eBay may be spying on your computer 🕵️🖥️

The world's best-known auction website may be able to access its millions of users' computers remotely. The discovery was made this week by Charlie Belmer, who works in privacy and security at DuckDuckGo.

The expert's claim on his blog caused a stir: this behaviour by the website was observed in browsers on Windows, but not on the Linux operating system.

What is a port scan?

In very simple terms, a port scan is an application or technique often used to check for open ports on a network, hosting environment or server, in order to prevent, or carry out, specific attacks.

Antivirus software can very often detect these active port scans and flag them as potential abuse or attempted attacks. Security professionals often use these applications to help them identify weaknesses in a system that cybercriminals could exploit.

At the same time, hackers use them for the same reasons: to find open ports that could ultimately allow them to access the operating system remotely.

Which ports is eBay using?

Bleeping Computer has put together a list showing a total of 14 ports being probed by eBay. Apart from an unknown program on port 63333, the remaining 13 are remote access tools such as VNC and TeamViewer.

Tests have since been carried out in two different browsers (Google Chrome and Mozilla Firefox), both running on Windows 10 computers. The tests followed these steps: open the browser, press F12, then select the "network" tab. On visiting eBay's website, connections to 127.0.0.1, or localhost, could indeed be seen being scanned.

For a closer look at this subject, see this article.

What does eBay say about it?

A journalist from a US magazine asked the company about the issue, how the data was being used and whether users' consent should be sought before taking this action. An eBay spokesperson replied: "Our customers' privacy and data remain our top priority. We are committed to providing a safe and trusted experience on our sites and services."

Even so, the company is known to be investigating complaints about this port-scanning activity, a technology that is indeed used as part of its fraud detection programme.

This particular technology is called ThreatMetrix and is used to identify potentially compromised systems and fraudulent activity. The same reporter contacted LexisNexis Risk Solutions, which markets ThreatMetrix, but the company declined to comment on the case.

Could this be fraud protection?

But what if eBay is doing this to prevent problems, because it takes security very seriously? That would be great, of course. We should all applaud strict cybersecurity measures, but here is the problem: should users not be asked for consent before their computers are spied on?

If asked, users would most likely consent. However, even if something about this were buried in eBay's terms and conditions, it would make little difference. Apparently, this behaviour does not only affect authenticated users who are logged in to the website; it also happens to visitors who have no account or are not logged in, even if they use private browsing tabs (known as incognito mode in the browser).

What do the experts say?

Cybersecurity professionals are almost unanimous on this subject: companies should always avoid carrying out this kind of activity so quietly, without even warning their customers or visitors. Yes, even if they are preventing fraud.

This situation brings another major disadvantage for the company: like many others, eBay relies heavily on its customers' trust to thrive. By running these scans without asking permission or informing them, it may drive users towards its competitors.

Any website with access to its customers' bank details should offer the best possible protection against fraud, even if that means using a port scan, but it must tell users it is doing so.

Some banks are known to do this too, without asking their customers' permission or telling them. Questions remain, extending even to the legality of the practice. In the United Kingdom, for example, it is prohibited and can even lead to a prison sentence.

How can I stop eBay doing this on my computer?

There are a few ways to prevent these scans if you use Windows. You can use other browsers to visit eBay, which apparently blocks the port scan, according to reports from some users on Twitter.

Alternatively, you can install apps and extensions for Chrome and Firefox that block this kind of activity.