Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon's customer service backdoor

medium.com

Post reply on HN
Print view View original

241–250 of 366 posts

Re: Amazon's customer service backdoor

#241

Post by arianvanp »

PhantomGremlin wrote: post #123
ubersync wrote: post #73

If anyone wants to start a fund to sue Amazon for this, I am ready to pitch in a $100.

That's probably wishful thinking. I haven't checked Amazon's terms of service, but nowadays you can count on both of these being true: - you agreed to arbitration - you agreed to disallow class action lawsuits I.e. thanks to the Supremes[1]: As a result, businesses that include arbitration agreements with class action waivers can require consumers to bring claims only in individual arbitrations, rather than in court…

I'm pretty sure those kind of terms, at least in The Netherlands and most of Europe, are illegal. So lets Class-action them in Europe instead? I'll pitch in 100 euros.

Re: Amazon's customer service backdoor

#242

Post by akerro »

danneu wrote: post #17

Whois is great for social engineering attackers. You get a name, email, address, and the first service to attack. Meanwhile, the ICANN is working around the clock to make it illegal for us to protect our personal information, and whois protection is becoming an increasingly niche service for registrars. For example, gandi.net (and thus Amazon) doesn't hide your name when you have it turned on. By the time you find th…

I use https://ititch.com/ for over a year now. You can pay with bitcoin, they don't make much validation around whois input values. I use it for my domain registration and whois protection, they support IPv4 and IPv6 which in my country are not supported by biggest companies like 1and1. Customer support answers in less than 30hours.

Re: Amazon's customer service backdoor

#243

Post by andrewaylett »

iopq wrote: post #185
mangeletti wrote: post #172

Earlier quoted context omitted.

Hiding your contact information is like security through obscurity. I'm not saying it's not a good extra step to decrease the frequency of attacks (much like changing an SSH port to 3857 or something), but it doesn't add any real security. This is the crux of the problem; our addressees and birthdays are treated like passwords by these companies.

Passwords are also security by obscurity.

Not really -- security by obscurity is a re-statement of the idea that the security mechanism shouldn't need to be secret for the security to have meaning. You're allowed to have secret data, just not secret mechanism.

And relying on what looks like secret data (changing the SSH port) where the number of bits of entropy is low enough that it's plausible to try them all (16) probably still counts as security by obscurity -- it might hide you from many attackers, but it's not enough to make you secure.

Relying on data that's not actually secret, just hard to find, is just insecure.

Re: Amazon's customer service backdoor

#244

Post by robhawkes »

ronyeh wrote: post #18

On your Amazon home page, go to: Your Account › Change Account Settings › Advanced Security Settings Turn on 2-step Verification. It won't completely solve social engineering, but it can't hurt.

There's currently no 2FA for Amazon.co.uk and (I assume), other non-.com Amazon domains :(

Re: Amazon's customer service backdoor

#245

Post by imron »

scoot wrote: post #72
TheOtherHobbes wrote: post #30

Earlier quoted context omitted.

A related word of warning: Namecheap updated their registration page last year. Now, when you register a domain it tells you free Whoisguard is included, but it doesn't make it clear that it's disabled by default." Previously it just worked. Now you have to check another box to turn it on. This change makes no sense to me. (If you want free Whoisguard, why would you not want it turned on?) I was white-hot furious* wh…

Worse, they'll happily sell you Whoisguard for domains that don't support it. When you discover it's not usable, they'll give you a refund, then include it again in the next billing cycle. I switched to Namecheap based on recommendations here, and their previous stance on certain privacy issues, but I'm running out of alternatives.

Namesilo works well for me, and they have free whois privacy.

Re: Amazon's customer service backdoor

#246

Post by alpb »

mrb wrote: post #52

How to stop this: 1. Get a friend's permission to "hack" into his Amazon account (or "hack your own account"). 2. Contact Amazon's customer service, try the same social engineering techniques that the OP documented. 3. Once you obtain some sensitive information from the account, scare the CS rep by saying: "Haha! I am actually not the customer. I am a journalist/hacker/whatever and wanted to see how easy it was to so…

> Hopefully if enough people do this, it will get some internal attention at Amazon.

This is very smart, why has no one thought of this before? When people post it on Medium and share it on HN/Reddit it will not get enough internal attention at Amazon for sure. So let's do something totally stupid which could easily get us in trouble with the law enforcement to make a shitty point to Amazon so that they can notice something is wrong on their end.

Re: Amazon's customer service backdoor

#247

Post by zifnab06 »

SXX wrote: post #227
andrepd wrote: post #197

Earlier quoted context omitted.

Ssh ports are brute forceable, passwords have a much much larger search space.

Changed SSH port is not security measure. It's needed to keep your log files clear from random network scanning. When your SSH port is something like 53148 and you see password brute-force activity in logs it's almost always mean that somebody intentionally scanning your server.

Just a note: if you do change it, keep it below 1024. Otherwise if ssh dies anyone on the server can create a client listening on that port and steal credentials.

Re: Amazon's customer service backdoor

#248

Post by akerro »

fps wrote: post #20
danneu wrote: post #17

Whois is great for social engineering attackers. You get a name, email, address, and the first service to attack. Meanwhile, the ICANN is working around the clock to make it illegal for us to protect our personal information, and whois protection is becoming an increasingly niche service for registrars. For example, gandi.net (and thus Amazon) doesn't hide your name when you have it turned on. By the time you find th…

I think the bigger problem is that public information like your name and address is sufficient for proving your identity. If we make whois information private, what about phone books, property records, direct mail databases, etc. etc.

https://news.ycombinator.com/item?id=7525198

His daughter was also attacked...

Re: Amazon's customer service backdoor

#249

Post by m0nty »

ajmurmann wrote: post #84
sombremesa wrote: post #58

Earlier quoted context omitted.

I fear that customer support might still accept emails without the suffix from the "customer". These are people, not robots, so if the address is close or in the vicinity of being correct, they might accept it. Same goes for the dot characters allowed in gmail addresses.

I strongly second this concern. I generate random strings as answers to my recovery questions. When I recently got asked one of the questions the support rep let out a sigh when asking (presumably because he saw the "crazy" answer) and then said "yeah yeah, alright" when I was about half way through the answer. That any company even suggests these insane security questions that anyone can trivially research is comple…

> I generate random strings as answers to my recovery questions.

What's your favourite football team? -> Genghis Khan 2nd XI What was your first school called? -> Little Horrors School for Hackers

etc. Easier to say, you won't lose the customer service rep's attention either :)

Re: Amazon's customer service backdoor

#250

Post by rogeryu »

We had our AWS account hijacked three years ago. Someone had taken over our admin email by hijacking the DNS. They had hacked into our DNS account (with another provider) and changed the MX for our domain. Then they contacted customer support and convinced them to disable two factor authentication. Then they started to play with our account, starting and stopping servers.

Taking back the DNS took time. Meanwhile the hijackers were logged in, and could not be logged out by Amazon. This took more than a day. It took us two full days to get all back to normal.

The good thing is that they could not login to our servers. What they wanted is still not clear, and who did this - we saw some suspicious traffic from Russia, but that's all.

Post reply on HN