phil ringnalda

As Jason points out this morning (and Wayne pointed out in his web-free link feed a couple of days ago), eBay has an open redirect, at

http://cgi4.ebay.com/ws/eBayISAPI.dll?MfcISAPICommand=RedirectToDomain&DomainUrl=

Yes, that means that phishers can have their “login in and change your password” link start with cgi4.ebay.com, and capture those people who wouldn’t click a link that starts with a numeric IP address, or with something not-quite-right like ebaysecuritylogin.com, but would click a link that ends with it, and ends up at it, but… wouldn’t you guess that eBayISAPI.dll also does a tiny bit of logging, and pays particular attention to things without a referer, and with suspicious URLs? “Oh, no, B’rer Phisher, please don’t use my redirect URL!”