View source for Courses/Computer Science/CPSC 203/CPSC 203 2007Summer L60/CPSC 203 2007Summer L60 TermProjects/Stolen!

==Group Members==
Michael Slipp
<br>Warren Chan
<br>Lindsay Thomason
<br>Ling Yin

__TOC__

==Initial Project Statement==

People increase their risk of identity theft when purchasing items on eBay, primarily when they are not properly educated about how to protect themselves.

==Argument==
====What is eBay?====
*[http://en.wikipedia.org/wiki/EBay eBay] is an online auction and shopping website where people buy and sell goods and services.
*Owned by an American Internet company, eBay Inc. (which also owns other well established businesses such as [http://en.wikipedia.org/wiki/PayPal PayPal] and [http://en.wikipedia.org/wiki/Skype Skype]).

====What is Identity Theft?====
*Identity theft is a criminal act whereby the collection and use of your personal information is done so without your permission and/or knowledge. This can lead to people receiving unwanted bills or charges to credit cards that they did not give approval of.
*Personal information that could be obtained may include: your name, date of birth, address, credit card numbers, Social Insurance Number etc.

====How does using eBay increase your risk of identity theft?====
=====Phishing=====
[http://en.wikipedia.org/wiki/Phishing Phishing] is any instance where a person gives the appearance of a reputable or trusted source for the purpose of obtaining another person's personal information.  A user could potentially copy any web page where a person inputs their personal information and have this duplicate site, commonly called a "spoof site", appear in a search.  Any person who unknowingly submits their information to this site would be deceived into thinking that they are giving their information to a source they trust when they are actually a victim of identity theft.

eBay and PayPal both have forms where people submit their personal information to create an account with them:

[https://scgi.ebay.ca/ws/eBayISAPI.dll?RegisterEnterInfo]

[[Image:Ebay reg1.JPG|800px|eBay registration page]]

[https://www.paypal.com/cgi-bin/webscr?cmd=_registration-run]

[[Image:Paypal reg.JPG|500px|PayPal registration page]]

However, a duplicate site could have the exact same appearance, but send the information to an entirely different source:

[[Image:Paypal source.JPG|View Source]]

[[Image:Paypal sourcetxt.JPG|Source]]

From this text file, anyone can view the code that created the webpage, and changing this code could maintain the site's appearance while redirecting the information to another computer.


Another form of phishing uses email: a fraudster finds a user's email address and sends them an email requesting that they re-submit their information.  This email will typically look official and business-like, so many people trust that it is a legitimate request and send their information, having their identities stolen in the process.

[http://www.millersmiles.co.uk/identitytheft/120903a-ebay-spoof.htm]

[[Image:eBayphishmail.JPG|Fraudulent email]]

=====Secure Socket Layer (SSL)=====
[http://en.wikipedia.org/wiki/Secure_socket_layer SSL] security is a type of encryption that protects a person's information as it is sent between computers.  eBay does use this technology, but it is not mandatory, or even the default option, when using the site.  In addition, the pages where users can change their password or view their account balance are not protected by SSL.  As a result, many users run the risk of having their information stolen by hackers without being aware that they are at risk, since SSL is an industry standard for submitting information and most users would assume that the page is protected.
[http://news.com.com/2100-1017-870959.html]

====What can you do to protect yourself?====
eBay has a list of account protection tips, so the first thing you can do is '''read them'''.  On their website, they list the following tips:
*Don't share your password with others. Protect it. Remember: eBay will never ask for your password.
*Choose a strong password and change it often.
*Create a unique password by using a combination of letters and numbers that are not easily guessed.
*Avoid using the same password for other accounts.
*Use caution when someone asks for sensitive information through email. If you get an email requesting personal information and you're unsure whether eBay actually sent it, check your My Messages inbox in My eBay. If the email is not there, it's fake. Do not click any links or enter information. Instead, forward the email to spoof@ebay.com
* eBay and PayPal offer you two-factor authentication to make your password even safer and stronger. The sturdy and portable PayPal Security Key is a small lightweight device that fits on your keychain.The PayPal Security Key generates a unique six-digit code that you add to your eBay User ID and password when you sign in. Because only you "hold the key", your account is even safer from unauthorized entry and identity theft.
*Download the eBay Toolbar with Account Guard. This free eBay tool lets you know when you're on an official eBay or PayPal Web site. It also protects you by letting you know when you're giving your password to a non-eBay site.
[http://pages.ebay.com/help/new/contextual/account_protection.html]

General tips to protect your online identity include:
*Purchase a computer security program, which will monitor your computer's activity.
*Update these security programs regularly.
*Never download attachments from email unless you are sure that it is safe (ie. you know the sender).
*Monitor all your account statements to ensure that there is no unusual activity.
*Always monitor your eBay account activities

Equally important is protecting your account while offline:
*Shred any papers that have any personal information on them before putting them in the garbage or recycling.
*Do not give out any information by phone or email.
*Check all your financial statements for potential discrepancies.
*Close any unused bank or credit card accounts.
*If possible, arrange for online financial statements to avoid having them stolen in the mail.
*Contact card issuers immediately if cards are lost or stolen.
[http://pages.ebay.com.au/securitycentre/identity-theft.html]

====What is eBay doing to help protect you?====
*[http://pages.ebay.ca/My_eBay/ My eBay]
This is an online account with eBay that allows you to manage your eBay activities.  Any communication from an eBay administrator will appear here, so if you receive any email that claims to be from an eBay administrator but does not appear in My eBay, it is most likely a fraudulent email.
*[http://pages.ebay.com/help/confidence/account-guard.html Account Guard]
Account Guard is a feature of eBay's free toolbar that provides additional security features for eBay account holders.  This service is able to:
#Identify "spoof sites" and provide a warning to the user that the site could be fake.
#Protect you from entering your password into an unverified site by asking for additional verification that the site can be trusted.
#Provide a direct link to eBay's reporting system, where you can report a site that you think is fake.

eBay also utilizes technical and procedural safeguards, including firewalls, encryption, and Secure Socket Layers (SSL), to protect your personal information against loss or theft, as well as from unauthorized access and disclosure.

====Conclusion====
We have determined that eBay has sufficient protection for its users to be safe from basic identity theft attempts, but users are still vulnerable to more advanced attacks.

==References==

#https://scgi.ebay.ca/ws/eBayISAPI.dll?RegisterEnterInfo
#https://www.paypal.com/cgi-bin/webscr?cmd=_registration-run
#http://www.millersmiles.co.uk/identitytheft/120903a-ebay-spoof.htm
#http://news.com.com/2100-1017-870959.html
#http://pages.ebay.com/help/new/contextual/account_protection.html
#http://pages.ebay.com.au/securitycentre/identity-theft.html
==External Links==

<b><i>http://pages.ebay.com/securitycenter/

http://pages.ebay.com/securitycenter/law_enforcement.html

http://news.com.com/2100-1017-870959.html

http://www.consumeraffairs.com/news04/2005/ebay_fraud.html

http://money.howstuffworks.com/ebay9.htm

http://www.auctionbytes.com/cab/abn/y02/m10/i12/s01

http://news.bbc.co.uk/1/hi/wales/4615117.stm

http://archives.cnn.com/2000/TECH/computing/11/07/suing.ebay.idg/index.html

http://www.fightidentitytheft.com/2002_JUL29_ebay_auction_fraud.html

http://archives.cnn.com/2002/TECH/internet/02/18/ebay.identity.theft.idg/index.html

http://www.ci.mtnview.ca.us/city_hall/police/crime_prevention/identity_theft.asp

http://pages.ebay.ca/help/pay/payment.html

http://en.wikipedia.org/wiki/Phishing

http://en.wikipedia.org/wiki/Secure_socket_layer

http://en.wikipedia.org/wiki/Skype

http://pages.ebay.ca/My_eBay/

http://pages.ebay.com/help/confidence/account-guard.html</i></b>


<b>http://www.rcmp-grc.gc.ca/scams/identity_theft_e.htm

http://www.pcworld.com/article/id,118709-page,1/article.html

http://pages.ebay.com/securitycenter/deterring_identity_theft.html

http://news.com.com/2100-1017-966835.html

http://www.millersmiles.co.uk/identitytheft/120903a-ebay-spoof.htm

http://millersmiles.co.uk/identitytheft/100303a-ebay-spoof.htm

http://kyl.senate.gov/legis_center/pharming.cfm

http://www.wiredsafety.org/safety/personal_information_safety/id_theft/index.html

http://www.abika.com/Reports/ebayusercheck.htm

http://antivirus.about.com/cs/emailscams/a/blebayscam5.htm</b>



<i>http://www.consumeraffairs.com/news04/2006/01/ebay_hacker.html

http://pages.ebay.com/securitycenter/deterring_identity_theft.html

http://news.zdnet.com/2100-9595_22-966835.html

http://pages.ebay.com.au/securitycentre/identity-theft.html

http://reviews.ebay.com/Wipe-Computer-Hard-Drives-To-Prevent-Identity-Theft_W0QQugidZ10000000000718162

http://www.caveatemptorus.com/protectyourself.html

http://www.identitysafetytips.com/identity-theft/facts-about-identity-theft.html

http://pages.ebay.in/help/confidence/problems-identity-theft.html

http://pages.ebay.in/help/confidence/isgw-account-theft-protection.html

http://www.informationweek.com/story/showArticle.jhtml?articleID=164300338

http://www.winferno.com/guides/antiphishing/ebay-fraud-identity-theft-paypal-fraud-spoofing.asp</i>


http://www.privcom.gc.ca/fs-fi/02_05_d_10_e.asp

http://en.wikipedia.org/wiki/EBay

http://en.wikipedia.org/wiki/PayPal

http://www.eweek.com/article2/0,1895,2102657,00.asp

http://www.theregister.com/2007/03/13/vlad_impales_ebay/

http://jcmc.indiana.edu/vol7/issue3/boyd.html

http://www.som.yale.edu/Faculty/sunder/eBay/eBayOct1602.pdf

http://www.crn.com/security/18830358

http://news.com.com/2100-1017-874311.html

http://nevada-outback-gems.com/ebay_fraud/Encyclopedia_fraud_P2.htm

http://nevada-outback-gems.com/ebay_fraud/