker, you lurk on security and blackhat forums, you know exploits inside and out. One day, you decide to check the security of some big consumer websites, and you find a security hole. What do you do (choose your adventure style)?

* You're a white-hat honest hacker, and all you want is for the internet to be a safer place. You decide to report the vulnerability to the company. Unfortunately, after you sent the email to their engineering team, they told you that the security hole you found isn't critical and refuse to award you a bounty. The rest of the emails go unanswered. You try sending emails to some other departments, including customer support, sales, and legal. No response. 2 months after that, when you're taking a dump on the toilet, federal agents burst into your apartment, knock you down and arrest you without even giving you the chance to wipe your ass. You're charged with industrial espionage, breach of security, and conspiracy to defraud. It turns out that someone did read your emails, checked out the logs, found traces of you researching the security hole. Your defense that you were trying to help is summarily dismissed and you rot in jail.

* You think most people are too serious and need to relax. You decide to have some fun. You download tons of embarrassing data from the company website, write them an untraceable email demanding 1000 BTC and public disclosure of your skills. You're pretty sure they will refuse your request, which they soon do. You troll the company by disclosing that they were hacked, and decide to sell the security hole to the highest bidder. You also sell chinks of data to random hackers and credit card scammers. You retire to a tropical island, drink martini and surf all day.

dang3• 12 years ago

The title originally was "Ebay user data has been put up for sale :s". We changed it.

sogen• 12 years ago

Hey, you can buy it cheaper!

0.5 BTC here

http://pastebin.com/Tfs07HDp

pdx• 12 years ago

https://blockchain.info/address/1Kfxm6Y5bRDnC9JLwq6vpYYcw439...

rcthompson2• 12 years ago

So, should I also change my security question?

bkurtz13• 12 years ago

I'm really getting tired of having to change my cat's name.

rcthompson2• 12 years ago

Hey, that's nothing! Now I have to change my mother's maiden name!

twistedpair3• 12 years ago

Poor kitty. You should just give it a wildcard name.

praeivis• 12 years ago

They should start auction on e-bay. ijs.

scottydelta• 12 years ago

Haha, smartasses :D

hamidr• 12 years ago

JonnieCache• 12 years ago

Now that is a nice route to some fast cash. (I'm assuming that no CSV file will actually be forthcoming.)

Kudos to to whoever moved quickly on this one. A fool and his money...

CompuHacker2• 12 years ago

None of the sample e-mail addresses contains "ebay", as in "example+ebay@gmail.com". I just thought that was interesting.

jasonkostempski2• 12 years ago

Does eBay even allow you to enter that? What benefit would that provide?

TeMPOraL• 12 years ago

example+ebay@gmail.com and example@gmail.com point to the same GMail inbox; you can use the part after + sign to filter incoming mail. A quite useful feature, I must say.

CompuHacker2• 12 years ago

It's a feature of gmail to provide unique addresses. It might protect your other accounts that use your base e-mail address from an automated attack vs. the compromised data. It doesn't matter much if the database goes public, though.

SoftwareMaven• 12 years ago

It doesn't cost you anything, and few things piss me off when I'm signing up for a service than when it won't let me use an RFC-valid email address because it has stupid validation in place.

colinbartlett• 12 years ago

Why wouldn't they?

I do this with almost every website as a way to segregate or block mail if needed. It's pretty eye opening to see what companies trade or sell your email addresses.

jasonkostempski2• 12 years ago

I know what it does, I use it to categorize stuff I email to myself (+reading, +reference, etc.). I just don't see how it would help filtering against some who also knows what it does. Maybe they don't show up in the list because they stripped it out already.

twistedpair3• 12 years ago

You can still use the "add as many dots as you want" feature in gmail, even if they don't allow the plus sign.

so.me.l.ongus.e.rname@gmail.com

Someone should make a gmail plugin for decoding directives this way.

platz• 12 years ago

Why is this on the HN front page?

nwh4• 12 years ago

Is there anything to suggest this is real? Classic scam would be to just sell a bunch of random data, people tried that when Mt Gox was compromised. People apparently provided "samples" on IRC with either random data or data from other leaks presented as being from the Bitcoin exchange.

A quick google search shows

• http://pastebin.com/L7CYznfK

• http://pastebin.com/4YRgEwPb

that have the same message with different bitcoin addresses.

icebraining2• 12 years ago

And more here (from the list of public pastes):

http://pastebin.com/YA2b6xCZ

http://pastebin.com/u4feDLAQ

http://pastebin.com/NQWEnW2v

runn1ng3• 12 years ago

Slightly racist observation about the sample data:

there is surprisingly large amount of Asian-sounding and Middle-East-sounding names there. Not sure how the data was chosen, but I would expect more... white-sounding names.

kapkapkap• 12 years ago

It says sample "from apac region" right in the pastebin.

runn1ng3• 12 years ago

Oh. I missed that. That makes sense then.

MrMeker• 12 years ago

The announcement says the sample is from the "apac" region, which I think is Asia-Pacific.

hnriot• 12 years ago

that's not racist at all, just unobservant. It's not racism to think a name sounds Asian. How did we get so confused about terms like racism and feminism.

mpg33• 12 years ago

$750 for a copy...seems reasonably

twistedpair3• 12 years ago

Worth more than $1000, wouldn't you think? Or perhaps Ebay will buy it regardless of the price, in hopes of quashing this?

icebraining2• 12 years ago

Nobody said s/he would only sell it once. It's $1000 per copy. Assuming it's true, of course.

ssw1n• 12 years ago

It would be hilarious if the seller accept bids for that on eBay ....

dang3• 12 years ago

There is no evidence yet that this is real, so we're burying the post.

Velox• 12 years ago

Just because there is no evidence doesn't mean that it should be ignored. Lots of things don't yet have evidence but it is still worth letting people know so that they are ready to take the appropriate action when the time comes.

Let's face it. Lots of posts on HN are pure speculation but they don't get buried. In this case, leaving it up won't do any harm? If it's not real, then no problem. You may have convinced a few people that they should change their passwords though, but that is a good thing. If it is real, then people will already have changed their passwords. It is win win.

Personally, I'm getting really sick of the mods deciding what news is and isn't relevant and/or suitable for me.

dang3• 12 years ago

No one is purporting to decide what's suitable for you personally. It's a question of what belongs on the HN front page. If the speculation were coming from a known source, this might be a harder call. But an anonymous pastebin that no one has any evidence for? That falls below any standard. So what you're really saying is that HN should have no editors at all, and that's not how HN has ever worked.

daveove2• 12 years ago

See my post below - ebay states this when you reset your password: To protect the security and privacy of our customers, we’re asking all eBay users to reset their passwords on or after May 21, 2014. If you already reset your password and forgot it, please follow the reset process below. Learn more

Try with an ebay account and then revisit this decision.

akerl_3• 12 years ago

Nobody is debating that a breach occurred. But there's no evidence that this paste is from someone who actually holds the stolen data.

numberwhun• 12 years ago

Even if it is real, the losers haven't been paid anything: https://blockchain.info/address/1e4aLP3jKD9wRAcSRNVb7VHbd7Kb...

eBay user data for sale?

Related Stories