Amazon's customer service backdoor
medium.com
Amazon's customer service backdoor
1–10 of 366 posts
Re: Amazon's customer service backdoor
#2Someone hacked my Amazon account once. I'm surprised they don't have 2-step verification.
Re: Amazon's customer service backdoor
#3I read this as a guy who has serious amnesia.
Re: Amazon's customer service backdoor
#4Someone hacked my Amazon account once. I'm surprised they don't have 2-step verification.
On the other hand, 2FA opens up the "I lost my phone" customer support channel which might be just as weak.
For example, you can turn on 2FA for sending money via Bank of America's webpanel. As in, you log in with username/password and need 2FA for some restricted actions.
Well, phone up customer support and they'll remove your 2FA if you can provide them some secret details... all of which are displayed on the webpanel to anyone that was already able to log in.
It's a joke.
Re: Amazon's customer service backdoor
#5Someone hacked my Amazon account once. I'm surprised they don't have 2-step verification.
Re: Amazon's customer service backdoor
#6Someone hacked my Amazon account once. I'm surprised they don't have 2-step verification.
2FA is useful if someone knows your password (e.g. you re-use it, and it gets leaked) but it's not useful in this case. I have 2FA setup on my accounts, and when ever contacting customer support I've never had to prove I own the device.
Re: Amazon's customer service backdoor
#7Any recommendation what one (as a customer of Amazon) can do today ?
2FA does not help here as someone goes through support channel which looks like bypasses 2FA
Also concerned if the same trick can be applied to Amazon Cloud services, as there one can also run up a big bill pretty quickly.
Re: Amazon's customer service backdoor
#8Any recommendation what one (as a customer of Amazon) can do today ? 2FA does not help here as someone goes through support channel which looks like bypasses 2FA Also concerned if the same trick can be applied to Amazon Cloud services, as there one can also run up a big bill pretty quickly.
I honestly have no idea. I think the only protection at the moment seems to be obscurity, use an email address that is not linked to you.
Re: Amazon's customer service backdoor
#9Someone hacked my Amazon account once. I'm surprised they don't have 2-step verification.
On the other hand, 2FA opens up the "I lost my phone" customer support channel which might be just as weak. For example, you can turn on 2FA for sending money via Bank of America's webpanel. As in, you log in with username/password and need 2FA for some restricted actions. Well, phone up customer support and they'll remove your 2FA if you can provide them some secret details... all of which are displayed on the webpa…
If they were following a script and the script were careful, saying "I lost my phone" would cause them to try to contact your phone, and when you answered and said you still had it, would put a fraud alert on the account and stop all further attempts to social engineer customer service.
But most companies aren't anywhere near that careful.
Re: Amazon's customer service backdoor
#10Earlier quoted context omitted.
On the other hand, 2FA opens up the "I lost my phone" customer support channel which might be just as weak. For example, you can turn on 2FA for sending money via Bank of America's webpanel. As in, you log in with username/password and need 2FA for some restricted actions. Well, phone up customer support and they'll remove your 2FA if you can provide them some secret details... all of which are displayed on the webpa…
If they were following a script and the script were careful, saying "I lost my phone" would cause them to try to contact your phone, and when you answered and said you still had it, would put a fraud alert on the account and stop all further attempts to social engineer customer service. But most companies aren't anywhere near that careful.
Many people (including me) don't answer from unknown numbers, so that wouldn't work.