Trojan Bayrob targets eBay users

Symantec warned eBay users that a sophisticated Trojan is seeking to scam them with a man-in-the-middle attack.

Named Trojan.Bayrob, the malware changes user hosts files to redirect traffic destined to numerous eBay sites, including eBay Motors, to a local proxy server and listens on localhost port 80.  From there, Bayrob downloads configuration data from the eBay servers, including a number of php scripts.

“The most interesting of these scripts is var.php; this script returns many different variables, which will be used in the attack,” Liam O’Murchu wrote on the Symantec Security Response blog. “The downloaded variables include tokenised versions of legitimate eBay pages.”

O’Murchu said that the exact motive behind Bayrob is still a mystery since the proxy servers are not yet using the right variables to start showing fake pages to users.

A spokesperson from eBay confirmed today that the auction company is aware of the problem.

“We have been working with Symantec to ensure that they share the details of this with other anti-virus software vendors,” the spokesperson said. “

We strongly encourage eBay buyers and sellers to never click on or download a link or file that is unfamiliar to them and always ensure your anti-virus software is up-to-date.”