Zeroday 01100100011010010

“3. Note that we cannot remove feedback that is retaliatory, libelous,
defamatory, untrue, unwarranted, or otherwise unfair unless we receive
documentation for removal from a court of law. eBay provides the
Feedback Forum as a place where users can express their opinions.
Opinions cannot be censored and remarks will not be investigated for
accuracy. Each individual member is solely responsible for the opinions
placed in the Feedback Forum. “

I had to look this up because I was given a retaliatory feedback. It works like this. Say you are a power seller in the low profit margin but high volume sector. In particular I was in the market for a cheap adapter for my PSP. I found one on eBay and the seller had a decent rating, ok confession… I barely look at the rating. I just see a number and go with it. If the number is really low (say > 40) I am very cautious but anything higher and I just conduct the transaction. This is flawed thinking. My particular seller has the following rating
Positive Feedback: 99.8%
Wow! That’s awesome. I could trust this man to babysit my kids (If I had kids that is). He could certainly water my plants while I’m on holiday. A further look shows that:
Members who left a negative: 47
Oh wait, that’s terrible! 47 people have had such a negative expierence with him that they left negative feedback?

There in lies the weakness of the eBay rating system. Those big numbers lull you into a feeling of false security. In fact a high feedback rating is only accurate if the user is under 50 points. There you will find that even a single bad rating will create wild swings. Let’s take me for instance.
Positive Feedback: 96.7%
That’s not honor roll good or even Dean’s list good. That’s a standard “A” for effort.
I must have received something like 240 negative ratings to warrent such a bad feedback percentage. No, in fact I had two. One from the jerk I bought the defective PSP adapter from. It’s the power of volume selling and if thought through eBay can only support it. Why would they chose me in a fight between this power seller and a sometimes buyer seller like myself. Clearly he represents more business and thus more profits for eBay.
So in the interest of public good I present a quick guide to spotting a bad eBay Seller.

Note in this real life example I’ve obscurred both my userID and the seller’s ID. As mentioned earlier 47 others thought this person was less then honorable to deal with. If one goes back far enough in the actual history provided you can actually read the complaints. eBay does not make this easy. If there were a way to lookup just the negative comments this type of investigation might be easier. Of those 47 what is important is how often this type of thing occurs. Given the age of the account, 4 years now, we can average say one per month and assume this person might still be fairly reliable. Everyone has a bad day from time to time. Everyone gets that one cranky customer who might leave a bad mark just to be a pain.
I’ve circled the important bits in this picture. 28 complaints in just the last 6 months! That’s an average of four per month or one per week. Considering the amount of goods this buyer moves that may not be a terrible average. But the average is skewed. He only moved 5000 items prior to six months ago. That’s a huge upswing in volume. In the past month alone 9 complaints. In retrospect I would not purchase anything from this person. The numbers point to a slumping attitude and likely a person at wit’s end. If a single person is running this operation then assume that anything that goes wrong will be amplified by 100. As in my case things went from bad to worse. I don’t know if he knew that he shipped bad adapters (the plug literally pops out of the PSP) but regardless he refuses to deal with it. Or maybe he simply can’t.

One really important thing to notice is the amount of “mutually withdrawn” complaints he’s had. 19! These are situations which are easy to predict. A frustrated customer is upset and gives a negative rating. I received the following message from the seller of my defective PSP adapter:

“Thank you for writing to us.

Best Regards,
“

A week later I received an offer to “mutally withdraw” the feedback. Negative feedback is simply a tool for this person. If the customer leaves bad feedback respond in kind and then offer to remove the unwarranted feedback you left as retaliation.

Earlier I mentioned I had two negative marks, only one from the above. So what was the other you may ask. Same deal actually. It’s not that I don’t learn, I just don’t care. eBay is not a source of revenue for me and I am not so enthralled with the concept of buying stuff from strangers online. I have craigslist for that now. A certain amount of respect goes into the transaction when both parties are within driving distance of each other.

It’s difficult to know who is who anymore. And I don’t mean the age old issue of changing personalities after major life events (marriage, breakup, big promotion). A recent talk by Christopher Abad at cansecwest/06 outlined this type of issue. How can we trust anything that is said online? How are we to know that the person who said it is the person who claims to have said it? In a recent blog post praising Abad’s talk here we see a comment purported to be from Dave Aitel. I’ve met Dave before and although I’m sure we wouldn’t list each other as beneficiaries on each others wills we are acquainted. I haven’t had time to ask him directly but my own gut says this comment isn’t Dave. It just doesn’t sound like something he would say or “how” he would say it. Word choice is as unique a fingerprint as say handwriting can be. But the “posted by:” says Dave and it does point to his company at Immunity.

As TK points out in the reply “without a proper digital signature on this posting, it would be Abad himself authoring it. (it is not but I am just trying to make the point)”. Abad could infact be the author of this post. Just because you read something on this blog doesn’t mean that it came from me. Someone could just as easily figure out a way into my blog and make a post in my name. A few minutes of searching on Daily Dave (Aitel’s mailing list) turns up this post from Dave stating it was not him who made the comments. In it Dave states,
“Just for the record, neither of these postings is from me. Sorry, tk, but I’m currently helping Nico and Bas with a heap overflow and can’t
figure out how to get a “TypeKey” identity, let alone have time to
post on the ncircle weblog. unmask.py would have told you I can’t talk
like that anyways. :>”
Now that sounds like Dave.

slides from the cansecwest/06 talk

Test Credit Card Numbers:
Visa: 	4111-1111-1111-1111
MasterCard: 	5431-1111-1111-1111
Amex: 	341-1111-1111-1111
Discover: 	6011-6011-6011-6611
Credit Card Prefix Numbers:
Visa: 	13 or 16 numbers starting with 4
MasterCard: 	16 numbers starting with 5
Discover: 	16 numbers starting with 6011
AMEX: 	15 numbers starting with 34 or 37