Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon's customer service backdoor

medium.com

Post reply on HN
Print view View original

341–350 of 366 posts

Re: Amazon's customer service backdoor

#341

Post by micro-ram »

putlake wrote: post #153
anindyabd wrote: post #126

The OP says he is "a security conscious user who follows the best practices like: using unique passwords, 2FA, only using a secure computer and being able to spot phishing attacks from a mile away..." yet I do not think he enabled 2FA on Amazon.com. If he did customer service would not have helped the hacker pretending to be him. As their help page says, "If you need help from Customer Service after enabling Two-Step…

I was excited about Amazon enabling 2FA. I started using it rightaway but it doesn't work with their extended applications. e.g. signing in on Roku, Amazon photos uploader app for Mac, Amazon video on Android/iOS.

Amazon should simply treat users with active 2FA accounts as high security accounts. High security accounts must go through a much more rigorous validation when speaking with support.

Re: Amazon's customer service backdoor

#342

Post by ptha »

robhawkes wrote: post #244
ronyeh wrote: post #18

On your Amazon home page, go to: Your Account › Change Account Settings › Advanced Security Settings Turn on 2-step Verification. It won't completely solve social engineering, but it can't hurt.

There's currently no 2FA for Amazon.co.uk and (I assume), other non-.com Amazon domains :(

If you login to amazon.com and enable 2FA, then when you login to amazon.co.uk (same username etc.) it will ask you for the 2FA code. It seems if you have an account for one Amazon domain you can login to all with the same credentials.

Re: Amazon's customer service backdoor

#343

Post by whitehat_data »

bigiain wrote: post #36
bigiain wrote: post #29

Earlier quoted context omitted.

While that's true, and perhaps even needs to be "the default", there really needs to be a way to say "Hey, I'm concerned, and am prepared to take responsibility for my own access credentials. I demand you categorically _do not_ disclose any of my personal information to anyone without a warrant or court order." And for that sort of demand to have appropriate legal teeth to ensure people collecting that data are suffi…

Startup idea: Whitehat Social Engineering (as a service). You authorise a whitehat team to attempt to social engineer all your discoverable internet presence/accounts to see what personal information their systems and/or customer service will disclose based on existing publicly available data. (I suspect legally that'd at least be on the white-ish side of grey rather than blackhat...) I wonder how long it'll be befor…

There are companies already doing this.

Re: Amazon's customer service backdoor

#344

Post by WorldMaker »

bigger_cheese wrote: post #109
stestagg wrote: post #22

Earlier quoted context omitted.

It wouldn't work /for you/. But for people who do answer their phone, it would add protection.

Possibly but you'd want to be damn sure it was actually the bank calling you. What's to stop a scammer claiming to be from the bank calling you. "Hi I'm from bank xxxx calling to warn about some potentially fraudulent transactions we've detected on your credit card before we can continue please answer a few security questions to verify your identity." I suspect some people would fall for that and tell the 'bank' thei…

I've yelled at most of my banks for cold calling me exactly like that. My response is, "Can this be corrected online? Otherwise, I will call the 800 number myself and if you could provide any specifics that might speed up that next call I would appreciate."

In the past I've also sent letters to bank security teams not to cold call and ask for personal details.

One of my banks actually switched to a standard recorded message that ends in a "Please call our 1-800 number at your earliest convenience." Better.

Re: Amazon's customer service backdoor

#345

Post by vanzard »

pjc50 wrote: post #286
mrb wrote: post #52

How to stop this: 1. Get a friend's permission to "hack" into his Amazon account (or "hack your own account"). 2. Contact Amazon's customer service, try the same social engineering techniques that the OP documented. 3. Once you obtain some sensitive information from the account, scare the CS rep by saying: "Haha! I am actually not the customer. I am a journalist/hacker/whatever and wanted to see how easy it was to so…

4. Get arrested

Given Amazon's history to NEVER involve law enforcement in outrageous cases like https://news.ycombinator.com/item?id=10966164 or even the OP, I doubt you would get arrested.

Re: Amazon's customer service backdoor

#346

Post by tamar »

romanhn wrote: post #338
tamar wrote: post #292

Earlier quoted context omitted.

Hey romanhn - did you contact support and try to make it right by reversing the chargeback? This isn't about blackmail as jewsin writes in the comments, it's about the reputation a business suffers with a chargeback. All you would need to do is reverse the chargeback and the full charge would go away. Disclosure: I work for Namecheap.

Hi tamar - thanks for reaching out! I was in contact with multiple members of the support team throughout this ordeal. Supposedly they consulted with senior management as well. Business reputation was never mentioned - it was always about paying a fee to the payment processor. At no point was chargeback reversal brought up. To be perfectly honest, I know nothing about chargebacks (this wasn't something I initiated, i…

Hey romanhn - so sorry for this. Can you share your ticket number? I think there was a definite mistake in the process here as that should have been broached and if it requires some updated training for the billing team, I'll put in my recommendation for that.

I'm sorry as well for the parking page situation - my guess is it didn't immediately propagate, but I'd have to investigate further as to why that happened. Usually, it's not about redirecting traffic but just not letting you get into your account. This does not sound like it should have happened at all. I sincerely apologize that this is what you encountered.

p.s. I love how trying to genuinely be helpful has resulted in an onslaught of downvotes. I'm going to assume you helped balance that out with an upvote. So thanks :)

Re: Amazon's customer service backdoor

#347

Post by 0xffff2 »

fnbr wrote: post #114
mrb wrote: post #52

How to stop this: 1. Get a friend's permission to "hack" into his Amazon account (or "hack your own account"). 2. Contact Amazon's customer service, try the same social engineering techniques that the OP documented. 3. Once you obtain some sensitive information from the account, scare the CS rep by saying: "Haha! I am actually not the customer. I am a journalist/hacker/whatever and wanted to see how easy it was to so…

Please don't do this. You're much more likely to get your friend in trouble with Amazon and have the police called on you.

Have the police called on you for what, exactly?

Re: Amazon's customer service backdoor

#348

Post by 0xffff2 »

AndrewUnmuted wrote: post #325

I worked for Amazon for four years. For nearly the entire time I worked there, I, as an engineer, had access to every customer's purchase history, contact information, email addresses, etc. The reason? On occasion, I'd need to get a user's email address to reach out to them if they reported bugs. The one service that offers employees this access is all or nothing. Either you get to see a customer's email, credit card…

>Perhaps I'm just clueless, but something tells me that any relevant competitor to Amazon - say, I don't know, Google - would choose to fix the service instead.

Why? The attitude you describe (do what's easy, not what's right) is endemic to any organization over a certain size in my experience.

Re: Amazon's customer service backdoor

#349

Post by rasz_pl »

Lawtonfogle wrote: post #321
lucaspiller wrote: post #231

Earlier quoted context omitted.

In the UK this and a lot more is public information. As an example of what is available about me online (without paying a penny) just by searching for my name: - The year I was born - The district I was born (not the exact town, although that wouldn't be hard to guess) - My mother's maiden name (which is what most banks et al ask as a security question...) - The areas I've lived (based upon the electoral register, wh…

>TL;DR; If you rely on this to 'identify' someone, you are doing it wrong. Which is why the system is set up so that if I go to the bank with this information and take money as you, I have stolen your identity and thus you are the victim and are responsible for the losses unless you fight back. Identity theft was created so financial institutions could be lax with their verification process thanks to the blame being…

>In reality, identify theft doesn't exist. In my example I stole from the bank

you wish https://www.youtube.com/watch?v=CS9ptA3Ya9E

Re: Amazon's customer service backdoor

#350

Post by romanhn »

tamar wrote: post #346
romanhn wrote: post #338

Earlier quoted context omitted.

Hi tamar - thanks for reaching out! I was in contact with multiple members of the support team throughout this ordeal. Supposedly they consulted with senior management as well. Business reputation was never mentioned - it was always about paying a fee to the payment processor. At no point was chargeback reversal brought up. To be perfectly honest, I know nothing about chargebacks (this wasn't something I initiated, i…

Hey romanhn - so sorry for this. Can you share your ticket number? I think there was a definite mistake in the process here as that should have been broached and if it requires some updated training for the billing team, I'll put in my recommendation for that. I'm sorry as well for the parking page situation - my guess is it didn't immediately propagate, but I'd have to investigate further as to why that happened. Us…

I did upvote, don't think the downvotes are deserved.

Sent my ticket number via the contact form on the website from your profile. I see that you spearheaded the SOPA membership surge - it's what got me to join in the first place.

Post reply on HN