Trojan Bayrob targets eBay users

By

Symantec warned eBay users that a sophisticated Trojan is seeking to scam them with a man-in-the-middle attack.

Trojan Bayrob targets eBay users
Named Trojan.Bayrob, the malware changes user hosts files to redirect traffic destined to numerous eBay sites, including eBay Motors, to a local proxy server and listens on localhost port 80.  From there, Bayrob downloads configuration data from the eBay servers, including a number of php scripts.

“The most interesting of these scripts is var.php; this script returns many different variables, which will be used in the attack,” Liam O’Murchu wrote on the Symantec Security Response blog. “The downloaded variables include tokenised versions of legitimate eBay pages.”

O’Murchu said that the exact motive behind Bayrob is still a mystery since the proxy servers are not yet using the right variables to start showing fake pages to users.

A spokesperson from eBay confirmed today that the auction company is aware of the problem.

“We have been working with Symantec to ensure that they share the details of this with other anti-virus software vendors,” the spokesperson said. “

We strongly encourage eBay buyers and sellers to never click on or download a link or file that is unfamiliar to them and always ensure your anti-virus software is up-to-date.”
Got a news tip for our journalists? Share it with us anonymously here.
Tags:

Most Read Articles

"Widespread data theft" hits Salesforce customers via third party

"Widespread data theft" hits Salesforce customers via third party

Home Affairs adds SecOps to new cyber risk overhaul

Home Affairs adds SecOps to new cyber risk overhaul

Exetel fined $694k over system 'vulnerability' for mobile number porting

Exetel fined $694k over system 'vulnerability' for mobile number porting

Attackers weaponise Linux file names as malware vectors

Attackers weaponise Linux file names as malware vectors

Log In

  |  Forgot your password?