Hacker training sold on eBay

Development is further evidence of e-crime becoming mainstream

Tom Young, Computing 20 Sep 2007

Hacker toolkits that used to be available only on hidden forums are now for sale on eBay, according to security vendor Tier-3.

The development is further evidence of the burgeoning and complex trade network that supports e-crime on the internet, said Geoff Sweeney, chief technology officer at Tier-3.

'High level hacking tools, including surreptitious trojan loaders and Web site hacking utilities, are being put into the hands of almost any internet user,' he said.

The kits are often sold as ethical hacker training courses, but can easily be used for malicious purposes.

We are satisfied that the presence of such an item on the US site is not commonplace, as although we have 100m listings live on the site globally at any one time, we are very effective at removing prohibiting items, often before the listing ends and any sale is completed," said eBay in a statement.

See also:

NHS records end up on eBay

Cancer patient data found on hard drive bought by BT

17 Sep 2007

Consumers being turned into online criminals

Cybercriminals showing consumers how to pick a pocket or two

17 Sep 2007

Full sized screencap of the item in article. (Note that item is active as of this time.)

eBay warning: Hacking software available in auctions

September 20, 2007 (Computerworld Australia) -- Programs covering the full range of hacking software, from Trojans to keyloggers to step-by-step tutorials on how to effectively hack Web sites and personal information, are now available on eBay Inc.'s online auction site, raising the concerns of one security company.

"It's a simple matter of searching for it now" said Magida Ezzat, marketing communications manager at PC Tools.

"It's also very, very cheap -- it's possible to even get it for free." Although the programs are readily available on the Internet outside of eBay, the concern is that, since eBay is accessed by the general public, new audiences could become aware of how easy it is to get hacking tools. "People don't need to be highly technical to access and use hacking software," Ezzat said.

Although awareness of how to obtain and use hacking software is on the rise, policing and preventing the sale of the software remains difficult.

"For a Web site as large as eBay, policing is a near impossible task," Ezzat said. Nonetheless, security-focused Web sites such as eBay are aware of the problem. "Hacking software that was available yesterday has been taken off the auctions today," Ezzat said.

The good news is that hacking software auctions aren't very popular at this stage. A search of the eBay Web site reveals that very few auctions featuring hacking software have any bids.

Hacking kits openly for sale on eBay

Hacker toolkits - which were previously confined to specialist hidden forums on the Internet - are now being sold openly on auction sites such as eBay, for as little as $20. Where previously would-be hackers had limited access to the hacker forums and source the kits, the fact that they are now on open sale on eBay is very worrying.

The hacker kits are usually sold on eBay as ethical hacker training courses, but the courses also include a wealth of utilities for "educational purposes".

"This is a serious development," said Geoff Sweeney, Tier-3's CTO." It basically puts high level hacking tools, including surreptitious trojan loaders and Web site hacking utilities, into the hands of almost any Internet user - including novices - providing they have an eBay and Paypal account," said Sweeney.

"This is really bad news for companies of all sizes, as it means they have to be extra-careful on the IT security front. As we've said before, companies can no longer rely on a single line of defence for their IT resource and now need to consider extending their security umbrella to include behavioural analysis technology," he said.

"Only then can they have a safety net capable of intercepting both known and unknown electronic attacks on their IT systems," he added