Date: Mon, 26 Jul 2004 20:26:05 +0200
From: Guy Antony Halse
To: info(at)etv.co.za
Subject: ebay hacking article
Hi
After listening to your news article this evening discussing the hacking of
e-Bay's credit card database, I decided to do some basic investigation of my
own.
I find it strange that the only website carrying any form of coverage of
this is news24.com. All the normal sources of IT-related news have no
mention of it at all (theregister.com, itweb.co.za, slashdot.org, etc). Not
only that, no other major wire service carries information about it. Nor
does Google's syndication service (news.google.com) carry any further
sources.
Some other inconsistencies piqued my interest. For a start, e-Bay is an
auctions company. They simply facilitate payments between two parties -
they don't handle money (apart from facilitation fees) as such. As far as I
remember, they hive credit card transactions off to paypal.com, so it seems
odd that they'd keep records of credit card details themselves.
Your article mentioned http://www.419legal.org/. It seems odd that a site
purporting to be part of the SAPS would be hosted on a .org domain rather
than a .org.za or .gov.za domain. Looking at ownership information for that
domain
(http://reports.internic.net/cgi/whois?whois_nic=419legal.org&type=domain)
we find:
Registrant ID:GODA-05739656
Registrant Name:D. Squire
Registrant Organization:E-Payments
Registrant Street1:6 Wrenford Place
Registrant Street2:Hillary
Registrant City:Durban
Registrant State/Province:Kwa Zulu Natal
Registrant Postal Code:4096
Registrant Country:ZA
Registrant Phone:+27.7646957
Registrant Email:support@e-payments.co.za
Now there are a few interesting things I notice about this. Firstly, the
South African Post Office's website (www.sapo.co.za) does not know anything
about the postcode 4096. The postcode for Hillary is 4094. In the same
way, the phone number "+27.7646957" does not correspond to the standard
10-digit (or 9 digit + international prefix) format of South African phone
numbers.
Of further interest is that this supposedly South African site is hosted in
the United States rather than in South Africa. The hosting company's
generic web site can be seen at http://69.93.250.100/
Visiting the web 419legal.org web site, we discover that in order to search
the database we need to enter a credit card number (as opposed to a name or
some other identifying feature, such as surname + last four digits). In
other words one has to reveal one's credit card number in order to "check"
it.
So my question is this: How sure are you of your sources for this story or
are you being unwittingly used to further fraud?
- Guy
--
Systems Manager, IT Division, Rhodes University, Grahamstown, South Africa
Email: G.Halse(at)ru.ac.za Web: http://mombe.org/ IRC: rm-rf@irc.zanet.net
*** ANSI Standard Disclaimer *** J.A.P.H
| 
