4 ms·

We have had this at Amazon AWS. We had 2FA, one phone call was enough to disable 2FA. The only thing they asked were the last four digits of our credit card.

ruffrey 10y ago
That is a little unnerving if true.
- infinite8s 10y ago
  A reporter at Wired had his digital life destroyed (including personal mac wiped) by social engineering, using little more than info from one account (last 4 digits of credit card from Appstore account) to socially engineer Amazon customer support - http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ Edit. Had some details wrong. It was a reporter at Gizmodo, and basically a collection of data was gathered from various online services (mailing address, last 4 digits of CC) to ultimately social engineer his Apple account and remote wipe his computer. A number of factors were involved, but ultimately he was done in by not having 2FA on google, and not backing up his machine.
- pilom 10y ago
  Just confirmed with our CTO. He was able to turn MFA off on our root AWS account over the phone.
  - mr_luc 10y ago
    Huh. I'm going to say thanks to HN, and this comment chain, for bringing this to light. That seems kind of insane.
    - deleted 10y ago
      [deleted]
    - brazzledazzle 10y ago
      Maybe it's time for Amazon to decouple AWS accounts from Amazon shopping accounts.
      - arviewer 10y ago
        I think you can do that yourself, although it probably means that you need two credit cards.
        brazzledazzle 10y ago
        I mean from a system level perspective. The trouble is that they have policies that are optimized for people shopping on a site with a money back guarantee not for hosting critical infrastructure.
toomuchtodo 10y ago
Too bad you can't ask for the CVV code, and run a dummy $1 transaction. Anyone could have the last four of the card number, but the person is much more likely to have the card itself with the CVV. Disclaimer: I use AWS extensively. Please do this.
- Declanomous 10y ago
  Call 1: "Hey, we just got a new credit card, can you put it on our account?" Call 2: "I just locked myself out of the account, can you reset it for me."
  - deleted 10y ago
    [deleted]
  - toomuchtodo 10y ago
    If you're using the payment method as auth, you should be locking it out as an auth method for X days after a change has been made, and emailing/SMSing the contact regarding the change.
nommm-nommm 10y ago
Yeah, that's the only thing amazon seller support asks me for verification as well. Either last 4 of credit card or last 4 of bank account - which is even stupider - anyone who you wrote a check out to has your bank account number.
bripeace 10y ago
Lastpass will let you remove 2FA using the attached email address. I do not believe it requires you to enter codes from the 2FA to disable. It makes me uncomfortable despite my email having two factor.

ruffrey 10y ago

That is a little unnerving if true.

infinite8s 10y ago
A reporter at Wired had his digital life destroyed (including personal mac wiped) by social engineering, using little more than info from one account (last 4 digits of credit card from Appstore account) to socially engineer Amazon customer support - http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ Edit. Had some details wrong. It was a reporter at Gizmodo, and basically a collection of data was gathered from various online services (mailing address, last 4 digits of CC) to ultimately social engineer his Apple account and remote wipe his computer. A number of factors were involved, but ultimately he was done in by not having 2FA on google, and not backing up his machine.
pilom 10y ago
Just confirmed with our CTO. He was able to turn MFA off on our root AWS account over the phone.
- mr_luc 10y ago
  Huh. I'm going to say thanks to HN, and this comment chain, for bringing this to light. That seems kind of insane.
  - deleted 10y ago
    [deleted]
  - brazzledazzle 10y ago
    Maybe it's time for Amazon to decouple AWS accounts from Amazon shopping accounts.
    - arviewer 10y ago
      I think you can do that yourself, although it probably means that you need two credit cards.
      - brazzledazzle 10y ago
        I mean from a system level perspective. The trouble is that they have policies that are optimized for people shopping on a site with a money back guarantee not for hosting critical infrastructure.

toomuchtodo 10y ago

Too bad you can't ask for the CVV code, and run a dummy $1 transaction. Anyone could have the last four of the card number, but the person is much more likely to have the card itself with the CVV. Disclaimer: I use AWS extensively. Please do this.

Declanomous 10y ago
Call 1: "Hey, we just got a new credit card, can you put it on our account?" Call 2: "I just locked myself out of the account, can you reset it for me."
- deleted 10y ago
  [deleted]
- toomuchtodo 10y ago
  If you're using the payment method as auth, you should be locking it out as an auth method for X days after a change has been made, and emailing/SMSing the contact regarding the change.

nommm-nommm 10y ago

Yeah, that's the only thing amazon seller support asks me for verification as well. Either last 4 of credit card or last 4 of bank account - which is even stupider - anyone who you wrote a check out to has your bank account number.

bripeace 10y ago

Lastpass will let you remove 2FA using the attached email address. I do not believe it requires you to enter codes from the 2FA to disable. It makes me uncomfortable despite my email having two factor.