22 ms·

Amazon's customer service backdoor

1447 points by grapehut 11y ago

free2rhyme214 11y ago
Someone hacked my Amazon account once. I'm surprised they don't have 2-step verification.
- danneu 11y ago
  On the other hand, 2FA opens up the "I lost my phone" customer support channel which might be just as weak. For example, you can turn on 2FA for sending money via Bank of America's webpanel. As in, you log in with username/password and need 2FA for some restricted actions. Well, phone up customer support and they'll remove your 2FA if you can provide them some secret details... all of which are displayed on the webpanel to anyone that was already able to log in. It's a joke.
  - jimrandomh 11y ago
    If they were following a script and the script were careful, saying "I lost my phone" would cause them to try to contact your phone, and when you answered and said you still had it, would put a fraud alert on the account and stop all further attempts to social engineer customer service. But most companies aren't anywhere near that careful.
    - hueving 11y ago
      Many people (including me) don't answer from unknown numbers, so that wouldn't work.
      - stestagg 11y ago
        It wouldn't work /for you/. But for people who do answer their phone, it would add protection.
        bigger_cheese 11y ago
        Possibly but you'd want to be damn sure it was actually the bank calling you. What's to stop a scammer claiming to be from the bank calling you. "Hi I'm from bank xxxx calling to warn about some potentially fraudulent transactions we've detected on your credit card before we can continue please answer a few security questions to verify your identity." I suspect some people would fall for that and tell the 'bank' their personal details.
        WorldMaker 11y ago
        I've yelled at most of my banks for cold calling me exactly like that. My response is, "Can this be corrected online? Otherwise, I will call the 800 number myself and if you could provide any specifics that might speed up that next call I would appreciate." In the past I've also sent letters to bank security teams not to cold call and ask for personal details. One of my banks actually switched to a standard recorded message that ends in a "Please call our 1-800 number at your earliest convenience." Better.
      - tomschlick 11y ago
        A text message / email might though. Just saying "Your account has been flagged for a lost/stolen phone which you use as your 2FA. Please contact support if this is not correct."
        deleted 11y ago
        [deleted]
    - mcintyre1994 11y ago
      Wouldn't that allow somebody who stole your phone to lock you out of your bank if they answered the call? Seems like that'd make a stressful situation potentially worse if thieves knew they could do that. Especially if they called from a number that's linked to the bank anywhere and something like Google's dialer surfaces who it is - your bank calling seems like a potential "maybe I can get more" for a thief so they might be inclined to answer and impersonate.
      - deleted 11y ago
        [deleted]
      - jimrandomh 11y ago
        I would prefer that my bank, if it detects fraudsters trying to pull some sort of trick involving my account, to freeze things until I show up and present ID. That's inconvenient, but clearly better than the alternative.
        zyxley 11y ago
        So... what about banks with no actual physical branches?
        jimrandomh 11y ago
        In an ideal world, the bank would direct you to a notary public who would check your identity and public key fingerprint. (Sadly, the present state of things is probably too dysfunctional to manage that.)
        hibikir 11y ago
        Banks would never do that, if just because they'd risk losing business in places where there's no local branches. Many of the national banks that offer the best conditions have no presence in a lot of metro areas. And even if you make sure your bank has a local branches (which really, I've not gone to one in years, why would I need one?), what happens when you are on a trip, and your accounts are frozen? I've had my CCs frozen because the bank considered my expenses during a trip to be potentially fraudulent, but I could clear it up over the phone. Do we have to devolve back to carrying thousands in cash, like in the old days? Security is always a tradeoff between avoiding fraud and being usable, and the tradeoffs that are great for some people in some situations are unacceptable for others.
    - ryanlol 11y ago
      Just DoS the phone then?
  - JoshTriplett 11y ago
    > On the other hand, 2FA opens up the "I lost my phone" customer support channel which might be just as weak. "I lost my phone" (or "my phone stopped working") does need some solution, though. The right way to handle "I lost my phone" seems like one of two possibilities: either come into a branch and provide legal identification matching what you used to open the account (and get "yourself" on camera doing so), or have a token mailed to your physical address on file (which you cannot change at the same time as a lost phone claim).
    - baby 11y ago
      > have a token mailed to your physical address on file This is the worst for the customer point of view. Takes a long time.
      - kuschku 11y ago
        It on average 24h or less, considering that mail through DHL is next-morning delivery everywhere, and same-day delivery in larger cities.
        SignMeTheHELLUp 11y ago
        This may come as a shock to you but some people live outside the United States.
        kuschku 11y ago
        I’m in Germany, actually.
    - Latty 11y ago
      Shout out here to NearlyFreeSpeech who do this right. They give you a set of verification actions: You provide a scanned copy of a government-issued photo ID. You provide a scanned copy of a statement showing both the most recent deposit and a name and address matching one of your accounts. You complete SMS verification. (SMS must be previously configured.) You complete 2-factor verification. (2-factor auth must be previously configured.) You correctly answer your security question. (Security question and answer must be previously configured, below.) You use an ssh key to create a file with a specific name on one of your sites hosted here. (Must be previously configured, won’t work if account is empty.) We try and fail to contact you via your currently configured email address. (This one may take a long time.) You can then pick how many of these you want to require to get your account back (and which you want to configure), including an option not to help at all in the case you lose your account.
- tshtf 11y ago
  They do: http://www.theverge.com/2015/11/18/9753888/amazon-two-factor-authentication-2fa http://www.theverge.com/2015/11/18/9753888/amazon-two-factor...
- grapehut 11y ago
  2FA is useful if someone knows your password (e.g. you re-use it, and it gets leaked) but it's not useful in this case. I have 2FA setup on my accounts, and when ever contacting customer support I've never had to prove I own the device.
- deleted 11y ago
  [deleted]
muppetman 11y ago
I read this as a guy who has serious amnesia.
okigan 11y ago
Any recommendation what one (as a customer of Amazon) can do today ? 2FA does not help here as someone goes through support channel which looks like bypasses 2FA Also concerned if the same trick can be applied to Amazon Cloud services, as there one can also run up a big bill pretty quickly.
- grapehut 11y ago
  I honestly have no idea. I think the only protection at the moment seems to be obscurity, use an email address that is not linked to you.
- bigiain 11y ago
  If I were the OP or someone equally sure I was likely to be targeted via my Amazon account, I'd consider: Using a unique email address. Using a unique physical address (both for my account details and for my delivery addresses). Use a unique credit card (I'd probably get a refillable prepaid gift card, and set up some auto topup to ensure it's got my expected monthly Amazon bill available as "credit", but not much more). I'd probably move any AWS billing to a different Amazon account. If I were more paranoid (or being actively targeted), I'd probably also try to go unique on _everything_ I tell Amazon; phone numbers, different city/state/zipcode (as well as street address), company name, website url, alternate contacts - then I'd set up "Security questions" with unguessable questions/answers (perhaps diceware/xkcd style "correct horse battery staple" type ones, that a CS rep could easily read out and verify - rather than a base64 GUID...). Not that I trust the "security questions", but if Amazon lets you use freeform questions as well as answers, it might help to make your first security question "Have you noticed this account has two factor authentication turned on?" with an answer like "Yes, so Amazon Customer Service will take additional care when being asked to reveal account information, right?"
  - Your_Creator 11y ago
    It seems to me that ANYONE who buys ANYTHING is equally likely to be targeted via their Amazon account - Think about how many people actually use Amazon services Through sheer competition, Amazon is forcing Walmart to close over 100 stores. We only know that because Walmart is big enough to get noticed. Remember when Walmart was the company putting local mom and pop shops out of business? Cycle of life I suppose...
paulcole 11y ago
"The problem is, 9999 times out of 10000 support requests are legitimate, agents get trained to assume they’re legitimate. But in the 1 case they’re not, you can completely fuck someone over." That's why nothing will change if these estimates are even in the right universe. Nobody wants to inconvenience the vast majority of customers to prevent a minuscule number of issues.
- vacri 11y ago
  Came here to say just that. I did general customer support for a telco for a few months a while back, and most of the general public can't really deal with high security for personal information. If you were as strict with security as you should be, you'd be locking half of your subscribers out of their accounts eventually. This would create a phenomenal amount of follow-up paperwork for your company, meaning higher costs on your end and greater resentment on the customer's end - costs go up for you and customers head elsewhere. It's why banks still use laughably short and simple PIN codes.
  - bigiain 11y ago
    While that's true, and perhaps even needs to be "the default", there really needs to be a way to say "Hey, I'm concerned, and am prepared to take responsibility for my own access credentials. I demand you categorically _do not_ disclose any of my personal information to anyone without a warrant or court order." And for that sort of demand to have appropriate legal teeth to ensure people collecting that data are sufficiently motivated to act properly on it.
    - bigiain 11y ago
      Startup idea: Whitehat Social Engineering (as a service). You authorise a whitehat team to attempt to social engineer all your discoverable internet presence/accounts to see what personal information their systems and/or customer service will disclose based on existing publicly available data. (I suspect legally that'd at least be on the white-ish side of grey rather than blackhat...) I wonder how long it'll be before (or how long ago it became) sensible to register a shell company as the holder of any public record you're legally required to make public? It's probably much easier to roll your shell companies "registered address" if you discover it's been compromised than it is to move house every time Amazon's customer service goes "above and beyond" on your behalf to your attackers...
tommoor 11y ago
Damn, lucky they send out emails after a customer service interaction or you'd have never had any idea this even took place.
- grapehut 11y ago
  It makes me wonder, if the person is unsuccessful at authenticating, does the real owner get a follow up email? For instance, maybe he had to try 5 times to contact support before he found an agent who authenticated me using a fake address.
xenadu02 11y ago
The vast majority of services use email address to identify you so diversifying your email addresses helps a lot. I've known about every hack/info leak ahead of everyone else for that reason - I use a unique email for every service. I also use different cards for the major online retailers / tech giants so knowing the last four digits from my Amazon account is useless to validate anything else (though this does require having several credit cards or debit cards). Whois privacy is absolutely required. Unfortunately if someone is determined enough, almost all ISPs, cell companies, retailers, etc will happily give them control of your entire digital life. You can only minimize the risk somewhat.
danneu 11y ago
Whois is great for social engineering attackers. You get a name, email, address, and the first service to attack. Meanwhile, the ICANN is working around the clock to make it illegal for us to protect our personal information, and whois protection is becoming an increasingly niche service for registrars. For example, gandi.net (and thus Amazon) doesn't hide your name when you have it turned on. By the time you find this out, it might occur to you to just type in a different name, but now you're violating ICANN policy. And it's already been scraped by any of those whois history websites.
- fps 11y ago
  I think the bigger problem is that public information like your name and address is sufficient for proving your identity. If we make whois information private, what about phone books, property records, direct mail databases, etc. etc.
  - VeilEm 11y ago
    If someone has your public name and address you're already at significant risk if you ever say anything controversial that gets attention. You're liable to being swatted, getting fake pizza orders, having people show up at your house, harassing you and much more. See Zoe Quinn, Brian Krebs, lots of less well known individuals, etc.
    - thephyber 11y ago
      Which only proves your comment's parent's point even more. {SWAT, pizza orders, etc} assume that the phone number that shows up on caller ID is authentication of the identity of the phone line on the other end. They could call back the number on caller ID to verify the original caller matched the person who picked up, but they don't. Having knowledge of a Social Security number was assumed to be authentication, but it's increasingly obvious that such an authentication scheme is antiquated and was destined to fail from the beginning. When an identity thief can get a mortgage under my name with little more than credit bureau data on me, it costs only a little more than $15 to destroy my credit, my time, and my future because transactions don't have sufficient authentication. These awfully designed authentication schemes will only magnify the problems as more companies (especially credit bureaus and data marketers) pass around data on me and make it easier for someone to buy it on demand.
ronyeh 11y ago
On your Amazon home page, go to: Your Account › Change Account Settings › Advanced Security Settings Turn on 2-step Verification. It won't completely solve social engineering, but it can't hurt.
- UnoriginalGuy 11y ago
  If you had read the article you would know that they already had 2F turned on before the first intrusion and throughout the subsequent intrusions.
  - ronyeh 11y ago
    Sorry, I did skim it but must have missed it! :-} In any case, I will leave my comment so that folks who come across this thread have a handy reference for turning on 2FA on their Amazon accounts.
  - asymptotic 11y ago
    I might be being pedantic, but the only mention of 2FA in the OP is: "As a security conscious user who follows the best practices like: using unique passwords, 2FA, only using a secure computer and being able to spot phishing attacks from a mile away, I would have thought my accounts and details would be be pretty safe? Wrong." Are you sure the author enabled 2FA on his Amazon retail account, or was it only enabled on his AWS account? The two systems do not share the same 2FA. FYI I enabled 2FA on my Amazon retail account and when I called customer support they verified it. Once the verification failed and they refused to give me support. Anyone else confirm a similar story with 2FA and support? Anyone willing to explicitly test this out?
    - hayd 11y ago
      There's no reason to assume he wasn't using 2FA. The title says "backdoor" and that's the point: they didn't verify identity... they asked for name, email and a nearby address.
      - 11y ago
ikeboy 11y ago
>Email services should allow me to easily create lots of aliases I use blur from Abine.com, gives me a new email that forwards to my main, as many as I want, integrated with a browser plugin that barely adds time to signup.
nmjohn 11y ago
> services should allow me to easily create lots of aliases. Right now the best defense against social engineering seems to be my fastmail account which allows me to create 1 email address alias per service What you may want is a catch-all email - which lets you do @domain.com -> nmjohn@domain.com (where is everything besides already defined addresses) - that way you can make up emails on the fly without having to setup the alias beforehand. I've had that setup for 5 or 6 years now, and it works extremely well. A handy side-effect of this is it makes it easy to see which companies sell your email address to spammers when you included the name of the original company in the email you register with
- JoshTriplett 11y ago
  Note, though, that catch-all emails will also catch a ridiculous amount of spam. Creating each account name individually avoids that problem, at the cost of some extra trouble when registering a new service. An intermediate step that may work if you don't expect people to target you individually: have one or more required substrings for the email local part, and catch all mail to addresses containing that substring.
  - _ikke_ 11y ago
    I created my catch-all on a subdomain. While it gives a problem with certain websites (don't consider it a valid e-mail address), I barely receive spam on it.
    - belovedeagle 11y ago
      > While it gives a problem with certain websites (don't consider it a valid e-mail address) Are you saying that there are sites out there which don't accept mailbox@subdomain.example.com a valid email address? If so, that's beyond broken...
      - steve-howard 11y ago
        My school's student addresses ended in @u.northwestern.edu. You can imagine this was annoying sometimes when email addresses ending in .edu were used to verify student status.
turar 11y ago
If you own a home in the U.S., anybody already can get your address legally and easily from your county or district property appraiser's/assessor's website. Along with how much you paid for it, and when you bought it. So calling Amazon CS rep is a hard way to go about it. :)
- c22 11y ago
  Although they probably can't get this information if all they know is your domain name.
- plink 11y ago
  If you are the officer of a company you own in the U.S., anybody can get your address from the annual corp. report.
  - emilyfm 11y ago
    It's the same in most countries. Opencorporates.com is the first place to look. Some countries, like New Zealand, have images of corporate documents online for free, which gives you a copy of the signature as well. Like domain names, privacy when you have a company is hard.
- driverdan 11y ago
  The amount of available data varies by state. In TX, for example, sale prices are not disclosed.
  - techsupporter 11y ago
    But the deed of trust the buyer signed is in the public record (every Texas county of medium-to-large population has scanned land records online) and has the amount of the mortgage issued on its front page so that gets you close. That goes double if the form has an FHA case number at the top because it usually means the deed of trust is within 5% of the purchase price. No, not all of the time, but very often enough to make it useful for social engineering.
- 11y ago
incarnate 11y ago
This is exactly the same thing that let someone delete Mat Honan's (Wired author) accounts back in 2012: Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information. http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/
- ec109685 11y ago
  No, customer service did not disclose the cc number in this instance -- they did disclose his address though, which stinks.
mrb 11y ago
How to stop this: 1. Get a friend's permission to "hack" into his Amazon account (or "hack your own account"). 2. Contact Amazon's customer service, try the same social engineering techniques that the OP documented. 3. Once you obtain some sensitive information from the account, scare the CS rep by saying: "Haha! I am actually not the customer. I am a journalist/hacker/whatever and wanted to see how easy it was to social engineer information out of your customer service department, and you failed. I would like to talk to your manager please." Hopefully if enough people do this, it will get some internal attention at Amazon.
- umanwizard 11y ago
  So, commit criminal fraud to prove a point? Bad idea.
  - q3k 11y ago
    If there is written, explicit permission to perform this attack, how is it different from a corporate penetration test?
    - bigiain 11y ago
      Amazon hasn't given permission. I suspect they'd be quite unhappy. Having said that, I personally think they ought to expect it, and be responsible for whatever failings it discovers.
  - oh_sigh 11y ago
    How is it fraud if you have permission from the account owner to try and access it?
    - umanwizard 11y ago
      Fraud against Amazon, not the account owner.
      - 11y ago
ubersync 11y ago
If anyone wants to start a fund to sue Amazon for this, I am ready to pitch in a $100.
- PhantomGremlin 11y ago
  That's probably wishful thinking. I haven't checked Amazon's terms of service, but nowadays you can count on both of these being true: - you agreed to arbitration - you agreed to disallow class action lawsuits I.e. thanks to the Supremes[1]: As a result, businesses that include arbitration agreements with class action waivers can require consumers to bring claims only in individual arbitrations, rather than in court as part of a class action. [1] https://en.wikipedia.org/wiki/AT%26T_Mobility_LLC_v._Concepcion https://en.wikipedia.org/wiki/AT%26T_Mobility_LLC_v._Concepc...
  - arianvanp 11y ago
    I'm pretty sure those kind of terms, at least in The Netherlands and most of Europe, are illegal. So lets Class-action them in Europe instead? I'll pitch in 100 euros.
    - SEMW 11y ago
      Any lawsuit, class action or otherwise, requires the claimants to have suffered whatever harm they're suing over. You can't sue a company because they injured someone else. (IANAL and I'm only familiar with English law, but I'd be very surprised if there was anywhere where that isn't true, it's pretty fundamental)
hagmonk 11y ago
Why didn't the OP turn on two step verification? Amazon does support this.
- sleepymountain 11y ago
  His Amazon account wasn't even logged into, the CS rep gave up his information without the attacker being authenticated, and the attacker used that to login to other non-Amazon systems.
jasonkostempski 11y ago
Couldn't customer service just treat all sensitive information like the they treated the last 4 digits of the CC in this scenario? Verify only, reveal nothing. I'm sure almost all legit customers don't have even 5 possible addresses they may have shipped to, make them say what they think it is.
- hobs 11y ago
  That would be the basic standard to which all CSRs are trained to, and deviating from that is 100% deviating from protocol in almost any case, they do it for individual reasons (speed, a good customer survey, whatever) When I trained Apple techs the clear communication was that people use pretexting for not just mundane things like credit card theft, but to commit violence against other people (especially in the case of domestic violence where they have some personal details and can try to get more). Anything but the strategy of verify only is putting people's lives in danger.
bobby_9x 11y ago
Its interesting how easy it is to do something like this, yet legitimate third-party sellers can‘t even talk to a live customer support rep. when their account is suspended.
pfarnsworth 11y ago
The problem is Amazon has thousands of poorly trained first-level support staff with far too much power and information. What we need is a global security standard for support staff, with a template as to what information is accessible by staff and what isn't. And what is available to better trained 2nd-level support, etc. And then each company can say they are certified for this particular security standard, and then you can't get social engineering attacks where you attack one large corporation, get partial information, and then feed that into another large organization to get other information. This was done previously using Amazon, again, to get enough information to take someone's Twitter account, if i remember correctly.
- Merad 11y ago
  Not Amazon. Essentially every company. Your typical first tier support rep is paid perhaps $9-10 an hour, utterly hates their job, and has access to scary amounts of account information. It doesn't help that call center turnover rates are often so high that it isn't unusual for the median experience of reps to be 6 months, or less. The bottom line really is that so far these kinds of social engineering attacks haven't been enough of a problem for companies to have the slightest economic incentive to improve the situation.
gravypod 11y ago
I am VERY interested in what you mentioned about fastmail. That seems like an amazing idea. I have never thought about it. I think I need to make a script that can do that for me. A simple mail server to forward emails both ways.
swehner 11y ago
Customer support is what Amazon adds to the otherwise simple service of operating an online catalogue, stocking products and sending them out when ordered. As you can see here, they are not doing a good job even in that department. Taking huge profits for basically failing. I have called this a lose-lose in the past. So -- be good and stop using amazon!
anindyabd 11y ago
The OP says he is "a security conscious user who follows the best practices like: using unique passwords, 2FA, only using a secure computer and being able to spot phishing attacks from a mile away..." yet I do not think he enabled 2FA on Amazon.com. If he did customer service would not have helped the hacker pretending to be him. As their help page says, "If you need help from Customer Service after enabling Two-Step Verification, you'll need provide a security code similar to when trying to sign in to your account." https://www.amazon.com/gp/help/customer/display.html?nodeId=201596330 https://www.amazon.com/gp/help/customer/display.html?nodeId=...
- grapehut 11y ago
  Actually, I do have 2FA enabled on my account. But I don't think I had it enabled at the time for the very first attack. Interestingly, last night I did get an SMS: "Message from Amazon Customer Service: xxxxx is your Amazon security code" even though my 2FA is not an SMS (it's using authenticator). I don't have access to the recording, so I have no idea what actually happened. But based on the email ("here's the details" on your order) I'm almost certain they were successful. Probably just told them that they lost the phone, or something. At this point, they've now been able to get almost everything possible about me. Also interestingly, not once did Amazon recommend that I use 2FA to avoid social engineering. I was told by two different support reps to change my password though.
- putlake 11y ago
  I was excited about Amazon enabling 2FA. I started using it rightaway but it doesn't work with their extended applications. e.g. signing in on Roku, Amazon photos uploader app for Mac, Amazon video on Android/iOS.
  - micro-ram 11y ago
    Amazon should simply treat users with active 2FA accounts as high security accounts. High security accounts must go through a much more rigorous validation when speaking with support.
RainManDetroit 11y ago
Simply create an LLC and have it manager-managed, as opposed to member-managed, As long as you either do no business or legitimate business, the owner (member) into is protected, and it will list your registered agent and their office address as the site owner.
- djrogers 11y ago
  So I need to pay the state of California $800/yr to stop Amazon from giving away my personal info? No.
dannysu 11y ago
Reading through this thread, I've now taken action to use a unique email for important accounts. I was already using [name of service]@[some other domain I only use for email].com. However, I just changed now to [random # and chars]@domain.com. An additional thing I'm doing is reviewing what accounts have my credit card. One of the things I like about my Bank of America credit card is that I can use their ShopSafe feature to generate a card number for specific accounts. So if I'm buying transit pass on a website probably made by incompetent people, I generate a new credit card number and use it one time. Same thing with doctors that want me to write my credit card info on a piece of paper and mail it back to them.
nicksuperb 11y ago
I've been using my local USPS PO box for domain registration for the past few years. It pays for itself when you figure in the cost of add-on services from registrars. I also use it as an address for similar in-person sign up forms also. Aliasing services like Fastmail are also a solid part of the equation. Use it as much and in as many places as possible. You could also try an IRL alias-type hack by giving out a slightly different name (middle name, title, etc.) when filling out your address.
grapehut 11y ago
Worth checking out: someone reproduces using a fake address to get a real address. https://medium.com/@amaz/thank-you-for-sharing-this-but-i-couldn-t-just-accept-this-so-i-went-ahead-and-did-it-to-my-own-afb19d990056#.3l83bgwjp https://medium.com/@amaz/thank-you-for-sharing-this-but-i-co... (contains pretty great screencaptures)
- tempestn 11y ago
  Wow, that second rep was really struggling to find the line in his script that fit the situation (without much success).
- tokenizerrr 11y ago
  Well, that's just... Really bad.
Camillo 11y ago
Yes, Amazon is doing it wrong. But the much bigger problem is that your bank lets fraudsters impersonate you using easily obtained information such as your name and address. It is completely backwards that you need an impenetrable wall and moat around the place where you buy books and groceries, because, once you get past it, then the place where you store all your money and get your mortgage is as easy to penetrate as a piece of tissue paper. The root cause of all identity theft are the incredibly lax security policies of the financial system.
adarsh_thampy 11y ago
As someone who has trained customer support agents, I can attest to the fact that most agents have to be taught every scenario. If it slightly deviates from the one they have been trained on, they are clueless. Not saying all customer support people are like this. However, majority of people are. They rely on pre-written scripts. When a question is asked, they search for the template question with the answer.
- representative 11y ago
  You're absolutely right about the majority. If someone is capable enough to understand customer needs and resolve issues outside of predefined scripts they are capable enough to be working beyond customer support. Customer support representatives are largely people who exist as an interface between a customer who doesn't understand a system and a system that doesn't understand the customer needs. Most companies would do well to invest in "Customer Support Engineer" type roles, putting people who understand systems and are informed problem solvers on the front lines, people who can identify technical solutions to customer problems. Customer Support Representatives problem solving seems to begin and end with what they've learned from the latest ZenDesk Webinar. Most companies seem to believe that fast and friendly messages are what customers want, through twitter and Facebook, when the reality is they want their problem solved and the business most benefits when the cause is identified and solved for all customers, not the symptoms for one customer. Most companies could slice their customer support costs in half and increase their customer satisfaction substantially if they invested in building out roles for problem solvers instead of ticket solvers. 1 ticket solved is 1 ticket solved. A problem solved can be hundreds or thousands of future tickets prevented and an improved customer experience. (This comment isn't a slight against customer service representatives, they serve an important purpose at many companies and often provide great value. This comment is a slight against the companies that choose to hire a dozen more customer support representatives instead of addressing the core issues that are driving people to their support.)
  - richardwhiuk 11y ago
    I think you substantially over-estimate the number of tickets which can actually be 'solved' like this, and dramatically under-estimate the cost it would take to solve the problem. I'd have a hard time believing that the large number of companies who all operate this model are getting the cost-benefit analysis wrong by such a large margin as you seem to suggest.
aaronbrethorst 11y ago
"A chain is only as strong as its weakest link."
rogeryu 11y ago
We had our AWS account hijacked three years ago. Someone had taken over our admin email by hijacking the DNS. They had hacked into our DNS account (with another provider) and changed the MX for our domain. Then they contacted customer support and convinced them to disable two factor authentication. Then they started to play with our account, starting and stopping servers. Taking back the DNS took time. Meanwhile the hijackers were logged in, and could not be logged out by Amazon. This took more than a day. It took us two full days to get all back to normal. The good thing is that they could not login to our servers. What they wanted is still not clear, and who did this - we saw some suspicious traffic from Russia, but that's all.
dannysu 11y ago
There's also no way to separate AWS account from Amazon account it seems: https://forums.aws.amazon.com/thread.jspa?threadID=85882 https://forums.aws.amazon.com/thread.jspa?threadID=85882 This is really bad. The security implications are different between the two.
- ugh123 11y ago
  Sure there is. Sign up with a different email account. I hear they're free these days...
  - dannysu 11y ago
    I meant that there isn't a supported way by Amazon. What about purchase history? Kindle books? Coupon credits? You're gonna manually migrate all AWS services you use one by one? What about AWS credits you might have gotten? While you can certainly register two accounts and start all over, it's clear I meant an intentional support by the system to allow one to separate the two.
ninjakeyboard 11y ago
People will forever be the weakest link in a system's security.
purpled_haze 11y ago
And now that this is public, we're all at more risk.
joncp 11y ago
Working in the same neighborhood as Amazon's new headquarters, I've become convinced that not all is well with their security. All those blue badges with their employees' full names dangling from their belts while they're in line at the local food trucks is a social engineer's dream come true. Expect to see some high-profile breaches.
Animats 11y ago
This is Amazon's problem for using street address (!) as a password. If there's an authentication issue, they should at least email or call or SMS you.
_Codemonkeyism 11y ago
Amazon does not care. A fraudster used our startup bank account to pay at Amazon. We told them, they did not blacklist the user to use our account or take any actions beside removing the bank account (ours) from his Amazon account. The fraudster did this at least 3 times with increasing amounts of money. Amazon did not care. Only when we went to the police did this stop. Amazon sold me a phone, the box arrived empty (I wonder why they do not check the weight when it leaves their warehouse, DHL printed a weight on the box that was less than the phone alone). It took Amazon support months to solve this, especially they could or would not cancel the attached mobile phone contract for months.
- kuschku 11y ago
  I had a situation where Amazon couldn't bill my bank account, so they blocked logging in. I verified with just name and address to a customer service rep and asked for the steps I'd have to do to unlock it again, and they told me that (a) the transaction failed, (b) they told me my IBAN. In plaintext. The full IBAN. (c) and then they told me the steps to fix it (wire them the money that I was owing them, plus 6 EUR. Standard procedure in Germany). In the end, everything worked again, but, the fact that they gave out by IBAN — enough info for anyone to go and pull money from my account — is making me so angry.
  - SimpleMinds 11y ago
    Could you tell how knowing IBAN enables someone to take money from your account? As far as I understand, the only think that can happen with IBAN is to receive money. Maybe you're thinking of credit card number? The CC's I had had different CC number and IBAN account.
    - pfg 11y ago
      SEPA direct debit allows you to pull money via IBAN (+ BIC, depending on the countries involved in the transaction). Specifics vary from country to country. Some require active approval from the customer (IIRC France, probably more), others "just work". Fraud is not as common, since bank accounts that are allowed to debit money this way are generally only available to companies who have to sign paperwork ensuring that they have written permission from each debitor. Additionally, although this might be country-specific as well, chargebacks can be initiated without providing any reason for at least 8 weeks, and in case of a fraudulent transaction, up to 13 months.
vjvj 11y ago
Wow. I had a similar experience with Skype too. They couldn't care less that someone had got access to my account and made calls. The attacker even added his own mobile number (in a different country) but Skype wouldn't bother investigating or escalating...
EGreg 11y ago
This article has taught me a valuable lesson: I should be using the email+suffix@gmail.com feature in each service I'm signed up for. Seems like an easy enough change. Ideally, the suffix would be some non obvious function of the service name, which I can remember easily. Like taking the second letter of the service name and relating it to an object I encounter a lot in my life.
Nemant 11y ago
Somebody should try getting Jeff bezos' address. I tried a couple of times and failed.
rplnt 11y ago
> migrating as much to Google services which seem significantly more robust at stopping these attacks. Because they don't have customer support?
- vgt 11y ago
  Because 2FA
yomly 11y ago
Someone's life in Amazon is about to become a world of pain. This is not going to be a fun Jeff B escalation...
facepalm 11y ago
I find it a bit weird that address and even credit card number are confidential information. Credit card numbers are not really secret, you hand them out to random waiters in random restaurants. Maybe part of the fault lies with the other companies who accept that information as ID?
BaNzounet 11y ago
A possible solution to avoid people finding out the email you're using for a given service is to dump random word/phrase in your email address. e.g. email+ifidontknowthisthisisnotme@youremail.com Not sure how an agent would react to someone having part of the correct email though.
fredwu 11y ago
It is rather unfortunate yet at the same time unsurprising. :( Two years ago I found out that Amazon allows multiple accounts to be set up using the same email address with different passwords (!!!) - which means that the potential attack vector is larger for no good reason. I don't recall how this happened but I can only assume at the time I signed up to AWS and I might have reset/changed the password somehow that resulted in the system creating another copy of my account. So all the information (credit cards, addresses, etc) of the "old" account still existed until I deleted them. But let's say if someone who has no idea that they have more than one accounts with Amazon, they could easily leave their information intact in their "old" accounts, which if they have weak passwords can easily be compromised. Unfortunately Amazon did not take this report seriously, and to this very day this issue still persists.
- sleepychu 11y ago
  My email address also maps to two unique accounts. One of them has never had any information on it anyway but I agree it's very concerning.
ommunist 11y ago
Same sh#t happens with Apple Support all the time, for few years in a row. Someone was after my last 4 digits, requesting password resets to Apple ID, like 14 times a day, and then impersonating me, talking to support.
- virusduck 11y ago
  Did you activate 2FA?
  - ommunist 11y ago
    After that I did. And I was so much surprised, Apple delays 2FA activation for a week! 'to be sure that you are you'
krampian 11y ago
I'm concerned that names and addresses alone seem to be enough for these guys to do meaningful ID theft with. The phone book is full of names and addresses anyone can get their hands on easily. Even these guys in India - there's whitepages.com. Not sure why they're going to all the trouble of trying to game Amazon's customer support. On that note, I order alot from Amazon and throw out their boxes in the trash outside all the time. Sometimes I notice that neighbors (presumably) take those boxes for their own use before trash pickup comes along. All of them have my name and mailing address on them...
AndrewUnmuted 11y ago
I worked for Amazon for four years. For nearly the entire time I worked there, I, as an engineer, had access to every customer's purchase history, contact information, email addresses, etc. The reason? On occasion, I'd need to get a user's email address to reach out to them if they reported bugs. The one service that offers employees this access is all or nothing. Either you get to see a customer's email, credit card number, and purchase history - or you get to see nothing at all. Everyone knew that I had this access, and everyone knew that it was against Amazon's own policy to give me access. But to them, that was easier than fixing the service so that it was more useful. Perhaps I'm just clueless, but something tells me that any relevant competitor to Amazon - say, I don't know, Google - would choose to fix the service instead.
- 0xffff2 11y ago
  >Perhaps I'm just clueless, but something tells me that any relevant competitor to Amazon - say, I don't know, Google - would choose to fix the service instead. Why? The attitude you describe (do what's easy, not what's right) is endemic to any organization over a certain size in my experience.
leeleelee 11y ago
I think the best solution, for now, is to just regularly check your full credit report for anything you don't recognize and watch your credit card, debit card statements for any purchases you don't recognize. I've had credit cards get compromised in the past, and it was actually quite painless to have my bank (Chase) shut the card down and issue a new one. Your information can be stolen from SO MANY sources and not just Amazon customer service. It's impossible to guarantee who sees any of your personal information once you share it with ANYONE on the internet (Amazon, Google, some random retailer, domain registrar, etc.). The server at your local Applebees could steal your CC info. Be sensible with where you share personal information, but don't be unreasonable. It's safe to use Amazon. Just watch your credit report (regardless of whether you feel you're at high risk) and bank statements. If/when a problem arises, then deal with it.

1447 points by grapehut 11y ago

free2rhyme214 11y ago

Someone hacked my Amazon account once. I'm surprised they don't have 2-step verification.

danneu 11y ago
On the other hand, 2FA opens up the "I lost my phone" customer support channel which might be just as weak. For example, you can turn on 2FA for sending money via Bank of America's webpanel. As in, you log in with username/password and need 2FA for some restricted actions. Well, phone up customer support and they'll remove your 2FA if you can provide them some secret details... all of which are displayed on the webpanel to anyone that was already able to log in. It's a joke.
- jimrandomh 11y ago
  If they were following a script and the script were careful, saying "I lost my phone" would cause them to try to contact your phone, and when you answered and said you still had it, would put a fraud alert on the account and stop all further attempts to social engineer customer service. But most companies aren't anywhere near that careful.
  - hueving 11y ago
    Many people (including me) don't answer from unknown numbers, so that wouldn't work.
    - stestagg 11y ago
      It wouldn't work /for you/. But for people who do answer their phone, it would add protection.
      - bigger_cheese 11y ago
        Possibly but you'd want to be damn sure it was actually the bank calling you. What's to stop a scammer claiming to be from the bank calling you. "Hi I'm from bank xxxx calling to warn about some potentially fraudulent transactions we've detected on your credit card before we can continue please answer a few security questions to verify your identity." I suspect some people would fall for that and tell the 'bank' their personal details.
        WorldMaker 11y ago
        I've yelled at most of my banks for cold calling me exactly like that. My response is, "Can this be corrected online? Otherwise, I will call the 800 number myself and if you could provide any specifics that might speed up that next call I would appreciate." In the past I've also sent letters to bank security teams not to cold call and ask for personal details. One of my banks actually switched to a standard recorded message that ends in a "Please call our 1-800 number at your earliest convenience." Better.
    - tomschlick 11y ago
      A text message / email might though. Just saying "Your account has been flagged for a lost/stolen phone which you use as your 2FA. Please contact support if this is not correct."
      - deleted 11y ago
        [deleted]
  - mcintyre1994 11y ago
    Wouldn't that allow somebody who stole your phone to lock you out of your bank if they answered the call? Seems like that'd make a stressful situation potentially worse if thieves knew they could do that. Especially if they called from a number that's linked to the bank anywhere and something like Google's dialer surfaces who it is - your bank calling seems like a potential "maybe I can get more" for a thief so they might be inclined to answer and impersonate.
    - deleted 11y ago
      [deleted]
    - jimrandomh 11y ago
      I would prefer that my bank, if it detects fraudsters trying to pull some sort of trick involving my account, to freeze things until I show up and present ID. That's inconvenient, but clearly better than the alternative.
      - zyxley 11y ago
        So... what about banks with no actual physical branches?
        jimrandomh 11y ago
        In an ideal world, the bank would direct you to a notary public who would check your identity and public key fingerprint. (Sadly, the present state of things is probably too dysfunctional to manage that.)
      - hibikir 11y ago
        Banks would never do that, if just because they'd risk losing business in places where there's no local branches. Many of the national banks that offer the best conditions have no presence in a lot of metro areas. And even if you make sure your bank has a local branches (which really, I've not gone to one in years, why would I need one?), what happens when you are on a trip, and your accounts are frozen? I've had my CCs frozen because the bank considered my expenses during a trip to be potentially fraudulent, but I could clear it up over the phone. Do we have to devolve back to carrying thousands in cash, like in the old days? Security is always a tradeoff between avoiding fraud and being usable, and the tradeoffs that are great for some people in some situations are unacceptable for others.
  - ryanlol 11y ago
    Just DoS the phone then?
- JoshTriplett 11y ago
  > On the other hand, 2FA opens up the "I lost my phone" customer support channel which might be just as weak. "I lost my phone" (or "my phone stopped working") does need some solution, though. The right way to handle "I lost my phone" seems like one of two possibilities: either come into a branch and provide legal identification matching what you used to open the account (and get "yourself" on camera doing so), or have a token mailed to your physical address on file (which you cannot change at the same time as a lost phone claim).
  - baby 11y ago
    > have a token mailed to your physical address on file This is the worst for the customer point of view. Takes a long time.
    - kuschku 11y ago
      It on average 24h or less, considering that mail through DHL is next-morning delivery everywhere, and same-day delivery in larger cities.
      - SignMeTheHELLUp 11y ago
        This may come as a shock to you but some people live outside the United States.
        kuschku 11y ago
        I’m in Germany, actually.
  - Latty 11y ago
    Shout out here to NearlyFreeSpeech who do this right. They give you a set of verification actions: You provide a scanned copy of a government-issued photo ID. You provide a scanned copy of a statement showing both the most recent deposit and a name and address matching one of your accounts. You complete SMS verification. (SMS must be previously configured.) You complete 2-factor verification. (2-factor auth must be previously configured.) You correctly answer your security question. (Security question and answer must be previously configured, below.) You use an ssh key to create a file with a specific name on one of your sites hosted here. (Must be previously configured, won’t work if account is empty.) We try and fail to contact you via your currently configured email address. (This one may take a long time.) You can then pick how many of these you want to require to get your account back (and which you want to configure), including an option not to help at all in the case you lose your account.
tshtf 11y ago
They do: http://www.theverge.com/2015/11/18/9753888/amazon-two-factor-authentication-2fa http://www.theverge.com/2015/11/18/9753888/amazon-two-factor...
grapehut 11y ago
2FA is useful if someone knows your password (e.g. you re-use it, and it gets leaked) but it's not useful in this case. I have 2FA setup on my accounts, and when ever contacting customer support I've never had to prove I own the device.
deleted 11y ago
[deleted]

muppetman 11y ago

I read this as a guy who has serious amnesia.

okigan 11y ago

Any recommendation what one (as a customer of Amazon) can do today ? 2FA does not help here as someone goes through support channel which looks like bypasses 2FA Also concerned if the same trick can be applied to Amazon Cloud services, as there one can also run up a big bill pretty quickly.

grapehut 11y ago
I honestly have no idea. I think the only protection at the moment seems to be obscurity, use an email address that is not linked to you.
bigiain 11y ago
If I were the OP or someone equally sure I was likely to be targeted via my Amazon account, I'd consider: Using a unique email address. Using a unique physical address (both for my account details and for my delivery addresses). Use a unique credit card (I'd probably get a refillable prepaid gift card, and set up some auto topup to ensure it's got my expected monthly Amazon bill available as "credit", but not much more). I'd probably move any AWS billing to a different Amazon account. If I were more paranoid (or being actively targeted), I'd probably also try to go unique on _everything_ I tell Amazon; phone numbers, different city/state/zipcode (as well as street address), company name, website url, alternate contacts - then I'd set up "Security questions" with unguessable questions/answers (perhaps diceware/xkcd style "correct horse battery staple" type ones, that a CS rep could easily read out and verify - rather than a base64 GUID...). Not that I trust the "security questions", but if Amazon lets you use freeform questions as well as answers, it might help to make your first security question "Have you noticed this account has two factor authentication turned on?" with an answer like "Yes, so Amazon Customer Service will take additional care when being asked to reveal account information, right?"
- Your_Creator 11y ago
  It seems to me that ANYONE who buys ANYTHING is equally likely to be targeted via their Amazon account - Think about how many people actually use Amazon services Through sheer competition, Amazon is forcing Walmart to close over 100 stores. We only know that because Walmart is big enough to get noticed. Remember when Walmart was the company putting local mom and pop shops out of business? Cycle of life I suppose...

paulcole 11y ago

"The problem is, 9999 times out of 10000 support requests are legitimate, agents get trained to assume they’re legitimate. But in the 1 case they’re not, you can completely fuck someone over." That's why nothing will change if these estimates are even in the right universe. Nobody wants to inconvenience the vast majority of customers to prevent a minuscule number of issues.

vacri 11y ago
Came here to say just that. I did general customer support for a telco for a few months a while back, and most of the general public can't really deal with high security for personal information. If you were as strict with security as you should be, you'd be locking half of your subscribers out of their accounts eventually. This would create a phenomenal amount of follow-up paperwork for your company, meaning higher costs on your end and greater resentment on the customer's end - costs go up for you and customers head elsewhere. It's why banks still use laughably short and simple PIN codes.
- bigiain 11y ago
  While that's true, and perhaps even needs to be "the default", there really needs to be a way to say "Hey, I'm concerned, and am prepared to take responsibility for my own access credentials. I demand you categorically _do not_ disclose any of my personal information to anyone without a warrant or court order." And for that sort of demand to have appropriate legal teeth to ensure people collecting that data are sufficiently motivated to act properly on it.
  - bigiain 11y ago
    Startup idea: Whitehat Social Engineering (as a service). You authorise a whitehat team to attempt to social engineer all your discoverable internet presence/accounts to see what personal information their systems and/or customer service will disclose based on existing publicly available data. (I suspect legally that'd at least be on the white-ish side of grey rather than blackhat...) I wonder how long it'll be before (or how long ago it became) sensible to register a shell company as the holder of any public record you're legally required to make public? It's probably much easier to roll your shell companies "registered address" if you discover it's been compromised than it is to move house every time Amazon's customer service goes "above and beyond" on your behalf to your attackers...

tommoor 11y ago

Damn, lucky they send out emails after a customer service interaction or you'd have never had any idea this even took place.

grapehut 11y ago
It makes me wonder, if the person is unsuccessful at authenticating, does the real owner get a follow up email? For instance, maybe he had to try 5 times to contact support before he found an agent who authenticated me using a fake address.

xenadu02 11y ago

The vast majority of services use email address to identify you so diversifying your email addresses helps a lot. I've known about every hack/info leak ahead of everyone else for that reason - I use a unique email for every service. I also use different cards for the major online retailers / tech giants so knowing the last four digits from my Amazon account is useless to validate anything else (though this does require having several credit cards or debit cards). Whois privacy is absolutely required. Unfortunately if someone is determined enough, almost all ISPs, cell companies, retailers, etc will happily give them control of your entire digital life. You can only minimize the risk somewhat.

danneu 11y ago

Whois is great for social engineering attackers. You get a name, email, address, and the first service to attack. Meanwhile, the ICANN is working around the clock to make it illegal for us to protect our personal information, and whois protection is becoming an increasingly niche service for registrars. For example, gandi.net (and thus Amazon) doesn't hide your name when you have it turned on. By the time you find this out, it might occur to you to just type in a different name, but now you're violating ICANN policy. And it's already been scraped by any of those whois history websites.

fps 11y ago
I think the bigger problem is that public information like your name and address is sufficient for proving your identity. If we make whois information private, what about phone books, property records, direct mail databases, etc. etc.
- VeilEm 11y ago
  If someone has your public name and address you're already at significant risk if you ever say anything controversial that gets attention. You're liable to being swatted, getting fake pizza orders, having people show up at your house, harassing you and much more. See Zoe Quinn, Brian Krebs, lots of less well known individuals, etc.
  - thephyber 11y ago
    Which only proves your comment's parent's point even more. {SWAT, pizza orders, etc} assume that the phone number that shows up on caller ID is authentication of the identity of the phone line on the other end. They could call back the number on caller ID to verify the original caller matched the person who picked up, but they don't. Having knowledge of a Social Security number was assumed to be authentication, but it's increasingly obvious that such an authentication scheme is antiquated and was destined to fail from the beginning. When an identity thief can get a mortgage under my name with little more than credit bureau data on me, it costs only a little more than $15 to destroy my credit, my time, and my future because transactions don't have sufficient authentication. These awfully designed authentication schemes will only magnify the problems as more companies (especially credit bureaus and data marketers) pass around data on me and make it easier for someone to buy it on demand.

ronyeh 11y ago

On your Amazon home page, go to: Your Account › Change Account Settings › Advanced Security Settings Turn on 2-step Verification. It won't completely solve social engineering, but it can't hurt.

UnoriginalGuy 11y ago
If you had read the article you would know that they already had 2F turned on before the first intrusion and throughout the subsequent intrusions.
- ronyeh 11y ago
  Sorry, I did skim it but must have missed it! :-} In any case, I will leave my comment so that folks who come across this thread have a handy reference for turning on 2FA on their Amazon accounts.
- asymptotic 11y ago
  I might be being pedantic, but the only mention of 2FA in the OP is: "As a security conscious user who follows the best practices like: using unique passwords, 2FA, only using a secure computer and being able to spot phishing attacks from a mile away, I would have thought my accounts and details would be be pretty safe? Wrong." Are you sure the author enabled 2FA on his Amazon retail account, or was it only enabled on his AWS account? The two systems do not share the same 2FA. FYI I enabled 2FA on my Amazon retail account and when I called customer support they verified it. Once the verification failed and they refused to give me support. Anyone else confirm a similar story with 2FA and support? Anyone willing to explicitly test this out?
  - hayd 11y ago
    There's no reason to assume he wasn't using 2FA. The title says "backdoor" and that's the point: they didn't verify identity... they asked for name, email and a nearby address.
    - 11y ago

ikeboy 11y ago

>Email services should allow me to easily create lots of aliases I use blur from Abine.com, gives me a new email that forwards to my main, as many as I want, integrated with a browser plugin that barely adds time to signup.

nmjohn 11y ago

> services should allow me to easily create lots of aliases. Right now the best defense against social engineering seems to be my fastmail account which allows me to create 1 email address alias per service What you may want is a catch-all email - which lets you do @domain.com -> nmjohn@domain.com (where is everything besides already defined addresses) - that way you can make up emails on the fly without having to setup the alias beforehand. I've had that setup for 5 or 6 years now, and it works extremely well. A handy side-effect of this is it makes it easy to see which companies sell your email address to spammers when you included the name of the original company in the email you register with

JoshTriplett 11y ago
Note, though, that catch-all emails will also catch a ridiculous amount of spam. Creating each account name individually avoids that problem, at the cost of some extra trouble when registering a new service. An intermediate step that may work if you don't expect people to target you individually: have one or more required substrings for the email local part, and catch all mail to addresses containing that substring.
- _ikke_ 11y ago
  I created my catch-all on a subdomain. While it gives a problem with certain websites (don't consider it a valid e-mail address), I barely receive spam on it.
  - belovedeagle 11y ago
    > While it gives a problem with certain websites (don't consider it a valid e-mail address) Are you saying that there are sites out there which don't accept mailbox@subdomain.example.com a valid email address? If so, that's beyond broken...
    - steve-howard 11y ago
      My school's student addresses ended in @u.northwestern.edu. You can imagine this was annoying sometimes when email addresses ending in .edu were used to verify student status.

turar 11y ago

If you own a home in the U.S., anybody already can get your address legally and easily from your county or district property appraiser's/assessor's website. Along with how much you paid for it, and when you bought it. So calling Amazon CS rep is a hard way to go about it. :)

c22 11y ago
Although they probably can't get this information if all they know is your domain name.
plink 11y ago
If you are the officer of a company you own in the U.S., anybody can get your address from the annual corp. report.
- emilyfm 11y ago
  It's the same in most countries. Opencorporates.com is the first place to look. Some countries, like New Zealand, have images of corporate documents online for free, which gives you a copy of the signature as well. Like domain names, privacy when you have a company is hard.
driverdan 11y ago
The amount of available data varies by state. In TX, for example, sale prices are not disclosed.
- techsupporter 11y ago
  But the deed of trust the buyer signed is in the public record (every Texas county of medium-to-large population has scanned land records online) and has the amount of the mortgage issued on its front page so that gets you close. That goes double if the form has an FHA case number at the top because it usually means the deed of trust is within 5% of the purchase price. No, not all of the time, but very often enough to make it useful for social engineering.
11y ago

incarnate 11y ago

This is exactly the same thing that let someone delete Mat Honan's (Wired author) accounts back in 2012: Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information. http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/

ec109685 11y ago
No, customer service did not disclose the cc number in this instance -- they did disclose his address though, which stinks.

mrb 11y ago

How to stop this: 1. Get a friend's permission to "hack" into his Amazon account (or "hack your own account"). 2. Contact Amazon's customer service, try the same social engineering techniques that the OP documented. 3. Once you obtain some sensitive information from the account, scare the CS rep by saying: "Haha! I am actually not the customer. I am a journalist/hacker/whatever and wanted to see how easy it was to social engineer information out of your customer service department, and you failed. I would like to talk to your manager please." Hopefully if enough people do this, it will get some internal attention at Amazon.

umanwizard 11y ago
So, commit criminal fraud to prove a point? Bad idea.
- q3k 11y ago
  If there is written, explicit permission to perform this attack, how is it different from a corporate penetration test?
  - bigiain 11y ago
    Amazon hasn't given permission. I suspect they'd be quite unhappy. Having said that, I personally think they ought to expect it, and be responsible for whatever failings it discovers.
- oh_sigh 11y ago
  How is it fraud if you have permission from the account owner to try and access it?
  - umanwizard 11y ago
    Fraud against Amazon, not the account owner.
    - 11y ago

ubersync 11y ago

If anyone wants to start a fund to sue Amazon for this, I am ready to pitch in a $100.

PhantomGremlin 11y ago
That's probably wishful thinking. I haven't checked Amazon's terms of service, but nowadays you can count on both of these being true: - you agreed to arbitration - you agreed to disallow class action lawsuits I.e. thanks to the Supremes[1]: As a result, businesses that include arbitration agreements with class action waivers can require consumers to bring claims only in individual arbitrations, rather than in court as part of a class action. [1] https://en.wikipedia.org/wiki/AT%26T_Mobility_LLC_v._Concepcion https://en.wikipedia.org/wiki/AT%26T_Mobility_LLC_v._Concepc...
- arianvanp 11y ago
  I'm pretty sure those kind of terms, at least in The Netherlands and most of Europe, are illegal. So lets Class-action them in Europe instead? I'll pitch in 100 euros.
  - SEMW 11y ago
    Any lawsuit, class action or otherwise, requires the claimants to have suffered whatever harm they're suing over. You can't sue a company because they injured someone else. (IANAL and I'm only familiar with English law, but I'd be very surprised if there was anywhere where that isn't true, it's pretty fundamental)

hagmonk 11y ago

Why didn't the OP turn on two step verification? Amazon does support this.

sleepymountain 11y ago
His Amazon account wasn't even logged into, the CS rep gave up his information without the attacker being authenticated, and the attacker used that to login to other non-Amazon systems.

jasonkostempski 11y ago

Couldn't customer service just treat all sensitive information like the they treated the last 4 digits of the CC in this scenario? Verify only, reveal nothing. I'm sure almost all legit customers don't have even 5 possible addresses they may have shipped to, make them say what they think it is.

hobs 11y ago
That would be the basic standard to which all CSRs are trained to, and deviating from that is 100% deviating from protocol in almost any case, they do it for individual reasons (speed, a good customer survey, whatever) When I trained Apple techs the clear communication was that people use pretexting for not just mundane things like credit card theft, but to commit violence against other people (especially in the case of domestic violence where they have some personal details and can try to get more). Anything but the strategy of verify only is putting people's lives in danger.

bobby_9x 11y ago

Its interesting how easy it is to do something like this, yet legitimate third-party sellers can‘t even talk to a live customer support rep. when their account is suspended.

pfarnsworth 11y ago

The problem is Amazon has thousands of poorly trained first-level support staff with far too much power and information. What we need is a global security standard for support staff, with a template as to what information is accessible by staff and what isn't. And what is available to better trained 2nd-level support, etc. And then each company can say they are certified for this particular security standard, and then you can't get social engineering attacks where you attack one large corporation, get partial information, and then feed that into another large organization to get other information. This was done previously using Amazon, again, to get enough information to take someone's Twitter account, if i remember correctly.

Merad 11y ago
Not Amazon. Essentially every company. Your typical first tier support rep is paid perhaps $9-10 an hour, utterly hates their job, and has access to scary amounts of account information. It doesn't help that call center turnover rates are often so high that it isn't unusual for the median experience of reps to be 6 months, or less. The bottom line really is that so far these kinds of social engineering attacks haven't been enough of a problem for companies to have the slightest economic incentive to improve the situation.

gravypod 11y ago

I am VERY interested in what you mentioned about fastmail. That seems like an amazing idea. I have never thought about it. I think I need to make a script that can do that for me. A simple mail server to forward emails both ways.

swehner 11y ago

Customer support is what Amazon adds to the otherwise simple service of operating an online catalogue, stocking products and sending them out when ordered. As you can see here, they are not doing a good job even in that department. Taking huge profits for basically failing. I have called this a lose-lose in the past. So -- be good and stop using amazon!

anindyabd 11y ago

The OP says he is "a security conscious user who follows the best practices like: using unique passwords, 2FA, only using a secure computer and being able to spot phishing attacks from a mile away..." yet I do not think he enabled 2FA on Amazon.com. If he did customer service would not have helped the hacker pretending to be him. As their help page says, "If you need help from Customer Service after enabling Two-Step Verification, you'll need provide a security code similar to when trying to sign in to your account." https://www.amazon.com/gp/help/customer/display.html?nodeId=201596330 https://www.amazon.com/gp/help/customer/display.html?nodeId=...

grapehut 11y ago
Actually, I do have 2FA enabled on my account. But I don't think I had it enabled at the time for the very first attack. Interestingly, last night I did get an SMS: "Message from Amazon Customer Service: xxxxx is your Amazon security code" even though my 2FA is not an SMS (it's using authenticator). I don't have access to the recording, so I have no idea what actually happened. But based on the email ("here's the details" on your order) I'm almost certain they were successful. Probably just told them that they lost the phone, or something. At this point, they've now been able to get almost everything possible about me. Also interestingly, not once did Amazon recommend that I use 2FA to avoid social engineering. I was told by two different support reps to change my password though.
putlake 11y ago
I was excited about Amazon enabling 2FA. I started using it rightaway but it doesn't work with their extended applications. e.g. signing in on Roku, Amazon photos uploader app for Mac, Amazon video on Android/iOS.
- micro-ram 11y ago
  Amazon should simply treat users with active 2FA accounts as high security accounts. High security accounts must go through a much more rigorous validation when speaking with support.

RainManDetroit 11y ago

Simply create an LLC and have it manager-managed, as opposed to member-managed, As long as you either do no business or legitimate business, the owner (member) into is protected, and it will list your registered agent and their office address as the site owner.

djrogers 11y ago
So I need to pay the state of California $800/yr to stop Amazon from giving away my personal info? No.

dannysu 11y ago

Reading through this thread, I've now taken action to use a unique email for important accounts. I was already using [name of service]@[some other domain I only use for email].com. However, I just changed now to [random # and chars]@domain.com. An additional thing I'm doing is reviewing what accounts have my credit card. One of the things I like about my Bank of America credit card is that I can use their ShopSafe feature to generate a card number for specific accounts. So if I'm buying transit pass on a website probably made by incompetent people, I generate a new credit card number and use it one time. Same thing with doctors that want me to write my credit card info on a piece of paper and mail it back to them.

nicksuperb 11y ago

I've been using my local USPS PO box for domain registration for the past few years. It pays for itself when you figure in the cost of add-on services from registrars. I also use it as an address for similar in-person sign up forms also. Aliasing services like Fastmail are also a solid part of the equation. Use it as much and in as many places as possible. You could also try an IRL alias-type hack by giving out a slightly different name (middle name, title, etc.) when filling out your address.

grapehut 11y ago

Worth checking out: someone reproduces using a fake address to get a real address. https://medium.com/@amaz/thank-you-for-sharing-this-but-i-couldn-t-just-accept-this-so-i-went-ahead-and-did-it-to-my-own-afb19d990056#.3l83bgwjp https://medium.com/@amaz/thank-you-for-sharing-this-but-i-co... (contains pretty great screencaptures)

tempestn 11y ago
Wow, that second rep was really struggling to find the line in his script that fit the situation (without much success).
tokenizerrr 11y ago
Well, that's just... Really bad.

Camillo 11y ago

Yes, Amazon is doing it wrong. But the much bigger problem is that your bank lets fraudsters impersonate you using easily obtained information such as your name and address. It is completely backwards that you need an impenetrable wall and moat around the place where you buy books and groceries, because, once you get past it, then the place where you store all your money and get your mortgage is as easy to penetrate as a piece of tissue paper. The root cause of all identity theft are the incredibly lax security policies of the financial system.

adarsh_thampy 11y ago

As someone who has trained customer support agents, I can attest to the fact that most agents have to be taught every scenario. If it slightly deviates from the one they have been trained on, they are clueless. Not saying all customer support people are like this. However, majority of people are. They rely on pre-written scripts. When a question is asked, they search for the template question with the answer.

representative 11y ago
You're absolutely right about the majority. If someone is capable enough to understand customer needs and resolve issues outside of predefined scripts they are capable enough to be working beyond customer support. Customer support representatives are largely people who exist as an interface between a customer who doesn't understand a system and a system that doesn't understand the customer needs. Most companies would do well to invest in "Customer Support Engineer" type roles, putting people who understand systems and are informed problem solvers on the front lines, people who can identify technical solutions to customer problems. Customer Support Representatives problem solving seems to begin and end with what they've learned from the latest ZenDesk Webinar. Most companies seem to believe that fast and friendly messages are what customers want, through twitter and Facebook, when the reality is they want their problem solved and the business most benefits when the cause is identified and solved for all customers, not the symptoms for one customer. Most companies could slice their customer support costs in half and increase their customer satisfaction substantially if they invested in building out roles for problem solvers instead of ticket solvers. 1 ticket solved is 1 ticket solved. A problem solved can be hundreds or thousands of future tickets prevented and an improved customer experience. (This comment isn't a slight against customer service representatives, they serve an important purpose at many companies and often provide great value. This comment is a slight against the companies that choose to hire a dozen more customer support representatives instead of addressing the core issues that are driving people to their support.)
- richardwhiuk 11y ago
  I think you substantially over-estimate the number of tickets which can actually be 'solved' like this, and dramatically under-estimate the cost it would take to solve the problem. I'd have a hard time believing that the large number of companies who all operate this model are getting the cost-benefit analysis wrong by such a large margin as you seem to suggest.

aaronbrethorst 11y ago

"A chain is only as strong as its weakest link."

rogeryu 11y ago

We had our AWS account hijacked three years ago. Someone had taken over our admin email by hijacking the DNS. They had hacked into our DNS account (with another provider) and changed the MX for our domain. Then they contacted customer support and convinced them to disable two factor authentication. Then they started to play with our account, starting and stopping servers. Taking back the DNS took time. Meanwhile the hijackers were logged in, and could not be logged out by Amazon. This took more than a day. It took us two full days to get all back to normal. The good thing is that they could not login to our servers. What they wanted is still not clear, and who did this - we saw some suspicious traffic from Russia, but that's all.

dannysu 11y ago

There's also no way to separate AWS account from Amazon account it seems: https://forums.aws.amazon.com/thread.jspa?threadID=85882 https://forums.aws.amazon.com/thread.jspa?threadID=85882 This is really bad. The security implications are different between the two.

ugh123 11y ago
Sure there is. Sign up with a different email account. I hear they're free these days...
- dannysu 11y ago
  I meant that there isn't a supported way by Amazon. What about purchase history? Kindle books? Coupon credits? You're gonna manually migrate all AWS services you use one by one? What about AWS credits you might have gotten? While you can certainly register two accounts and start all over, it's clear I meant an intentional support by the system to allow one to separate the two.

ninjakeyboard 11y ago

People will forever be the weakest link in a system's security.

purpled_haze 11y ago

And now that this is public, we're all at more risk.

joncp 11y ago

Working in the same neighborhood as Amazon's new headquarters, I've become convinced that not all is well with their security. All those blue badges with their employees' full names dangling from their belts while they're in line at the local food trucks is a social engineer's dream come true. Expect to see some high-profile breaches.

Animats 11y ago

This is Amazon's problem for using street address (!) as a password. If there's an authentication issue, they should at least email or call or SMS you.

_Codemonkeyism 11y ago

Amazon does not care. A fraudster used our startup bank account to pay at Amazon. We told them, they did not blacklist the user to use our account or take any actions beside removing the bank account (ours) from his Amazon account. The fraudster did this at least 3 times with increasing amounts of money. Amazon did not care. Only when we went to the police did this stop. Amazon sold me a phone, the box arrived empty (I wonder why they do not check the weight when it leaves their warehouse, DHL printed a weight on the box that was less than the phone alone). It took Amazon support months to solve this, especially they could or would not cancel the attached mobile phone contract for months.

kuschku 11y ago
I had a situation where Amazon couldn't bill my bank account, so they blocked logging in. I verified with just name and address to a customer service rep and asked for the steps I'd have to do to unlock it again, and they told me that (a) the transaction failed, (b) they told me my IBAN. In plaintext. The full IBAN. (c) and then they told me the steps to fix it (wire them the money that I was owing them, plus 6 EUR. Standard procedure in Germany). In the end, everything worked again, but, the fact that they gave out by IBAN — enough info for anyone to go and pull money from my account — is making me so angry.
- SimpleMinds 11y ago
  Could you tell how knowing IBAN enables someone to take money from your account? As far as I understand, the only think that can happen with IBAN is to receive money. Maybe you're thinking of credit card number? The CC's I had had different CC number and IBAN account.
  - pfg 11y ago
    SEPA direct debit allows you to pull money via IBAN (+ BIC, depending on the countries involved in the transaction). Specifics vary from country to country. Some require active approval from the customer (IIRC France, probably more), others "just work". Fraud is not as common, since bank accounts that are allowed to debit money this way are generally only available to companies who have to sign paperwork ensuring that they have written permission from each debitor. Additionally, although this might be country-specific as well, chargebacks can be initiated without providing any reason for at least 8 weeks, and in case of a fraudulent transaction, up to 13 months.

vjvj 11y ago

Wow. I had a similar experience with Skype too. They couldn't care less that someone had got access to my account and made calls. The attacker even added his own mobile number (in a different country) but Skype wouldn't bother investigating or escalating...

EGreg 11y ago

This article has taught me a valuable lesson: I should be using the email+suffix@gmail.com feature in each service I'm signed up for. Seems like an easy enough change. Ideally, the suffix would be some non obvious function of the service name, which I can remember easily. Like taking the second letter of the service name and relating it to an object I encounter a lot in my life.

Nemant 11y ago

Somebody should try getting Jeff bezos' address. I tried a couple of times and failed.

rplnt 11y ago

> migrating as much to Google services which seem significantly more robust at stopping these attacks. Because they don't have customer support?

vgt 11y ago
Because 2FA

yomly 11y ago

Someone's life in Amazon is about to become a world of pain. This is not going to be a fun Jeff B escalation...

facepalm 11y ago

I find it a bit weird that address and even credit card number are confidential information. Credit card numbers are not really secret, you hand them out to random waiters in random restaurants. Maybe part of the fault lies with the other companies who accept that information as ID?

BaNzounet 11y ago

A possible solution to avoid people finding out the email you're using for a given service is to dump random word/phrase in your email address. e.g. email+ifidontknowthisthisisnotme@youremail.com Not sure how an agent would react to someone having part of the correct email though.

fredwu 11y ago

It is rather unfortunate yet at the same time unsurprising. :( Two years ago I found out that Amazon allows multiple accounts to be set up using the same email address with different passwords (!!!) - which means that the potential attack vector is larger for no good reason. I don't recall how this happened but I can only assume at the time I signed up to AWS and I might have reset/changed the password somehow that resulted in the system creating another copy of my account. So all the information (credit cards, addresses, etc) of the "old" account still existed until I deleted them. But let's say if someone who has no idea that they have more than one accounts with Amazon, they could easily leave their information intact in their "old" accounts, which if they have weak passwords can easily be compromised. Unfortunately Amazon did not take this report seriously, and to this very day this issue still persists.

sleepychu 11y ago
My email address also maps to two unique accounts. One of them has never had any information on it anyway but I agree it's very concerning.

ommunist 11y ago

Same sh#t happens with Apple Support all the time, for few years in a row. Someone was after my last 4 digits, requesting password resets to Apple ID, like 14 times a day, and then impersonating me, talking to support.

virusduck 11y ago
Did you activate 2FA?
- ommunist 11y ago
  After that I did. And I was so much surprised, Apple delays 2FA activation for a week! 'to be sure that you are you'

krampian 11y ago

I'm concerned that names and addresses alone seem to be enough for these guys to do meaningful ID theft with. The phone book is full of names and addresses anyone can get their hands on easily. Even these guys in India - there's whitepages.com. Not sure why they're going to all the trouble of trying to game Amazon's customer support. On that note, I order alot from Amazon and throw out their boxes in the trash outside all the time. Sometimes I notice that neighbors (presumably) take those boxes for their own use before trash pickup comes along. All of them have my name and mailing address on them...

AndrewUnmuted 11y ago

I worked for Amazon for four years. For nearly the entire time I worked there, I, as an engineer, had access to every customer's purchase history, contact information, email addresses, etc. The reason? On occasion, I'd need to get a user's email address to reach out to them if they reported bugs. The one service that offers employees this access is all or nothing. Either you get to see a customer's email, credit card number, and purchase history - or you get to see nothing at all. Everyone knew that I had this access, and everyone knew that it was against Amazon's own policy to give me access. But to them, that was easier than fixing the service so that it was more useful. Perhaps I'm just clueless, but something tells me that any relevant competitor to Amazon - say, I don't know, Google - would choose to fix the service instead.

0xffff2 11y ago
>Perhaps I'm just clueless, but something tells me that any relevant competitor to Amazon - say, I don't know, Google - would choose to fix the service instead. Why? The attitude you describe (do what's easy, not what's right) is endemic to any organization over a certain size in my experience.

leeleelee 11y ago

I think the best solution, for now, is to just regularly check your full credit report for anything you don't recognize and watch your credit card, debit card statements for any purchases you don't recognize. I've had credit cards get compromised in the past, and it was actually quite painless to have my bank (Chase) shut the card down and issue a new one. Your information can be stolen from SO MANY sources and not just Amazon customer service. It's impossible to guarantee who sees any of your personal information once you share it with ANYONE on the internet (Amazon, Google, some random retailer, domain registrar, etc.). The server at your local Applebees could steal your CC info. Be sensible with where you share personal information, but don't be unreasonable. It's safe to use Amazon. Just watch your credit report (regardless of whether you feel you're at high risk) and bank statements. If/when a problem arises, then deal with it.