Ebay Fixed Malware Upload and Patch Disclosure Bugs

Ebay Fixed Malware Upload and Patch Disclosure Bugs

Shopping gaint Ebay has fixed a pair of security vulnerabilities that could allow attackers to upload malware executables and then point victims to them through drive-by download attacks.

Drive By Download Attacks ?

Drive-by-download attacks occur when a visitor navigates to a site that injects malware onto the victim's PC. Crucially, these attacks are usually downloaded and run in the background in a manner that is invisible to the user - and without the user taking any conscious action steps to initiate the attack. Just the act of viewing a web-page that harbors this malicious code is enough for the attack to run.

This is because of the failure of an eBay page to check the headers of image files uploaded by users, security researcher Aditya Sood said, "It basically verifies the image extensions. As a result, it is possible to upload a camouflaged malicious file (EXE,PDF,etc.) with image file extension."

"The attacker can upload malicious exe file camouflaged as image files and then use the URL in drive by download attacks or the attacker can also hide malicious executable in the image file which can be be executed on the end-user system when image file is opened," Sood added.

Researcher Rohit Bansal and Aditya Sood reported the vulnerabilities and the Ebay fixed the bugs before any of their customers were affected.

No comments

Powered by Blogger.