Dear Ebay: I told you so!

“Sir,” said the Ebay Support person on the phone, “We’re Ebay, and we’re pretty sure that no one can hack into our system.”

A few months ago, she was responding to my alarmed phone call, as I was pretty sure that someone was hacking into Ebay’s software and system to manipulate the online auction giant and further “hide” already hidden fake auctions designed as a smart phishing effort via Ebay’s apparent ironclad software.

As you may have read recently, a few days ago Ebay requested that all of its users change their passwords. This was as a result of a data breach in which “hackers figured out eBay employee credentials, which helped them gain access to the eBay database.”

Ebays admits now that “email addresses, phone numbers and other details were hacked.” 

But I have evidence from the recent past that hackers also potentially may have manipulated the Ebay auction software to use the auction site as a phishing vehicle.

This is how it all started, and here submitted for your consideration:

On January 27, 2014, I was sitting in Glen Echo while my son was in his music class. I was bored and surfing the net and logged onto Ebay. To my surprise I noticed almost a dozen messages in my Ebay inbox. I write “to my surprise,” because whenever I get an Ebay-generated message (either from Ebay or from an Ebay user sending the email from their Ebay account) I have a rule that automatically forwards it to my personal email account.

That’s exhibit (a) – There were multiple messages from Ebay users to my account, all dealing with the same 3-4 Ebay auctions and messages that were never forwarded to me. If I hadn’t logged onto my Ebay account, I would not have seen them... until it was too late! By the way, all auctions were about to end - they were seven day auctions and all were in day 5 or 6.

All the messages referred to the same assorted “auctions” that had been posted as if coming from my account. I have the word "auctions" in quotes because none of the auctions were mine, and also because all of them were cleverly designed to phish people out of their money. I quickly responded to all the emails warning the users that the auctions were a scam and had nothing to do with me.

The fake auctions had been created without my knowledge and had also somehow circumvented the Ebay notification system that sent an email to my account each time that a real auction lot is created under my account.

That’s exhibit (b) – Someone was able to create an Ebay listing under my account and at the same time prevented the Ebay software from notifying me that a new lot had been created.

The fake listings offered tech goods at ridiculous prices, such as Apple MacBook Pro Retina 15.4" GeForce, or a new Samsung 65" 3D Smart TV.

The hacker had cleverly inserted his email address (4iph55@gmail.com) into the image of the item being offered, highlighted it in yellow, and requested that interested bidders contact him directly prior to bidding. The incoming emails that were in my Ebay inbox (but not being forwarded to my regular email) were from interested bidders wanting to know why they needed to contact the person offering the lots. From reading the threads it was easy to see why…

The phishing scam artist was asking interested parties to wire him money directly, instead of bidding through the Ebay system. When users balked at this, and instead bid the “normal” way via the Ebay lot, he was then able to generate a fake Ebay email from checkout@ebayprotection.com to every single bidder, announcing to the victim that they had won the auction and requesting payment. He also offered next day UPS shipping at no additional cost.

Pretty cool uh? Dude is able to ship a 65" flat screen TV via next day UPS at no additional cost!

I immediately reported the fake auctions to Ebay, and they immediately cancelled them. Subsequently, throughout all this process, I was reporting all of these issues to Ebay via email, and receiving canned email responses from them. I then tried several times to report the issue via telephone, but each time I was assured by the Ebay telephone operator that there was no way that what I was describing could actually have taken place. They told me to change my password (Nevermind that I use really hard passwords: 16-20 mixed characters, and change them several times a year), but refused the logic of the events, or could not explain the technical reasons why these lots had all been posted without generating emails to me, or how the emails to my Ebay account had not been forwarded to me, and even more important --- and the key evidence of hacking into Ebay’s software: why these listings were not visible as my listings in MyEbay!

Exhibit (c) – The hacker was able to create listings using my account and yet they were not listed in MyEbay as my listings.

Working with some of the Ebay users who were nearly scammed, I was also able to piece together the identity of the scammer.

Name: Victor Stan Cornel
Email: 4iph55@gmail.com
Address : Al Solidarnisci Nr. 118/2 00-140 Warsaw Poland.
Bank Name : Millenium Bank
Bank Address : ul.Stanislawa Zaryna 2A 02-593 Warszawa Poland.
IBAN : PL 16 1160 2201 0000 0002 4729 3383
SWIFT : BIGBPLW

I passed all this information to Ebay, who ignored it… at least as far as I know, since I never received a response from them. I also contacted Millenium Bank in Poland and advised them of the issue. They promptly replied to me and passed that they were sending my email to the “right unit of our bank” and advised me to “report it to law enforcement bodies.” And thus I reported the whole event to Interpol, since this phishing mutant apparently lives (or at least has a bank account in Poland). I also tried a dozen ways to report to Google that a phishing scheme was being run from a Gmail account; not sure if I was successful.

Every single thing that I’ve written here has been exhaustively reported to Ebay. When the first telephone operator dismissed me, I called back, got a different operator and reported it all over again from scratch. When that also failed, I did it a third time.

After that I gave up.

And then a few days ago I read about the Ebay system breach. It apparently happened a while back, but Ebay just confirmed it.

Do you think these that two issues are related?

And this is why...

In the past I've harped as to the danger of grouping the Hispanic or Latino vote into one block, as if all people from the twenty-plus nations south of the border and in the Caribbean are all alike and all think alike.

Spanish is a perfect example... Below is an image of something being sold in a local Supermarket which caters to Central American shoppers... The item being offered is "chocho" - which I have no idea what this is, but I do know, that this is also the Puerto Rican slang for, ahem... a woman's private parts and easily a word forbidden on Spanish language radio on the island.

I Googled the word in Google Images, just for fun, and got a boatload of porn.

But here's a Central/South American "chocho"... cough, cough...

Dress for Success Benefit

Happy Memorial Day!

American Flag by Jonathan S. Woods, which was part of Artomatic 2012

DC Judge rules in favor of DC gallery

From DC's Charles Krause Reporting:

After two years of threats, refusing to meet with me or even tell me the nature of the complaints they had received, the Solo Piazza Condominium Board  where I live filed suit on March 16 to shut down the gallery I opened in December 2011.

The issue before the Court was whether an art gallery was an "accessory office use" permitted by the condominium's by-laws, which I was bound by when I purchased my apartment seven years ago. In letters to my attorney, Benny Kass, and to me before the suit was filed, the board changed its story a number of times about why it  was so opposed to allowing me to operate the gallery---especially after it learned that I had obtained a permit from the DC government giving me the right to do so.

Nonetheless, the board clearly expected to win the suit, allocating only $500 for legal fees in the building's 2014 budget (because the bylaws say that if the board has to go to court to enforce the bylaws and wins, the co-owner who loses has to pay both his own legal fees and the condominium's legal fees as well).

Pushing its luck even further, the board filed a motion for summary judgment shortly after it filed its complaint, arguing that since an art gallery  is obviously not an "office," the judge should execute summarily; obviously, they were thinking the judge would make short work of my gallery, not their credibility.

As it turned out, however, the only thing that was obvious about the board's complaint and its motion for summary judgment was that neither they nor their attorney had bothered to do the most basic legal research to determine how the word "office" is defined.  

What my attorneys at Kass, Mitek & Kass discovered, much to their surprise and very much to their credit, was that the word "office" had never been litigated before-- in which case the DC courts rely on Webster's Unabridged Dictionary to define legally undefined words for them.

And sure enough, Webster's defines "office" as "a place where a particular kind of business or  service for others is transacted."

So, dear friends and art aficionados, the judge denied the board's motion for a summary judgment and, instead, ruled in my favor. It's official: my home is now an office and my office is now a place where I can show and sell art that might not otherwise have a home if DC Superior Judge Michael O'Keefe hadn't found that the condo board where I have my home, my gallery and my office hasn't a clue what the bylaws mean nor the wit to look in a dictionary before they file a mean-spirited and expensive lawsuit contending that an art gallery isn't an office and therefore isn't a permitted "accessory office use" of my home office which, by the way, is located in a section of Washington that's an officially designated arts zone.

Is this the end? Probably not. But it's a good beginning.

Read the review of their current exhibit by Mark Jenkins in the WaPo here.

The Lilith

"The Lilith." Watercolor on Paper. 7x5 inches matted and framed to 10x8 inches.

Congrats!

To DMV artist Tim Tate, winner of the 2014 Brilliance Award. Details here.