Slashdot Mirror
Amazon's Customer Service Backdoor (medium.com)
An anonymous reader writes: Eric Springer describes his recent troubles with Amazon to highlight one of the biggest weak points in information security: customer service. You can use complex passwords and two-factor authentication all you want — all it takes is a low-level representative trying to be helpful and your account information is now compromised. In this case, a bad actor was able to use Amazon's online chat support and a fake address to get the rep to tell him Springer's real address and phone number. That was enough to commit fraud with a couple of unrelated online services. Springer complained, but months later the same thing happened again. That time, he had Amazon put a note on his account not to give out his details.
But that didn't help; the attacker contacted Amazon's phone support line instead, and gathered yet more information. Springer writes, "At this point, Amazon has completely betrayed my trust three times. I have done absolutely everything in my power to secure my account, but it's hopeless. I am in the process of closing my Amazon account, and migrating as much to Google services which seem significantly more robust at stopping these attacks." Springer's advice for fixing this: "Never do customer support unless the user can log in to their account. The only exception to this would be if the user forgot the password, and there should be a very strict policy." He also says email services should make aliases easier, and whois protection should be default.
But that didn't help; the attacker contacted Amazon's phone support line instead, and gathered yet more information. Springer writes, "At this point, Amazon has completely betrayed my trust three times. I have done absolutely everything in my power to secure my account, but it's hopeless. I am in the process of closing my Amazon account, and migrating as much to Google services which seem significantly more robust at stopping these attacks." Springer's advice for fixing this: "Never do customer support unless the user can log in to their account. The only exception to this would be if the user forgot the password, and there should be a very strict policy." He also says email services should make aliases easier, and whois protection should be default.
He thinks Google is more secure ... ?
Puteulanus fenestra mortis
While amazon screwed up here and enabled a social engineering attack:
Google services which seem significantly more robust at stopping these attacks
What is the evidence that he has to support this assertion? In his time at amazon, it seemed one party after some period of time started harassing amazon. Does he know that Google is more robust, or just that no one has gotten around to harassing him?
Assuming google is more robust, is it because they are 'just plain better' or because Amazon is so retail-heavy that it's much more difficult for them to block such attacks without royally pissing off their bread and butter retail customers?
It does surprise me that the support without logging in can do *anything* except help them reset their password. Resetting the password is more intrusive, though even this got notification sent to the legitimate account holder, so it wasn't a stealthy attack to begin with.
XML is like violence. If it doesn't solve the problem, use more.
Banking websites require 1 capital, 1 symbol, and 1 number in the password, doesn't allow you to use the back button and logs you out after 5 minutes but then allows you to reset your password by knowing your pet's name, your birthday, or some other ridiculously easy to find information. Yes, the password is usually sent to an email address but that email address doesn't have any of the same security, a person is always logged in, and usually has similar easy to crack password resets. Oh, and let's not forget that they won't actually allow you to opt out of the password reset or set it to something reasonable (like maybe most recent deposit combined with text message combined with a letter they mail out combined with credit card number)
In the USA they recently rolled out "Chip and Pin" technology for credit cards but decided that "Chip and Pin" was too inconvenient so instead just made it "Chip" so that when/if they ever implement "Chip and Pin" they will have to retrain everyone a second time (aka won't happen anytime soon) It's not like people weren't already familiar with pins with debit cards. It would have been trivial to just add the pins on in one go.
As long as we continue to operate on the premise that convenience is more important than security we are going to continue to have security problems.
Back when Amazon.com had been in business for a few years I called their tech support to recover my password.
They read the password to me over the phone. That means passwords at that time were not stored as a hash but as clear text in their database.
Do not look at laser with remaining good eye.
The context of the conversation is customer service for people who already have accounts that can be exploited via the social engineering of said customer service.
In this case, a bad actor was able to use Amazon's online chat support and a fake address to get the rep to tell him Springer's real address and phone number.
Shatner must be stopped.
systemd is Roko's Basilisk.
Why would an IT professional use the same credentials for his AWS account as he does with his Amazon retail account? Just use a different email address for the AWS account (and not the email address that you've published on your business card, WHOIS, LinkedIn, etc). Either use a second email account just for AWS (they are free, you know?), or use an alias (i.e a gmail username+somespecialalias@gmail.com address)
He likely uses is Amazon credentials in several different browsers, the Amazon App, Kindle App, perhaps an Amazon instant video viewer on his TV, an Amazon Kindle device, etc. He's trusting a lot of different consumer apps and devices to keep a secret that could affect his livelihood. Not to mention the problem he's complaining about -- customer service for a retail company that wants to make sure he gets his packages.
Really? I have never felt scared in a Wal-mart parking lot. I don't even hear about much crime there either, they have cameras everywhere in their lots.
Be afraid. Be very afraid.
Faster! Faster! Faster would be better!
Christmas before last I was the lovely new recipient of a brand new amazon account, that I didn't signup for. The problem starts with Amazon not validating email ownership and ends with Amazon not understanding how account ownership works. Some child with my same name was given a brand spanking new Fire HD for Christmas and a pile of Amazon gift certificates which they loaded up in short order, the mistake was made they maybe typoed their email address or they them self didn't understand that you don't inherently own yourname@emailprovider.com
I tried to contact Amazon support and have them fix this problem with out ruining this kids Christmas. Amazon's response? No problem here with their processes, however I should give him my email address as far as they are concerned he owns my gmail account I've had since the closed gmail beta... After much arguing Amazon wasn't budging, I had already explained that gmail ignores dots in your address among other things, so u.ser@gmail.com u.s.e.r@gmail.com us.er@gmail.com, and user@gmail.com etc all are the same account but amazon will register individual accounts for them, my problem is I use a . in mine just for readability and spam identification and is how I have *MY* amazon account registered. Additional fun is anything after a + sign in your email gets ignored too, so you can use an email like user+is.the.CEO.of@gmail.com and it'll just send any email to that to user@gmail.com, maybe I could have used this and told them that this is not a gmail problem and they should fix it? This behavior on google's part is in my opinion: fantastic, it's an epic step on account security meaning someone else can't come along and pretend to be me just by adding or removing a dot from their email address. Blaming Google in this case was a weak attempt at avoiding responsibility.
Long story short, Amazon didn't care that I could reset this kids password and buy whatever it is I wanted using it, as far as they were concerned this wasn't their problem. Here's amazon's official response I got before I escalated it to Jeff Bezos and spoke to the executive of customer relations (this is a thing by the way, anyone can do this)
"Unfortunately, this is an issue that will need to be resolved by Google. We would normally be able to temporarily disable your account in order to sort out the email issues, as these issues can be caused by typos on another person's side. However, as this is not an email typo issue, we will not be able to resolve this issue ourselves. Samantha L"
I would really like to know beyond handing over my account, what they think Google is going to do about it?
the summary is confusing. unless he only has an amazon account for Amazon's cloud computing platform, what would be the point of migrating to Google? And google is only 'more robust' because they make it EXTREMELY hard to actually contact a live person.
Sleep your way to a whiter smile...date a dentist!