eBay scripting trick used to boost seller ratings

Shockwave redirection ploy in mystery auction attack

Hackers have been caught using a malicious scripting scam in an apparent attempt to boost their rating on eBay.

An auction for a 4WD car on eBay.co.uk featuring the ruse was brought to our attention by Reg reader John early on Monday. eBay pulled the auction on Monday afternoon but The Reg has this screenshot.

The auction for a 2007 Range Rover Sport HSE offered a car valued at £40K for £12K. Clicking on the auction generated a suspicious pop-up, served up from Russia. Having established something was amiss we called up security experts at Sophos to analyse the attack, which we initially took to be a scripting variant of the Bayrob Trojan scam.

Not so.