Hackers still exploiting eBay’s stored XSS vulnerabilities in 2017

Fraudsters are still exploiting eBay's persistent cross-site scripting vulnerabilities to steal account credentials, years after a series of similar attacks took place. Worse still, many of the listings that exploited these vulnerabilities remained on eBay's website for more than a month before they were eventually removed.

All of the attacks stem from the fact that eBay allowed fraudsters to include malicious JavaScript in auction descriptions. Previous attacks exploited this vulnerability to place malicious redirect code on high-value vehicle listings, with the intention of stealing login credentials from other eBay members, whose accounts could then be used to list even more fraudulent vehicle listings.

But fraudsters are now using malicious scripts on a wide variety of lower-value items, including legitimate listings that had already been posted from reputable eBay accounts. Fraudsters have seemingly compromised these accounts and appended additional information to many of the members' existing listings – and this is where the malicious JavaScript is placed.

As can be seen below, the cybercriminals even used listings of dental tools to extract credentials from their victims, bypassing eBay's toothless listing policies in a similar way to the attacks that took place a few years ago.

A compromised listing for a dental tool from a Chinese seller as it appeared in eBay search results.

A compromised listing for a dental tool from a Chinese seller as it appeared in eBay search results.

Clicking on the above listing took the user to the following page, which included malicious JavaScript that had been injected by the fraudster:

The malicious listing is displayed for only a split second

The malicious listing is displayed for only a split second

But the malicious code in this listing executes as soon as the page has loaded, which causes it to be displayed for only a split second. In the blink of an eye — and without any further interaction — the victim is redirected to a spoofed login form:

In the blink of an eye, the victim is redirected to a very-convincing spoof login form.

In the blink of an eye, the victim is redirected to a very-convincing spoof login form.

Victims are unlikely to expect a phishing form to appear as a result of clicking on an eBay search result, and so the efficacy of these attacks is likely to be far greater than the average phishing scam. Allowing listings to include arbitrary JavaScript not only facilitates this type of fraud, but also allows fraudsters to capitalize on the trust instilled by the eBay website.

In this particular example, the malicious code injected by the attacker was obfuscated to make its purpose less apparent – possibly to get around any text-based content filters implemented by eBay. The obfuscated script is used to load a much larger JavaScript payload from an external location at user54631.vs.easily.co.uk/v.js (this script, which was hosted by Easily, has since been removed).

Lightly-obfuscated malicious JavaScript as it appeared in an eBay listing

Lightly-obfuscated malicious JavaScript as it appeared in an eBay listing

The externally-hosted script redirected victims to a data URI, which is another trick sometimes used by cybercriminals: The Base64-encoded address makes it difficult for victims to report such attacks, as by this point, the page is ostensibly not hosted anywhere.

When the victim submits his username and password, the credentials are transmitted to a script at daviddouglas.co.uk/session.php?/ws/eBayISAPI.dll?co_partnerId=2&siteid=3&UsingSSL=1 (which has also since been taken down). This PHP script receives the victim's credentials and then immediately redirects the victim to a page on the genuine eBay website, giving the impression that the listing that the victim originally attempted to visit is no longer available:

The victim is redirected to a non-existent listing after his credentials have been stolen.

The victim is redirected to a non-existent listing after his credentials have been stolen.

The victim may not realise it — as his browser never showed the address of any externally hosted websites — but at this point, his credentials will have already been stolen by the fraudster's PHP script.

The fraudsters behind these attacks can attempt to monetize these stolen credentials by selling them to other fraudsters, or use them to propagate malicious code into even more listings. In the dental tool example, malicious JavaScript was added to the listing on 8 December 2016, and remained there until late January 2017, giving the fraudster more than a month and a half to exploit the vulnerability.

The malicious script (not visible) was added on 8 December 2016, and eBay continued to serve it for a month and a half.

The malicious script (not visible) was added on 8 December 2016, and eBay continued to serve it for a month and a half.

The compromised seller account involved in the above attack had over a thousand of its listings infected with malicious JavaScript, many of which flew under eBay's radar for more than a month, despite having obvious malicious intentions. The only deterrent is eBay's JavaScript policy, which disallows the use of JavaScript redirects – but this is evidently not entirely effective, as it failed to prevent it being exploited for extended periods, and fraudsters will obviously not care about breaking policies that are not proactively enforced.

These latest listings were reported to Netcraft by "Jaco Bustero". Although this pseudonym is very similar to "Buster Jack" — who discovered a series of related scams in 2014 — they are, in fact, different people in the UK. Both hide behind pseudonyms because of valid concerns about their own safety – for instance, Buster Jack's efforts to combat vehicle fraud have earned him several death threats from the perpetrators of these crimes.

But fortunately, the end of script-based attacks may soon be in sight on eBay. In an effort to make its listings mobile-friendly, eBay plans to limit the use of active content (such as JavaScript) at some point in 2017, before eventually blocking it altogether. If this is implemented as a technical control (for example, by using iframes with Content Security Policy and sandbox restrictions), then such attacks should become impossible to carry out against modern browsers.

The most recent attacks have taken place over the past 12 months, after eBay had responded to 'previous reports' of JavaScript-based attacks, when it claimed not to have found any fraudulent activity stemming from these cross-site scripting vulnerabilities.

In some cases, it could be that eBay is simply unaware of the fraud it is facilitating. When one customer phoned eBay Trust & Safety to report these redirect attacks, the eBay handler was unable to see the redirection due to security settings on their internal systems. Consequently, reporting such vulnerabilities to eBay can prove frustrating, as well as fruitless: When Jaco posted a similar warning to the eBay Motors community forum, he claims his message was quickly deleted.

A year ago, we predicted that it would be difficult to prevent this type of fraud when listings are still able to include arbitrary JavaScript. With these recent attacks proving eBay's interim measures are still insufficient to prevent abuse, only technically-enforced controls on the execution of JavaScript will finally put a stop to this fraud.

August 2019 Web Server Survey

In the August 2019 survey we received responses from 1,271,920,923 sites across 239,441,736 unique domain names and 8,948,887 web-facing computers. This reflects a large loss of 124 million sites, but a gain of 1.30 million domains and 10,700 computers.

All major vendors lost active sites this month, and of those, only Google made a gain in sites (+1.58 million). Microsoft lost the largest number of active sites (-2.03 million), while nginx lost the most sites (-81.4 million, -16.9%) but remains in the lead with a 31.6% share of all sites.

Despite losing so many sites, nginx showed the strongest growth in unique domains, web-facing computers, and among the top million sites. This bears more significance than the more unpredictable changes in the site counts, which are prone to fluctuations month-on-month as link farms, spam networks and other low-value web content comes and goes.

With a gain of 58,500 web-facing computers, nginx now has more than 31% of the computer market share – just 5.39 percentage points behind Apache – while Microsoft has lost 65,000 computers. As is evident in the graphs, counting web-facing computers provides the most stable metric and makes long term trends easy to spot. In particular, the clear and consistent rise in nginx's market share and the steady decline of Apache makes it hard not to imagine nginx taking the market lead from Apache by early next year.

The number of top-million websites powered by nginx has increased by 1,292, while Apache's count fell by 3,101. Apache maintains the lead in this market, but is now only 5.92 percentage points ahead of nginx. Apache also continues to lead in terms of unique domains, despite losing 784,000 this month. It has a similar lead over nginx, which is now only 5.32 percentage points behind Apache after gaining 753,000 domains.

Microsoft lost counts in almost all metrics this month, apart from where it gained 166,000 domains, although this still resulted in a small drop in its domain market share. The sites market is the only one where its share did not fall, despite losing 16.6 million sites.

Netflix finds nginx vulnerabilities

nginx 1.61.1 stable and nginx 1.17.3 mainline were released on 13th August, in order to address three HTTP/2 security issues that could cause excessive memory consumption and CPU usage. All versions between 1.9.5 – 1.17.2 are affected, but only if HTTP/2 is enabled. These security issues were discovered by Jonathan Looney at Netflix, which chose to use nginx when developing its own globally distributed content delivery network, known as Netflix Open Connect.

The content delivery network consists of Open Connect Appliances, which run the FreeBSD operating system and use nginx to stream audio and video directly to Netflix customers. Most of this content is served from appliances hosted by ISPs, rather than across the internet, which leads to better performance whilst vastly reducing the amount of peered traffic when huge numbers of customers worldwide stream a popular show at the same time. Thousands of ISPs have enthusiastically participated in this program because it is free to connect to the Open Connect network, and it prevents Netflix traffic from taking up a significant amount of an ISP's internet capacity.

FreeBSD is dying?!

Netflix chose FreeBSD for its balance of stability and features (as did Netcraft once upon a time), but it is becoming an increasingly less common frontend operating system on the web as a whole. Only 60,200 (0.67%) web-facing computers are running FreeBSD today. To put this into perspective, more than twice as many servers are still running Windows Server 2003, even though it has not been supported for several years.

Linux is by far the most commonly used operating system for web-facing computers. It is installed on 6.64 million (74.2%) servers, and at least 1.05 million of these can be positively identified as running the Ubuntu distribution.

Naturally, the choice of operating system depends to some extent on what type of web server will be running on it, and vice versa. For example, it is no surprise that most instances of Microsoft IIS can be found running on Windows Server, and most instances of Windows Server are used to run Microsoft IIS; but it is clear that the Linux operating system is especially favoured for some web servers. Between 92% and 96% of all web-facing computers that use each of nginx, Apache, Litespeed and lighttpd can be found running Linux.

AWS ELB overtakes Beaver

The awselb (Amazon Web Services Elastic Load Balancing) web server was found on 69,800 web-facing computers this month, overtaking Beaver to become the fourth most commonly used frontend server by computers. Practically all of these machines appear to be running Linux, and are responsible for hosting 464,000 sites across 48,500 unique domains.

ELB achieves fault tolerance and scalability by automatically distributing incoming application traffic across multiple targets – and can even spread it across multiple AWS Availability Zones – so the 69,800 AWS ELB servers exposed to the internet are likely to be only the tip of the iceberg in terms of the AWS infrastructure used by each website.

Total number of websites

Web server market share

DeveloperJuly 2019PercentAugust 2019PercentChange
nginx482,877,27534.59%401,454,02931.56%-3.03
Apache387,366,82627.75%374,277,24329.43%1.68
Microsoft203,673,34414.59%187,109,42314.71%0.12
Google29,385,0652.11%30,969,2592.43%0.33
Continue reading

Most Reliable Hosting Company Sites in October 2018

Rank Performance Graph OS Outage
hh:mm:ss
Failed
Req%
DNS Connect First
byte
Total
1 GoDaddy.com Inc Linux 0:00:00 0.004 0.481 0.005 0.017 0.018
2 Swishmail FreeBSD 0:00:00 0.004 0.248 0.084 0.167 0.170
3 Netcetera Linux 0:00:00 0.004 0.199 0.085 0.175 0.175
4 www.dinahosting.com Linux 0:00:00 0.004 0.306 0.091 0.182 0.182
5 vXtream Ltd Linux 0:00:00 0.008 0.322 0.072 0.145 0.145
6 One.com Linux 0:00:00 0.008 0.396 0.080 0.236 0.236
7 Rackspace Linux 0:00:00 0.013 0.712 0.006 0.014 0.015
8 Bigstep Linux 0:00:00 0.017 0.245 0.072 0.147 0.147
9 Webair Linux 0:00:00 0.017 0.355 0.080 0.161 0.162
10 ServerStack Linux 0:00:00 0.017 0.251 0.091 0.181 0.181

See full table

In October 2018, GoDaddy had the most reliable hosting company site, with a single failed request and the fastest average connection time of 5ms. GoDaddy's site has now appeared in the top 10 six times so far in 2018, and has topped the rankings three times in 2018. The Website Builder tool offered by GoDaddy is widely used, as seen in Netcraft's September Web Server Survey, and provides customers with a simple way to create a web presence.

Swishmail, Netcetera and dinahosting ranked second, third and fourth place, with their sites also only experiencing a single failed request. The tie is broken by their average connection times: 84ms, 85ms and 91ms. Swishmail is a provider of a range of email and web hosting services and returns to the top 10 for the 7th time in 2018.

Following in fifth and sixth place are vXtream Ltd and One.com, whose sites both failed to respond to two requests. Rackspace had the second fastest average connection time of 6ms but appears 7th in October due to 3 failed requests. Like GoDaddy, Rackspace has appeared in Netcraft's top 10 most reliable hosting company sites six times in 2018.

Linux continues to dominate the web server market as the most popular operating system and this is reflected in 9 of the top 10 hosting company sites being served by web-servers running Linux. FreeBSD also makes an appearance in second place.

Netcraft measures and makes available the response times of around thirty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. In the event the number of failed requests are equal then sites are ranked by average connection times.

Information on the measurement process and current measurements is available.