Amazon Quietly Closes Security Hole After Journalist’s Devastating Hack

http://www.wired.com/gadgetlab/2012/08/amazon-changes-policy-wont-add-new-credit-cards-to-accounts-over-the-phone/

by sciwiz • 14 years ago

120 38 14 years ago

I would like to see a customer service/tech support org where customers have to enter their 2-factor PIN at a phone menu before reaching a human support agent. You could possibly combine that with caller ID for better verification - basically use phone # like a username and the PIN as password.

Or you could just use them alongside other verification steps.

drewinglis• 14 years ago

You would also need to enter your username or email address, though, and that's hard to do over the phone... I guess voice-to-text is improving, so that might be an option.

pavel_lishin• 14 years ago

You don't have to actually enter your email address, you just have to prove that you know it - and telephones have the full alphanumeric set of characters on the keypad. Use a * or # for special characters, and something like "pavel@lishin.org" could be entered as "72835#547446#674".

Edit: I guess that may not be sufficient to identify you, but it could verify that you are the account holder for other services.

ars• 14 years ago

Voice to text works fine for limited input. So if all you needed was the letters of the alphabet (rather than words) it works pretty well.

LoganCale2• 14 years ago

What if they've had their mobile phone stolen and can't do 2-factor auth and that's why they're calling?

laconian• 14 years ago

Security traded for convenience, back to square one.

Wingman4l73• 14 years ago

Isn't this scenario why Gmail's 2-factor authorization gives you a set of one-time passwords?

jrockway• 14 years ago

BofA does this for teller transactions. To talk to a teller, you have to swipe your debit card and type your PIN. While not foolproof, I think it's a pretty nice security measure.

Osiris2• 14 years ago

If you don't have your card with you, however, you can provide photo ID and they'll look up your account number. I suppose it would be possible to provide a forged photo ID to gain access to someone's account.

kellyhclay• 14 years ago

GoDaddy essentially does this - but you have to give the human the PIN. Also, most banks do this as pointed out (fwiw, I bank with USAA and I have to call from a registered phone number and enter a pin before reaching a human.)

brudgers2• 14 years ago

This is the only possible response after the "exploit" was published. Amazon's process was appropriate for their business, and the problems the journalist experienced were due solely to the level is security Apple chose to implement and their decision to allow remote wiping of people's Macbooks.

This is only a story because of Apple's of operational decisions. The information required to game their system could have come from a myriad of sources other than Amazon.

Osiris2• 14 years ago

I disagree that Amazon's processes were 'appropriate'. Being able to gain access to someone's Amazon account with such basic information can be a big problem.

I know a guy that's a huge amazon seller and he says there are Amazon sellers often with upwards of $100,000 in their accounts on Amazon before pulling the cash out. If someone were able to gain access to a seller account (I'm not sure if this 'exploit' would have worked for a seller account or not), that could have been quite financially painful for some people.

Wingman4l73• 14 years ago

Why are they leaving so much in their accounts? Amazon is not a bank, and as such they're probably not subject to the same regulations. We've already seen this issue with people leaving too much money in winnings in online poker accounts, or PayPal accounts.

mattacular2• 14 years ago

Leaving that amount of money anywhere other than in an FDIC insured bank is incredibly irresponsible. Arguably as irresponsible as Apple's decision to require the last 4-digits of a credit card to gain access to iCloud, where a malicious intruder could arguably do way more damage, on average.

I could walk up to an ATM behind someone and get the last 4 of their card all day long. It is printed on every single receipt you've ever gotten.

brudgers2• 14 years ago

I suspect that Amazon has behavioral metrics to back up their visible security measures. Not to mention that Amazon also relies on the scrutiny of each transaction by the financial institutions issuing credit cards. Had the person taking over the account changed shipping addresses and ordered expensive merchandise, I strongly suspect that Amazon and/or the credit card companies would have been alerted.

The absence of any sort of backup measures at Apple allowed a lost password access followed immediately by the wiping of three devices to go entirely unnoticed. It's not just the lack of rigor Apple implemented in the password recovery process, it's that that is all there was. Apple didn't defend in depth at all - there was just one call center employee between the black hat and mischief.

einhverfr3• 14 years ago

The question is what info you can change by calling. Can you change the destination account for payments?

The thing is that Amazon's previous risk assessment was probably about what sort of harm could be done directly with the info provided. Now they are worried about what can be done through other providers that will bring them bad press.

arrrg3• 14 years ago

How is easily being able to gain access to an Amazon account in any way appropriate?

The concrete problem the journalist experienced was mostly due to the level of security Apple chose, sure, but that’s only because the hacker chose not to exploit being able to access the Amazon account.

The problem with Amazon is not that they give out the last four digits of the credit card. The problem is that you can access anyone’s account.

josteink• 14 years ago

The problem with Amazon is not that they give out the last four digits of the credit card. The problem is that you can access anyone’s account.

Amazon: You can access the account. And like order Hello kitty plush toys in someone else's name.

Apple: You can access the account. Then possibly remote-wipe all data belonging to whoever owns that account, data which may or may not be recoverable.

There is a slight difference. Apple has a much bigger responsibility here. Amazon is just responding because this is bad press, and they are basically covering Apple's ass here.

Apple, as per usual, has a shitty security record. Unless Microsoft, they haven't learned that security is a something which has to be baked in at the root of your products and services. It needs to be there from the start and isn't something which can be tacked on later.

For a short time, Apple was ahead of Microsoft in security because its OS was based on Unix-roots. Now they've built so many systems on top of that, and we can clearly see that Apple itself has no concept about security. Apart, ofcourse, for DRMed media and its own walled iOS-gardens.

The only security Apple cares about is its own. I wonder when their Microsoft-moment will come and they realize they have a responsibility towards their customers security wise as well.

einhverfr3• 14 years ago

Another way to look at this is that the exploit was solely an emergent property of two different systems having different views on what constituted secret information. The issue was not necessarily that either one did something wrong, but rather that when you put them together, one could play off both their weaknesses to create a bigger one.

xtracto• 14 years ago

And this is not something new. Back in the days of ICQ and hotmail, it was trivial to "hack" someone's email account by filling in the required information to "recover your password" by using information users stored in ICQ (which usually included their email).

I remember searching for people with an @hotmail.com account in ICQ just to see if I could enter to see their emails. This was like, 15 years ago IIRC.

larrys• 14 years ago

For those not aware whenever a journalist uses the term "quietly" it equates to "didn't issue a press release" or post publicly in an announcement.

arrrg3• 14 years ago

Yeah, and? What else would it equate to?

Press releases and public announcements are how a company communicates. If a company changes something without communicating, they changed something quietly.

I’m not really understanding what point you are trying to make. What is there to misunderstand about that “quietly”?

jakeludington• 14 years ago

While they have closed the loophole for adding credit cards, you can apparently still change your email or password via phone: http://www.forbes.com/sites/kellyclay/2012/08/07/amazon-tigh...

nohat• 14 years ago

If you can change the email or password by phone, then nothing is solved. Adding the credit card was, as I understand, simply because amazon required a credit card number on the account (possibly last four digits).

davros• 14 years ago

Is it possible to prevent a remote wipe by Apple? Or at least so it is only possible with knowledge of my password? If I lose both my MBA and my password, I am ok with not being able to remote wipe.

EDIT: OK, I can disable remote wipe entirely by disabling 'find my mac'.

X-Istence• 14 years ago

It is only possible if you know your iCloud username and password.

Now the reason why the attacker was able to remote wipe is because he had the iCloud username and the newly generated password.

Amazon Quietly Closes Security Hole After Journalist’s Devastating Hack

Related Stories