Date: Mon, 26 Jul 2004 20:26:05 +0200
From: Guy Antony Halse 
To: info(at)etv.co.za
Subject: ebay hacking article

Hi

After listening to your news article this evening discussing the hacking of
e-Bay's credit card database, I decided to do some basic investigation of my
own.

I find it strange that the only website carrying any form of coverage of
this is news24.com.  All the normal sources of IT-related news have no
mention of it at all (theregister.com, itweb.co.za, slashdot.org, etc).  Not
only that, no other major wire service carries information about it.  Nor
does Google's syndication service (news.google.com) carry any further
sources.

Some other inconsistencies piqued my interest.  For a start, e-Bay is an
auctions company.  They simply facilitate payments between two parties -
they don't handle money (apart from facilitation fees) as such.  As far as I
remember, they hive credit card transactions off to paypal.com, so it seems
odd that they'd keep records of credit card details themselves.

Your article mentioned http://www.419legal.org/.  It seems odd that a site
purporting to be part of the SAPS would be hosted on a .org domain rather
than a .org.za or .gov.za domain.  Looking at ownership information for that
domain
(http://reports.internic.net/cgi/whois?whois_nic=419legal.org&type=domain)
we find:

Registrant ID:GODA-05739656
Registrant Name:D. Squire
Registrant Organization:E-Payments
Registrant Street1:6 Wrenford Place
Registrant Street2:Hillary
Registrant City:Durban
Registrant State/Province:Kwa Zulu Natal
Registrant Postal Code:4096
Registrant Country:ZA
Registrant Phone:+27.7646957
Registrant Email:support@e-payments.co.za

Now there are a few interesting things I notice about this.  Firstly, the
South African Post Office's website (www.sapo.co.za) does not know anything
about the postcode 4096.  The postcode for Hillary is 4094.  In the same
way, the phone number "+27.7646957" does not correspond to the standard
10-digit (or 9 digit + international prefix) format of South African phone
numbers.

Of further interest is that this supposedly South African site is hosted in
the United States rather than in South Africa.  The hosting company's
generic web site can be seen at http://69.93.250.100/

Visiting the web 419legal.org web site, we discover that in order to search
the database we need to enter a credit card number (as opposed to a name or
some other identifying feature, such as surname + last four digits).  In
other words one has to reveal one's credit card number in order to "check"
it.

So my question is this: How sure are you of your sources for this story or
are you being unwittingly used to further fraud?

- Guy
-- 
Systems Manager, IT Division, Rhodes University, Grahamstown, South Africa
Email: G.Halse(at)ru.ac.za  Web: http://mombe.org/ IRC: rm-rf@irc.zanet.net
*** ANSI Standard Disclaimer ***                                   J.A.P.H

There are lots of inconsistencies with this. My gut feel is that it is a scam and that eTV and News24 have cleverly been tricked into furthering malicious goals.

For example, why is "Johannesburg Commercial Branch" hosting information on a .com and .org domains when they have a perfectly good .gov.za domain. Take a look at http://www.saps.gov.za/divstat/commercial/ and http://www.commercialbranch.com/ and tell me which you trust more? Why is 419legal.org or commercialbranch.com not mentioned on http://www.saps.gov.za/crimeprev/nig.htm#nig

Also have a look at the registration information for those domains and notice they're registered to someone in Durban (odd for Jo'burg), that both the post code and the telephone number are almost, but not quite right, etc. Why is not registered in the SAPS's name, or why hasn't it been changed to be? Why were the domains were registered through a US-based registrar when we have several perfectly good registrars in South Africa.

The 419legal.org site is hosted by a generic hosting company in the USA, yet the rest of the SAPS's site is hosted on the government's own netblock in South Africa. Add to that the fact that they thank RealXchange.co.za for hosting -- yet RealXchange.co.za is hosted on a completely different network in the UK.

Then realise that every one of the logos and pictures you see on 419legal.org can be found on other web sites (for example, the Jo'burg commercial branch's logo is on the saps.gov.za site, the RealXchange face is on their web site, etc).

The final straw is that they ask you to enter your credit card number in order to check it. There is no way in hell that's good Internet practice. They could have asked for your surname and last four digits, or something similarly unique. They purport it to be a "secure" site, but notice how they don't have their own SSL certificate. Instead they piggy-back of someone else's (www2.securesiteserver.co.uk). Why is that? I suspect it is because they couldn't provide the necessary certificate of incorporation, etc required by all commercial SSL vendors.

It has scam written all over it in big letters.