Ebay/Hotmail hacking

Right, I'm throwing this out to the masses because I'm at my wits end.

My wife runs an ebay based shop and she's had a week of hell due to people of dubious parentage hacking into her accounts. I have absolutely no idea how they're managing to get in. Both accounts have strong passwords (random letters/numbers) and we're even using random letters and numbers for the security questions to stop people guessing those. I've run Microsoft Security Essentials over the computer several times, and nothing has popped up and also Malwarebytes whatnot which again reports nothing amiss.

So far this has happened 5 times in as many days and once they get access to the account they go on a rampage selling iPhones. So far they've run up a bill totalling £500. Ebay themselves are next to useless, however they've agreed to refund the money and have sorted the feedback/sales but they say that there's nothing else they can do to secure the account. Hotmail appears to be the same, no matter what I do with passwords etc they still manage to get in.

So - I'm guessing the computer is being compromised in some way. It's running Win7, fully up to date. Any suggestions? :(

What Av are you using ? Wireless ?

Microsoft Security Essentials and Malwarebytes. Ethernet wired connection.

You are not changing the passwords from the same computer each time? Same browser?

Spybots is what I use occasionally.

It has been changed from the same machine yes, we're going to try from another later on. Even worse, they've now managed to get into our actual proper online shop, separate from eBay. This just got a whole lot more serious. :(

Try running TDSS Killer, you may have this rootkit. Happened to me and my whole system became compromised and booted into a dodgy anti virus phishing thing whenever I booted up :

http://support.kaspersky.com/viruses...?qid=208280684

I personally dont like Microsoft security essentials, I use Comodo now as it is not intrusive and not a system hog. If you decide to get Comodo select the bottom one in the list as it is AV and Firewall :

http://personalfirewall.comodo.com/free-download.html


It sounds like they have some sort of backdoor trojan / key logger or browser hijack installed on your machine. Get your downloads done on the security side of things then disconnect the machine from the net. Boot into safemode with network (just to do the needed updates for the programs), uninstall Malwarebytes. Then re install mawarebytes and update & scan and then run the TDSS Killer and setup Comodo and do full system scan before putting the machine back online in full boot.

Comodo do a great firewall, not sure about their AV offering. Do exactly as Ferral describes, but also runa few other scans such as SuperAntiSpyware before going back online.

If all else fails, nuke the disc from orbit and rebuild.

The Comodo AV is actually very functional, works perfectly. Since I got shot of Avast (which is what I had installed when I got compromised), since Comodo installation I have had no bother at all. It picks up if a system file has been changed in any way and alerts you where you can do a clean / ignore or delete. If it cant deal with it, item gets put in a Sandbox and file details get sent to Comodo where it gets scanned and fixed if needed.

In the mean time, might be worth running your business from a Linux BootCD / HDD. At least you can then be sure you've isolated the OS as a potential attack vector and for most eBay type stuff which is run from a browser anyway, you'll probably not notice the difference.

My house mate at uni spent some time setting up keloggers on the uni machines. Was only really funny because he picked up another housemates login info!

Quote:

---

Originally Posted by Domestic_Ginger

My house mate at uni spent some time setting up keloggers on the uni machines. Was only really funny because he picked up another housemates login info!

---

Wonder how many laws that breaks? Not funny and not clever.

Remove the network cable from the back of the suspect machine.

Read this thread and start with the step by step processes.

Download the tools they suggest on another machine (use your Mac) and transfer them to the machine using a pen drive.

I've just finished cleaning a fourth laptop in as many weeks, one cleanup required signing up and posting on the above forum. Hopefully yours isn't as terminal :)

Another vote for TDSS killer if the Alureon root kit (and associated variants) is your issue.

It sounds like something nasty is going on.

Stop using that machine. if you've got a spare hard drive put a linux install or just another windows copy onto that, unplug the old hard drive and now use the spare.

checking settings on the router/modem might be a good idea too.

Hope you get this sorted, and please us know how this turns out.
(as my other half runs both an ebay shop and online shop too I really don't want to have her fall into this as well)

Quote:

---

Originally Posted by mycarsavw

Remove the network cable from the back of the suspect machine.

Read this thread and start with the step by step processes.

Download the tools they suggest on another machine (use your Mac) and transfer them to the machine using a pen drive.

I've just finished cleaning a fourth laptop in as many weeks, one cleanup required signing up and posting on the above forum. Hopefully yours isn't as terminal :)

---

This is an excellent step by step guide. :rockon:

I wish it were as simple as just using another machine or firing up into Linux. Problem is all the postage is handled by a program that will only run under Windows. :/ That makes the whole Linux thing a little more awkward. At the moment she can copy paste info from the order straight into the postage program, it prints the labels and away we go. Having to manually type all the addresses in is a no go I'm afraid. :(

Still, I'll have a look at the machine when I get home and go from there. Thanks all for the help thus far...

Right TDSS didn't find anything so that's one down. Got rid of MSE and have now installed Comodo, cor 'eck lots of options that mean nothing to me lol!

Still, it's running a scan and now has picked up 1 threat so far: Heur.Packed.Unknown@-1

Dunno if that's real or a false positive but we'll see. SuperAntispyware and Malwarebytes are running too, nothing so far.

"Nuke the entire site from orbit. It's the only way to be sure."

-- Ripley (Aliens)

Right - I've nuked it into quarantine for now, submitted it for analysis too. I'm not convinced it's dodgy but we'll see.

Superspyware has found some tracking cookies and is still scanning but I didn't think those would be of a keylogging variety.

So... I'm more and more convinced that it's not the computer after all. This is bloody weird. :S Still, going through Malwarebytes now to see if that picks anything up. I'm wondering if they've somehow got into Hotmail by guessing or brute forcing, then have simply been using the 'forgot password' gubbins on the other sites to get into those. Argh!

Quote:

---

Originally Posted by b0redom

In the mean time, might be worth running your business from a Linux BootCD / HDD. At least you can then be sure you've isolated the OS as a potential attack vector and for most eBay type stuff which is run from a browser anyway, you'll probably not notice the difference.

---

Definately good advice. Some distros (knoppix certainly) allow you to run your home directory (and also key environment settings) from an (optionally) encrypted usb stick, so you have the benefit of a persistent environment without a vulnerable hard drive.

Quote:

---

Originally Posted by peterb

Definately good advice. Some distros (knoppix certainly) allow you to run your home directory (and also key environment settings) from an (optionally) encrypted usb stick, so you have the benefit of a persistent environment without a vulnerable hard drive.

---

http://forums.hexus.net/help-technic...ml#post2067394

Quote:

---

Originally Posted by Lowe

http://forums.hexus.net/help-technic...ml#post2067394

---

Appreciate that, but it was just as a clean machine to reset all the passwords should your win7 machine prove to be compromised.

I guess you are using the SmartStamp application. Don't know if that would run under WINE.

You can't really trust AV apps to find the latest malware.

Use tcpview to identify suspicious connections - try logging on to Ebay with dummy credentials and see if any info is submitted to to unusual IPs. I also use smsniff by Nirsoft as a simple sniffer for this purpose.

I once had to deal with the PC of a 'friend of the family' infected with..... well, everything. Out of pure curiosity, and expecting to never fully clean it, I tried cleaning it anyway. When I finished, every AV and anti-malware app I tried was finding nothing, but I knew something was still on the PC because every form I submited in Firefox (not IE) was having the corresponding information sent to a Leaseweb server in the Netherlands. I think it turned out to be a malicious Firefox plugin or extension.

So, basically monitor & sniff the traffic yourself, and from there look in to what processes, services or add-ons might be causing that traffic.

Also maybe check for hardware keyloggers?

In the past few months there have also been some MBR-based malware. GMER and Rootalyzer are useful for these sorts of things.

edit: Also, PayPal and Ebay offer a Security Key. However, they can be bypassed by an army of cheap labour in Asia and an instant keylogger

Quote:

---

Originally Posted by peterb

Appreciate that, but it was just as a clean machine to reset all the passwords should your win7 machine prove to be compromised.

I guess you are using the SmartStamp application. Don't know if that would run under WINE.

---

Ah right - I brought my Mac home and got the wife to reset everything on that at the in laws house so hopefully that's sorted for now. We're trying to get in contact with eBay to freeze the account as well for the next few weeks, but their phone number isn't working. :/

Yes she uses Smartstamp. I'm considering ditching the PC altogether and getting a Mac Mini for her, then chuck Parallels or similar on it just for Smartstamp. Might be a whole lot easier!

Quote:

---

Originally Posted by Lowe

I'm considering ditching the PC altogether and getting a Mac Mini for her, then chuck Parallels or similar on it just for Smartstamp. Might be a whole lot easier!

---

I can't advise you with regards to your problem but I'm in a similar situation where I rely on a Windows only program for my business. I run it through Parallels on my Mac with no issues whatsoever and would recommend it as an option to others.

What I suggest

Backup your important files and run a Avast Antivirus or NOD32 scan on them.
Next, full format your hard drive and reinstall Windows and all apps.

A bit of a overkill, but much quicker than battling with spyware/malware. Once a machine is infested with spyware, it's a constant battle!

Yes indeed - I'm surprised you're battling this with AV. Only way to be sure is to do a complete reinstall. Well worth the peace of mind, even if it is a tedious task.

Lowe - if you have something you have to ask where it has come from, in my experience of repairing computers, such malicious software doesn't appear out of thin air.

I definitely recommend a run of hijack this, get your mac out and google any unfamiliar processes.

Do you keep your OS/Browser/Flash/Java up to date? For the sakes of saving time and hassle, I'd do a safe mode boot, back up any files you need to an empty drive, maybe scan the drive if you have the resources to do so, but don't do it on the same computer. Then fresh install Windows.

If it's possible, maybe you should consider running weekly backups of Windows as I do, just in case anything does ever happen again.

Also, with regards to password (I'm sure your clued up already): http://www.businessweek.com/magazine...4036460585.htm

I had to repair a similar issue a while back, where the 'client' had logged in to online banking to make some changes, only to find a few days later £2,500 had gone missing from her account. After digging around it was a Java exploit, MSE found the issue and repaired it, I also cleaned up some files and examined processes after. It seemed the original exploit was obtained through a pron website her husband was visiting, ofc I didn't tell her that :)

Personally, I would copy my data onto usb key/another computer. Then Nuke the computer doing a complete reinstall, its the only way to be sure. You can never fully trust a compromised computer again, nuke it.

If you did want to use a linux system as it would be harder to break, you could run a windows VM for the postage program. You could end make a copy of the windows VM and run it via a snap shot so every time you boot it, the disk reverts to the orginal image!

Quote:

---

Originally Posted by Lowe

Yes she uses Smartstamp. I'm considering ditching the PC altogether and getting a Mac Mini for her, then chuck Parallels or similar on it just for Smartstamp. Might be a whole lot easier!

---

Might I suggest looking at her facebook account, there are lots of things on there that could be a potential mine field as far as dodgyness goes, like on like this that and the other to view pictures and various other random "apps" that are installed on the front of facebook and tie into your email/social media lifelines..
Ditching a PC for a Mac is hardly a solution though, I thought higher of you ;)

Quote:

---

Originally Posted by DannyM

It seemed the original exploit was obtained through a pron website her husband was visiting, ofc I didn't tell her that :)

---

You assume it was the husband... or were you able to tell by the login?

Quote:

---

Originally Posted by ik9000

You assume it was the husband... or were you able to tell by the login?

---

You fell for that story, come on, it was Danny's laptop and Danny's porn :D

Quote:

---

Originally Posted by mycarsavw

You fell for that story, come on, it was Danny's laptop and Danny's porn :D

---

Except he refers to "the client's" account as belonging to "her". Unless DannyM has taken to self-identifying as the opposite gender, it might imply he actually is referring to a third party.

Danny's good at making up stories, he has a particularly inventive one about an Arsenal replica top, a lack of toilet roll and a bet.

It's the husband who contacted me I know him fairly well so told me :)

Well played VW, gl tonight :p

Any news yet Lowe?