7 ms·

How to stop this: 1. Get a friend's permission to "hack" into his Amazon account (or "hack your own account"). 2. Contact Amazon's customer service, try the s

by mrb 11y ago

How to stop this: 1. Get a friend's permission to "hack" into his Amazon account (or "hack your own account"). 2. Contact Amazon's customer service, try the same social engineering techniques that the OP documented. 3. Once you obtain some sensitive information from the account, scare the CS rep by saying: "Haha! I am actually not the customer. I am a journalist/hacker/whatever and wanted to see how easy it was to social engineer information out of your customer service department, and you failed. I would like to talk to your manager please." Hopefully if enough people do this, it will get some internal attention at Amazon.

umanwizard 11y ago
So, commit criminal fraud to prove a point? Bad idea.
- q3k 11y ago
  If there is written, explicit permission to perform this attack, how is it different from a corporate penetration test?
  - bigiain 11y ago
    Amazon hasn't given permission. I suspect they'd be quite unhappy. Having said that, I personally think they ought to expect it, and be responsible for whatever failings it discovers.
- oh_sigh 11y ago
  How is it fraud if you have permission from the account owner to try and access it?
  - umanwizard 11y ago
    Fraud against Amazon, not the account owner.
    - Karunamon 11y ago
      Fraud requires personal or financial gain. This doesn't seem to apply.
      - amag 11y ago
        Well, you may gain increased security on your Amazon account..
driverdan 11y ago
If any journalist is interested in trying contact me (email in profile) and I will give you permission to use my account.
pkaye 11y ago
I think there is already enough here to shame Amazon into action if it gets on a major newspaper. Something like "Hackers break into Amazon account and Amazon will not do anything" Perhaps the Washington Post would be a good newspaper with credibility.
- mtgx 11y ago
  Not sure if you were being sarcastic or not, but Jeff Bezos bought Washington Post...
  - larrymcp 11y ago
    oh, whoops...
- madeofpalk 11y ago
  This already happened to Matt Honan back in 2012, where the hacker used social engineering on both Amazon and Apple to take over his twitter handle (oh and also wiping all his devices via iCloud). http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ It looks like both Amazon and Apple have fixed _some_ issues since then - Amazon is no longer leaking last 4 digits, but instead they're still leaking other info. Apple now requires more information to reset accounts and to wipe devices.
  - ascagnel_ 11y ago
    Apple set up 2FA for certain actions (changing passwords, adding or removing devices from an account, etc); Amazon has yet to do anything related to 2FA for normal customer accounts.
    - ptha 11y ago
      2FA is now available for Amazon customer accounts: http://betanews.com/2015/11/18/how-to-enable-two-factor-authentication-on-your-amazon-account/ http://betanews.com/2015/11/18/how-to-enable-two-factor-auth... The option is only (at the moment) available for Amazon.com accounts, but if you enable it there is will also be turned on for other domains Amazon.co.uk etc.
fnbr 11y ago
Please don't do this. You're much more likely to get your friend in trouble with Amazon and have the police called on you.
- zymhan 11y ago
  You think Amazon wants to arrest it's customers because they shared account information?
- Salgat 11y ago
  How do they know who did it though?
- 0xffff2 11y ago
  Have the police called on you for what, exactly?
  - zymhan 11y ago
    Stealing free shipping. You monster.
alpb 11y ago
> Hopefully if enough people do this, it will get some internal attention at Amazon. This is very smart, why has no one thought of this before? When people post it on Medium and share it on HN/Reddit it will not get enough internal attention at Amazon for sure. So let's do something totally stupid which could easily get us in trouble with the law enforcement to make a shitty point to Amazon so that they can notice something is wrong on their end.
pjc50 11y ago
4. Get arrested
- vanzard 11y ago
  Given Amazon's history to NEVER involve law enforcement in outrageous cases like https://news.ycombinator.com/item?id=10966164 https://news.ycombinator.com/item?id=10966164 or even the OP, I doubt you would get arrested.
adam12 11y ago
There is no point in getting a friend involved. Just see how much sensitive data Amazon will give you without giving them any of your login credentials.

by mrb 11y ago

umanwizard 11y ago

So, commit criminal fraud to prove a point? Bad idea.

q3k 11y ago
If there is written, explicit permission to perform this attack, how is it different from a corporate penetration test?
- bigiain 11y ago
  Amazon hasn't given permission. I suspect they'd be quite unhappy. Having said that, I personally think they ought to expect it, and be responsible for whatever failings it discovers.
oh_sigh 11y ago
How is it fraud if you have permission from the account owner to try and access it?
- umanwizard 11y ago
  Fraud against Amazon, not the account owner.
  - Karunamon 11y ago
    Fraud requires personal or financial gain. This doesn't seem to apply.
    - amag 11y ago
      Well, you may gain increased security on your Amazon account..

driverdan 11y ago

If any journalist is interested in trying contact me (email in profile) and I will give you permission to use my account.

pkaye 11y ago

I think there is already enough here to shame Amazon into action if it gets on a major newspaper. Something like "Hackers break into Amazon account and Amazon will not do anything" Perhaps the Washington Post would be a good newspaper with credibility.

mtgx 11y ago
Not sure if you were being sarcastic or not, but Jeff Bezos bought Washington Post...
- larrymcp 11y ago
  oh, whoops...
madeofpalk 11y ago
This already happened to Matt Honan back in 2012, where the hacker used social engineering on both Amazon and Apple to take over his twitter handle (oh and also wiping all his devices via iCloud). http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ It looks like both Amazon and Apple have fixed _some_ issues since then - Amazon is no longer leaking last 4 digits, but instead they're still leaking other info. Apple now requires more information to reset accounts and to wipe devices.
- ascagnel_ 11y ago
  Apple set up 2FA for certain actions (changing passwords, adding or removing devices from an account, etc); Amazon has yet to do anything related to 2FA for normal customer accounts.
  - ptha 11y ago
    2FA is now available for Amazon customer accounts: http://betanews.com/2015/11/18/how-to-enable-two-factor-authentication-on-your-amazon-account/ http://betanews.com/2015/11/18/how-to-enable-two-factor-auth... The option is only (at the moment) available for Amazon.com accounts, but if you enable it there is will also be turned on for other domains Amazon.co.uk etc.

fnbr 11y ago

Please don't do this. You're much more likely to get your friend in trouble with Amazon and have the police called on you.

zymhan 11y ago
You think Amazon wants to arrest it's customers because they shared account information?
Salgat 11y ago
How do they know who did it though?
0xffff2 11y ago
Have the police called on you for what, exactly?
- zymhan 11y ago
  Stealing free shipping. You monster.

alpb 11y ago

> Hopefully if enough people do this, it will get some internal attention at Amazon. This is very smart, why has no one thought of this before? When people post it on Medium and share it on HN/Reddit it will not get enough internal attention at Amazon for sure. So let's do something totally stupid which could easily get us in trouble with the law enforcement to make a shitty point to Amazon so that they can notice something is wrong on their end.

pjc50 11y ago

4. Get arrested

vanzard 11y ago
Given Amazon's history to NEVER involve law enforcement in outrageous cases like https://news.ycombinator.com/item?id=10966164 https://news.ycombinator.com/item?id=10966164 or even the OP, I doubt you would get arrested.

adam12 11y ago

There is no point in getting a friend involved. Just see how much sensitive data Amazon will give you without giving them any of your login credentials.