4

To preface this, I'd just like to let you know that I'd consider myself an intermediate security guy(Definitely not a novice, not yet an expert) I do have a story to tell, and would like to know if you guys have any ideas as of what happened.

1. The call My friend received a call today(From his supposed credit card company) , that his credit card was charged three days ago on eBay for the amounts of $1, $10, and $40 dollars. He responded to the call right away (He did not give away any personal information about the card or himself, he just gave his address to verify himself and the woman on the phone simply asked him if he had completed the purchases or not.) He of course said that he did not authorize those purchases. He then asked me if I could see why his computer could not access eBay.com.

2. eBay.com Typing eBay.com into Chrome was giving him a page not found error(he could access every other website.) He tried on his sons laptop and he could log in just fine. The first thing I did was go to his hosts file. To my surprise (for the first time) there were additional entries in it. There was a list about 30 lines long of eBay domains/sub-domains that were pointing back to localhost. Real fishy.

3. My advice He told me that he doesn't believe that his credit card was on file with eBay or PayPal so he didn't know how they could get that information. My advice was to change all of his account passwords and to keep track of his billing statements. I also got rid of all of the eBay hosts file entries to give him a clean slate.

4. How? How could this have happened? Just trying to overwrite the hosts file in Windows 7 is a pain. Having to go through Administrative access and all. I told him that it was possibly a phishing attack. I don't know how they got to his hosts file though. All of the hosts file entries were somehow only involving "eBay" and no other retailers. Coincidence? I think not.

5. His setup, and my question He has a simple i3 Asus laptop running Windows 7 (I did a clean install when he purchased it 3 weeks ago.) All he uses the laptop for is the internet. Clean Win 7, Google Chrome, and Microsoft Security Essentials with real-time protection turned on. Nothing else. How could this have happened? I'm really clueless. Any feedback is welcome.

Improve this question
1
  • 1
    You should tell your friend NEVER to verify personal information over the phone when they RECIEVE a phone call. There is no reason to do this, if i receive a phone call from my bank, I tell them to send me a letter.
    – Ramhound
    Commented Apr 9, 2012 at 17:43

1 Answer 1

Reset to default
2

Well not all exploits are in the overt yet. Obviously these guys know one. They also seem to be quite bold to just contact their victim.

I have heard of this before with a 2 way authentication mechanism for a bank, where the misfeasors called their victim too.

What I can think off immediately:

  • Your ISO was not an official one and it already contained backdoors
  • He got infected with an unknown virus
  • Essentials just failed to detect it
Improve this answer
6
  • I downloaded the ISO from here. Should be legit. I didn't check the MD5 though (rookie move?) mydigitallife.info/…
    – EGHDK
    Commented Apr 8, 2012 at 6:23
  • Well I actually used those as well one time, they are from an official MS partner, if you have the ISO's check the hashes. But I think they will check out okay.
    – Lucas Kauffman
    Commented Apr 8, 2012 at 7:24
  • Yeah, so I'm guessing it was just infected with something. Should I run more tests on it? All I ran was a Security Essentials scan and it came back clean.
    – EGHDK
    Commented Apr 8, 2012 at 19:46
  • Yea, what you can do is try this one support.kaspersky.com/faq/?qid=208282173 it's a live disk from kaspersky, it scans without actually booting the windows operating system. I have good experience with it detecting where other AV fail (rootkits). Try it, if it doesn't work I'm out of inspiration.
    – Lucas Kauffman
    Commented Apr 8, 2012 at 20:04
  • Thanks for the link. Is it recommended even though I can boot into windows just fine?
    – EGHDK
    Commented Apr 9, 2012 at 1:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .