Hi Folks
Although I've been successfully using AS for quite a while now, this is my first post. The first I knew of all this was when I couldn't log into to my eBay account. All I was getting was an error message saying that the password/login was invalid. A while later, I got a series of emails from eBay telling me that my account had been compromised. Somehow, somebody had managed to get my password and change the registered email address. They had then used the account to list a number of unauthorised items. Fortunately for me, eBay were on the ball, and intercepted the activity. By the time I knew anything about it, the listings had been ended and the fees had been cancelled. (Well done eBay!) This seems to be a repeat of other episodes which have been documented on this forum before.
Like everyone else, I am concerned to know how this is done. I have had no 'phishing' emails, so it can't be that. I am running Ad-Watch and have Norton AV and Windows Firewall on.
However, when I ran Ad-AWARE (having downloaded latest update), and did an in depth scan, it found a couple of files which were identified as "Possible Browser Hijack". This obviously suggests a keystroke logger. I hope it is only that, and not something which is accessing the stored password list! BTW, does anyone know how to schedule Ad-Aware to run every night at say, 3am when the PC is idle? Or another product that can be made to do this? I have my AV scan set to do this, and simply check the result in the morning.
The good news is, I don't think this is a question of AS being hacked to get the eBay login details.
This all being the case, there are some simple things that eBay could do to prevent this happening. There could be more than one level of security. A simple login should suffice for browsing and adding items to the Watch List, for instance. But when placing bids or listings, it could be made necessary to go through another layer of security. Nochex do this successfully without using keystrokes. You have to enter a number using pull-down menus, which gets round the problem of keystoke loggers.
This whole episode has caused me to rethink the way I use my PC. First, I'm going to buy a proper hardware Firewall to go between my PC and the outside world, so I don't have to rely on Microsoft's crappy attempt at a software firewall. Next, I am going to rebuild the machine and once it's done, create and use a User-only account which does NOT have Administrator priviledges. Hopefully these precautions might make my machine more secure.
Finally, some suggestions how you can help to avoid this happening to YOU! (And believe me, it's a real pain!).
1. DON'T use the same password for logging in to eBay, PayPal, email, etc.
2. DON'T use words which might occur in the dictionary.
3. DO intersperse the letters with numbers, i.e. instead of using the letter 'i', use the figure '1'
4. DO change your passwords regularly.
5. DO USE a product like Ad-Aware to regularly scan your hard disk. Get the updates because there are new trojans, etc out all the time.
Until the advent of a low-cost biometric identification device, I'm not sure there's much else you can do!
Safe & happy sniping!
Strutty
Original Post