Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon's customer service backdoor

medium.com

Post reply on HN
Print view View original

61–70 of 366 posts

Re: Amazon's customer service backdoor

#61

Post by josso »

notyourwork wrote: post #55
danneu wrote: post #17

Whois is great for social engineering attackers. You get a name, email, address, and the first service to attack. Meanwhile, the ICANN is working around the clock to make it illegal for us to protect our personal information, and whois protection is becoming an increasingly niche service for registrars. For example, gandi.net (and thus Amazon) doesn't hide your name when you have it turned on. By the time you find th…

> For example, gandi.net (and thus Amazon) Why do you say here and thus Amazon?

I assume it's because AWS uses Gandi as their registrar.[1]

[1]: https://news.ycombinator.com/item?id=8116506

Re: Amazon's customer service backdoor

#62

Post by gist »

DINKDINK wrote: post #53
danneu wrote: post #17

Whois is great for social engineering attackers. You get a name, email, address, and the first service to attack. Meanwhile, the ICANN is working around the clock to make it illegal for us to protect our personal information, and whois protection is becoming an increasingly niche service for registrars. For example, gandi.net (and thus Amazon) doesn't hide your name when you have it turned on. By the time you find th…

> By the time you find this out, it might occur to you to just type in a different name, but now you're violating ICANN policy. Why not just "sell"/transfer ownership of your domain to another entity (one that you own)?

What you need is the following (and no more):

a) A valid email address. (A gmail that forwards to your real email will do).

b) A valid postal address. By valid I mean "in the proper form".

As such the following would get flagged:

1 Main St. Anytown USA 10016

(because it doesn't exist..)

545 Jones St. New York NY 10016

(let's say that's a post office..)

is fine.

Re: Amazon's customer service backdoor

#63

Post by asymptotic »

UnoriginalGuy wrote: post #19
ronyeh wrote: post #18

On your Amazon home page, go to: Your Account › Change Account Settings › Advanced Security Settings Turn on 2-step Verification. It won't completely solve social engineering, but it can't hurt.

If you had read the article you would know that they already had 2F turned on before the first intrusion and throughout the subsequent intrusions.

I might be being pedantic, but the only mention of 2FA in the OP is:

"As a security conscious user who follows the best practices like: using unique passwords, 2FA, only using a secure computer and being able to spot phishing attacks from a mile away, I would have thought my accounts and details would be be pretty safe? Wrong."

Are you sure the author enabled 2FA on his Amazon retail account, or was it only enabled on his AWS account? The two systems do not share the same 2FA.

FYI I enabled 2FA on my Amazon retail account and when I called customer support they verified it. Once the verification failed and they refused to give me support.

Anyone else confirm a similar story with 2FA and support? Anyone willing to explicitly test this out?

Re: Amazon's customer service backdoor

#64

Post by jimrandomh »

zyxley wrote: post #32
jimrandomh wrote: post #14

Earlier quoted context omitted.

I would prefer that my bank, if it detects fraudsters trying to pull some sort of trick involving my account, to freeze things until I show up and present ID. That's inconvenient, but clearly better than the alternative.

So... what about banks with no actual physical branches?

In an ideal world, the bank would direct you to a notary public who would check your identity and public key fingerprint. (Sadly, the present state of things is probably too dysfunctional to manage that.)

Re: Amazon's customer service backdoor

#65

Post by School-Cotton »

mrb wrote: post #52

How to stop this: 1. Get a friend's permission to "hack" into his Amazon account (or "hack your own account"). 2. Contact Amazon's customer service, try the same social engineering techniques that the OP documented. 3. Once you obtain some sensitive information from the account, scare the CS rep by saying: "Haha! I am actually not the customer. I am a journalist/hacker/whatever and wanted to see how easy it was to so…

So, commit criminal fraud to prove a point?

Bad idea.

Re: Amazon's customer service backdoor

#66

Post by bigiain »

thephyber wrote: post #49
VeilEm wrote: post #28

Earlier quoted context omitted.

If someone has your public name and address you're already at significant risk if you ever say anything controversial that gets attention. You're liable to being swatted, getting fake pizza orders, having people show up at your house, harassing you and much more. See Zoe Quinn, Brian Krebs, lots of less well known individuals, etc.

Which only proves your comment's parent's point even more. {SWAT, pizza orders, etc} assume that the phone number that shows up on caller ID is authentication of the identity of the phone line on the other end. They could call back the number on caller ID to verify the original caller matched the person who picked up, but they don't. Having knowledge of a Social Security number was assumed to be authentication, but i…

Keep in mind too that Caller ID is trivially blockable (and blocked caller id isn't remarkable enough to be super suspicious), and it's also easily within the capability of many of the 4chan/gg griefers to spoof "correct" Caller ID numbers as well.

Re: Amazon's customer service backdoor

#67

Post by bigiain »

jakobegger wrote: post #57
JoshTriplett wrote: post #39

Earlier quoted context omitted.

Note, though, that catch-all emails will also catch a ridiculous amount of spam. Creating each account name individually avoids that problem, at the cost of some extra trouble when registering a new service. An intermediate step that may work if you don't expect people to target you individually: have one or more required substrings for the email local part, and catch all mail to addresses containing that substring.

I receive all mails @ my domain and I get about 1 spam a day. Fastmail's spam filters are pretty good.

Do you have a good idea of the rate of false positives?

Re: Amazon's customer service backdoor

#68

Post by pyre »

JoshTriplett wrote: post #38
bigiain wrote: post #29

Earlier quoted context omitted.

While that's true, and perhaps even needs to be "the default", there really needs to be a way to say "Hey, I'm concerned, and am prepared to take responsibility for my own access credentials. I demand you categorically _do not_ disclose any of my personal information to anyone without a warrant or court order." And for that sort of demand to have appropriate legal teeth to ensure people collecting that data are suffi…

Unfortunately, far more people think they want that than can take full personal responsibility for it. See also: people who don't understand that full-disk encryption means they lose their data if they forget their passphrase. That doesn't make full-disk encryption in any way bad, but if you train people to think that all accounts have a "forgotten password" option, they might get a nasty surprise.

While ago I setup FDE on a new drive, put the passphrase in my encrypted password file, put the new copy of the password file on the encrypted drive, and then proceeded to wipe machine that had the only other copy of that password file (well at least the up-to-date version with that passphrase). A nasty surprise indeed. Thankfully I only lost a month's worth of files (mostly photos).

Re: Amazon's customer service backdoor

#69

Post by q3k »

School-Cotton wrote: post #65
mrb wrote: post #52

How to stop this: 1. Get a friend's permission to "hack" into his Amazon account (or "hack your own account"). 2. Contact Amazon's customer service, try the same social engineering techniques that the OP documented. 3. Once you obtain some sensitive information from the account, scare the CS rep by saying: "Haha! I am actually not the customer. I am a journalist/hacker/whatever and wanted to see how easy it was to so…

So, commit criminal fraud to prove a point? Bad idea.

If there is written, explicit permission to perform this attack, how is it different from a corporate penetration test?

Re: Amazon's customer service backdoor

#70

Post by plink »

turar wrote: post #37

If you own a home in the U.S., anybody already can get your address legally and easily from your county or district property appraiser's/assessor's website. Along with how much you paid for it, and when you bought it. So calling Amazon CS rep is a hard way to go about it. :)

If you are the officer of a company you own in the U.S., anybody can get your address from the annual corp. report.
Post reply on HN