Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon's customer service backdoor

medium.com

Post reply on HN
Print view View original

51–60 of 366 posts

Re: Amazon's customer service backdoor

#51

Post by DougWebb »

tyingq wrote: post #43
nmjohn wrote: post #35

> services should allow me to easily create lots of aliases. Right now the best defense against social engineering seems to be my fastmail account which allows me to create 1 email address alias per service What you may want is a catch-all email - which lets you do @domain.com -> nmjohn@domain.com (where is everything besides already defined addresses) - that way you can make up emails on the fly without having to se…

You can approximate this with gmail using the plus sign. Like myaccount+label@gmail.com. It's ignored for delivery, but gmail's filters can match on it in the to: address.

Every time I've tried to use that feature, the email field in the registration form I'm trying to fill out rejects it because they don't like + in an email address. There are a lot of not-quite-correct email form validation routines out there. Or maybe this is selection bias: the forms where I'm most likely to want to use the + are with the companies that are most likely to want to resell my email address, and they may be intentionally rejecting the +.

Re: Amazon's customer service backdoor

#52

Post by mrb »

How to stop this:

1. Get a friend's permission to "hack" into his Amazon account (or "hack your own account").

2. Contact Amazon's customer service, try the same social engineering techniques that the OP documented.

3. Once you obtain some sensitive information from the account, scare the CS rep by saying: "Haha! I am actually not the customer. I am a journalist/hacker/whatever and wanted to see how easy it was to social engineer information out of your customer service department, and you failed. I would like to talk to your manager please."

Hopefully if enough people do this, it will get some internal attention at Amazon.

Re: Amazon's customer service backdoor

#53

Post by DINKDINK »

danneu wrote: post #17

Whois is great for social engineering attackers. You get a name, email, address, and the first service to attack. Meanwhile, the ICANN is working around the clock to make it illegal for us to protect our personal information, and whois protection is becoming an increasingly niche service for registrars. For example, gandi.net (and thus Amazon) doesn't hide your name when you have it turned on. By the time you find th…

> By the time you find this out, it might occur to you to just type in a different name, but now you're violating ICANN policy.

Why not just "sell"/transfer ownership of your domain to another entity (one that you own)?

Re: Amazon's customer service backdoor

#54

Post by Latty »

JoshTriplett wrote: post #45
danneu wrote: post #4

Earlier quoted context omitted.

On the other hand, 2FA opens up the "I lost my phone" customer support channel which might be just as weak. For example, you can turn on 2FA for sending money via Bank of America's webpanel. As in, you log in with username/password and need 2FA for some restricted actions. Well, phone up customer support and they'll remove your 2FA if you can provide them some secret details... all of which are displayed on the webpa…

> On the other hand, 2FA opens up the "I lost my phone" customer support channel which might be just as weak. "I lost my phone" (or "my phone stopped working") does need some solution, though. The right way to handle "I lost my phone" seems like one of two possibilities: either come into a branch and provide legal identification matching what you used to open the account (and get "yourself" on camera doing so), or ha…

Shout out here to NearlyFreeSpeech who do this right. They give you a set of verification actions:

    You provide a scanned copy of a government-issued photo ID.
    You provide a scanned copy of a statement showing both the most recent deposit and a name and address matching one of your accounts.
    You complete SMS verification. (SMS must be previously configured.)
    You complete 2-factor verification. (2-factor auth must be previously configured.)
    You correctly answer your security question. (Security question and answer must be previously configured, below.)
    You use an ssh key to create a file with a specific name on one of your sites hosted here. (Must be previously configured, won’t work if account is empty.)
    We try and fail to contact you via your currently configured email address. (This one may take a long time.)
You can then pick how many of these you want to require to get your account back (and which you want to configure), including an option not to help at all in the case you lose your account.

Re: Amazon's customer service backdoor

#55

Post by notyourwork »

danneu wrote: post #17

Whois is great for social engineering attackers. You get a name, email, address, and the first service to attack. Meanwhile, the ICANN is working around the clock to make it illegal for us to protect our personal information, and whois protection is becoming an increasingly niche service for registrars. For example, gandi.net (and thus Amazon) doesn't hide your name when you have it turned on. By the time you find th…

> For example, gandi.net (and thus Amazon)

Why do you say here and thus Amazon?

Re: Amazon's customer service backdoor

#56

Post by asymptotic »

notyourwork wrote: post #55
danneu wrote: post #17

Whois is great for social engineering attackers. You get a name, email, address, and the first service to attack. Meanwhile, the ICANN is working around the clock to make it illegal for us to protect our personal information, and whois protection is becoming an increasingly niche service for registrars. For example, gandi.net (and thus Amazon) doesn't hide your name when you have it turned on. By the time you find th…

> For example, gandi.net (and thus Amazon) Why do you say here and thus Amazon?

You can register for domains through AWS Route 53 and it'll automagically register on Gandi with WHOIS protection and link it up inside Route 53. You then don't need to leave the AWS UI, it just seems like it works magically.

(I think this is true...I can't remember now actually).

Re: Amazon's customer service backdoor

#57

Post by jakobegger »

JoshTriplett wrote: post #39
nmjohn wrote: post #35

> services should allow me to easily create lots of aliases. Right now the best defense against social engineering seems to be my fastmail account which allows me to create 1 email address alias per service What you may want is a catch-all email - which lets you do @domain.com -> nmjohn@domain.com (where is everything besides already defined addresses) - that way you can make up emails on the fly without having to se…

Note, though, that catch-all emails will also catch a ridiculous amount of spam. Creating each account name individually avoids that problem, at the cost of some extra trouble when registering a new service. An intermediate step that may work if you don't expect people to target you individually: have one or more required substrings for the email local part, and catch all mail to addresses containing that substring.

I receive all mails @ my domain and I get about 1 spam a day. Fastmail's spam filters are pretty good.

Re: Amazon's customer service backdoor

#58

Post by sombremesa »

mdavidn wrote: post #46
nmjohn wrote: post #35

> services should allow me to easily create lots of aliases. Right now the best defense against social engineering seems to be my fastmail account which allows me to create 1 email address alias per service What you may want is a catch-all email - which lets you do @domain.com -> nmjohn@domain.com (where is everything besides already defined addresses) - that way you can make up emails on the fly without having to se…

Fastmail and Gmail support a local suffix of the form yourname+amazon@gmail.com. That's a plus character between the local name and local suffix. If you use a password manager, you can replace a predictable suffix like "amazon" with random hex value. Unfortunately, many sites borked their e-mail address validation and do not accept the plus character. (Amazon permits it.) Also, you'll ocassionally find a customer ser…

I fear that customer support might still accept emails without the suffix from the "customer". These are people, not robots, so if the address is close or in the vicinity of being correct, they might accept it. Same goes for the dot characters allowed in gmail addresses.

Re: Amazon's customer service backdoor

#59

Post by pyre »

JoshTriplett wrote: post #39
nmjohn wrote: post #35

> services should allow me to easily create lots of aliases. Right now the best defense against social engineering seems to be my fastmail account which allows me to create 1 email address alias per service What you may want is a catch-all email - which lets you do @domain.com -> nmjohn@domain.com (where is everything besides already defined addresses) - that way you can make up emails on the fly without having to se…

Note, though, that catch-all emails will also catch a ridiculous amount of spam. Creating each account name individually avoids that problem, at the cost of some extra trouble when registering a new service. An intermediate step that may work if you don't expect people to target you individually: have one or more required substrings for the email local part, and catch all mail to addresses containing that substring.

One method that I've seen used (heard it described by a guest one of Leo Laporte's podcasts a looooong time ago) is to iterate account names by year. For example, this year the email address would be pyre2016@example.com, and next year it will be pyre2017@example.com. Not sure how well it works, but the idea is that by that every year you start over with a fresh address (that takes a while to get onto spam lists).

I'll note that I don't use this method as it seems too high maintenance and the effectiveness is unclear.

Re: Amazon's customer service backdoor

#60

Post by D-Coder »

mdavidn wrote: post #46
nmjohn wrote: post #35

> services should allow me to easily create lots of aliases. Right now the best defense against social engineering seems to be my fastmail account which allows me to create 1 email address alias per service What you may want is a catch-all email - which lets you do @domain.com -> nmjohn@domain.com (where is everything besides already defined addresses) - that way you can make up emails on the fly without having to se…

Fastmail and Gmail support a local suffix of the form yourname+amazon@gmail.com. That's a plus character between the local name and local suffix. If you use a password manager, you can replace a predictable suffix like "amazon" with random hex value. Unfortunately, many sites borked their e-mail address validation and do not accept the plus character. (Amazon permits it.) Also, you'll ocassionally find a customer ser…

Panix.com supports this, plus an alternate that works almost everywhere. You can use "whatever@yourname.users.panix.com", and it ends up in your inbox, filterable by the "To:" address. I create a new email address for every company I sign up with.

(Satisfied Panix customer.)

Post reply on HN