Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Compare cell phone plans using Wirefly's innovative plan comparison tool ×
Security

Amazon's Customer Service Backdoor (medium.com) 131

An anonymous reader writes: Eric Springer describes his recent troubles with Amazon to highlight one of the biggest weak points in information security: customer service. You can use complex passwords and two-factor authentication all you want — all it takes is a low-level representative trying to be helpful and your account information is now compromised. In this case, a bad actor was able to use Amazon's online chat support and a fake address to get the rep to tell him Springer's real address and phone number. That was enough to commit fraud with a couple of unrelated online services. Springer complained, but months later the same thing happened again. That time, he had Amazon put a note on his account not to give out his details.

But that didn't help; the attacker contacted Amazon's phone support line instead, and gathered yet more information. Springer writes, "At this point, Amazon has completely betrayed my trust three times. I have done absolutely everything in my power to secure my account, but it's hopeless. I am in the process of closing my Amazon account, and migrating as much to Google services which seem significantly more robust at stopping these attacks." Springer's advice for fixing this: "Never do customer support unless the user can log in to their account. The only exception to this would be if the user forgot the password, and there should be a very strict policy." He also says email services should make aliases easier, and whois protection should be default.

This discussion has been archived. No new comments can be posted.

Amazon's Customer Service Backdoor

Comments Filter:
  • Google... (Score:5, Interesting)

    by JasterBobaMereel ( 1102861 ) on Monday January 25, 2016 @09:49AM (#51365097)

    He thinks Google is more secure ... ?

    • Re:Google... (Score:5, Insightful)

      by ZiakII ( 829432 ) on Monday January 25, 2016 @09:51AM (#51365103)
      Well it's more like Google does not have Customer Service...
      • Re:Google... (Score:5, Interesting)

        by Anonymous Coward on Monday January 25, 2016 @10:58AM (#51365491)

        Well it's more like Google does not have Customer Service...

        Well, they do, sort of.

        A while back I ordered a nexus android phone direct from google for testing. I received the phone, my credit card was charged, I paid my credit card bill, and all was good.

        About 4 months later, I decided to buy another nexus android phone direct from google. I logged in to my account and bought another phone.

        A day later I get a rejection message that my account was suspended and to contact google. I call them, speak to someone (in the USA, judging by their accent). They explain that my account was suspended for security reasons, and they are transferring the call to their "security team".

        Their "security team" is based in the Philippines, and they told me my account was suspended for suspicious activity, and to reactivate the account I needed to upload scans of my driver's license and passport, otherwise they won't reactivate my account.

        Why does google flag this as a suspicious? I have no idea. If the initial order was fraudulent, I probably would have disputed the charge on my credit card instead of paying it months ago.

        After much back & forth with their Philippines call center and being escalated, they won't budge - provide scans of my driver's license and passport, or they won't sell me a phone.

        I told them to fuck off.

        • Re:Google... (Score:4, Insightful)

          by Shawn Willden ( 2914343 ) on Monday January 25, 2016 @11:17AM (#51365667)

          After much back & forth with [Google's] Philippines call center and being escalated, they won't budge - provide scans of my driver's license and passport, or they won't sell me a phone.

          You obviously aren't pleased by this, but this is actually evidence that Google's customer service is significantly more careful with your account than Amazon's customer service (per the article).

          • Re: (Score:2, Insightful)

            by Anonymous Coward

            You obviously aren't pleased by this, but this is actually evidence that Google's customer service is significantly more careful with your account than Amazon's customer service (per the article).

            How do you know ?

            No really, how do you know ?

            What the OP and I do see is that they ask for stuff that could be easily used to do exactly that what its supposed to be warding off: identity spoofing.

            In other words: that "helpdesk" (the higher management) is either as dumb as anything, or its actually an outfit to gai

            • Would you give some random joe a copy of the key to your house as proof that you're the actual resident ? Why not ?

              No because I have papers that show my residency. Every so often they are asked for. You can't expect a service that provides proof that you are you and then refuse to give them proof that you are you.

              Thanks but I'll stick with Google's approach.

      • Oh, they do, for paying customers. You know how the old quote goes: if you are not paying, then you are the product.
      • Well it's more like Google does not have Customer Service...

        Google does have customer service for any products that involve money. That's pretty much unavoidable. For free services, Google generally does not have customer service in the sense of people you can talk to, only online feedback forms which are largely unidirectional (you get no response).

        • Google Apps For Work has customer service. In order to get service, the user has to log into the account to obtain a PIN, which expires a set time after generation. This method mitigates the concern of a phishing attack.

        • Then how do I get support for severe slowdowns on my Nexus 7 (2012) 8 GB tablet purchased from the Google store, which started after I installed Lollipop?

          • Then how do I get support for severe slowdowns on my Nexus 7 (2012) 8 GB tablet purchased from the Google store, which started after I installed Lollipop?

            The 2012 Nexus 7 is out of warranty.

            • by tepples ( 727027 )

              You are correct that this particular device is out of warranty.

              But I have another question: Why do warranties on cellular devices tend to expire before the device would be paid off under the most common financing arrangement? Smartphones are often sold on a 24-month contract, yet not all are warranted for 24 months.

              • by KGIII ( 973947 )

                Where do you live? Just the State should do. Or, alternatively, look and see if you can find it yourself. I'll show you Maine's example:

                http://legislature.maine.gov/l... [maine.gov]

                Here's a good description from the AG:

                http://www.maine.gov/tools/wha... [maine.gov]

                See, specifically, 4 . 3 for a bit of a quick run-down. I'll quote it here:

                The implied warranty of merchantability is created by Maine law and means that the product will
                be fit for the ordinary purposes for which such products are used.6
                For example, washing machines
                must be fit for washing clothes. They must be able to do the job washing machines ordinarily do and to
                last for as long as washing machines ordinarily last.
                The same is true for toasters, new automobiles,
                mobile homes, clothing, furniture and every other item you purchase for family, household or personal
                use. To prove a breach of the implied warranty of merchantability you must show that the product was
                defective in design, materials, or workmanship.

                (Emphasis added and emphasis mine.)

                I have, in fact, used it for a cell phone that they said was no longer covered under warranty. Except, not really. What I did was contact the OEM for a repair. T

        • by KGIII ( 973947 )

          I was shocked, shocked I tell you, that I got a reply (some years ago) about a message I'd sent concerning their free email service. It was referencing a spam filtering issue, had a potential mechanism for improvement, and I was contacted several times for more information. No, I did not expect to get a response and yes, I am the only person that I know of who has ever had a response. I'm sure others have, I just don't know them. I've not even *read* about someone getting a similar response.

          However, they di

    • Regardless of one's opinion of Google's security - this isn't exactly an apples to apples move. It's not as if you go to google.com to buy light bulbs or towels directly from them. You can search on Google for other vendors that might sell them; but at that point you are dealing with dozens of other businesses in addition to Google.

      • He's talking about Amazon Web Services and Google Cloud Platform.

        There is a very small amount of overlap between Amazon Web Services support/accounts and Amazon.com support/accounts, but it is not entirely nonexistant (It is possible to be forwarded to the customer service team for one, after much cajoling / convincing that the other team exists at all, having first called the support team for the other. There is more overlap for Amazon Marketplace Web Services vs Amazon.com, though I have never experienced

    • He thinks Google is more secure ... ?

      Have you ever tried to get Google on the phone?

    • by KGIII ( 973947 )

      How does he know that the "attacker" used Amazon? Seriously, how did he figure that out? Did they actually confirm that this was how they had gotten his information? I can't imagine an attacker telling you how they did the attack unless you'd hired them to attack you - which might be the case but they didn't mention this and it's a bit hard to imagine that the attacker, if hired, would then go on to commit fraud. The whole thing seems a bit melodramatic and a bit like someone has jumped to conclusions.

      I gue

  • Never do customer support unless the user can log in to their account.

    Well, there's your problem. Most of the times I don't want to log in into an account, because:

    • Their site won't work at all with my security settings
    • I don't understand all the fields I have to fill on a foreign site.
    • I want some answers first before I give my privacy away.

    And if I want to abuse the system on purpose, I can always pretend to be a computer-illiterate old granny.

  • Is he sure? (Score:5, Insightful)

    by Junta ( 36770 ) on Monday January 25, 2016 @10:01AM (#51365155)

    While amazon screwed up here and enabled a social engineering attack:

    Google services which seem significantly more robust at stopping these attacks

    What is the evidence that he has to support this assertion? In his time at amazon, it seemed one party after some period of time started harassing amazon. Does he know that Google is more robust, or just that no one has gotten around to harassing him?

    Assuming google is more robust, is it because they are 'just plain better' or because Amazon is so retail-heavy that it's much more difficult for them to block such attacks without royally pissing off their bread and butter retail customers?

    It does surprise me that the support without logging in can do *anything* except help them reset their password. Resetting the password is more intrusive, though even this got notification sent to the legitimate account holder, so it wasn't a stealthy attack to begin with.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      While amazon screwed up here and enabled a social engineering attack:

      Google services which seem significantly more robust at stopping these attacks

      What is the evidence that he has to support this assertion?

      Google does not have customer service.

    • While amazon screwed up here and enabled a social engineering attack:

      Google services which seem significantly more robust at stopping these attacks

      What is the evidence that he has to support this assertion?

      ...because Google is intentionally near-impossible to contact as a user of their services? Do you have the phone number of Gmail Customer Support?

    • by Junta ( 36770 )

      I'm also surprised that they kept just saying what the last order was, rather than asking what the item was.

    • Google require all sorts of real documents as evidence and don't budget to hand waving and lip flapping, that's IF you can get them on the phone. They are known to have far worse customer service, and in this case great customer service (being overly helpful) can be bad.

    • by nnull ( 1148259 )
      The problem here is that Amazon is trying to really be helpful and resolve problems as quickly as possible. They do pretty well in this, but it seems they need more training in security precautions. I wouldn't go as far to cancel my Amazon account, time after time, Amazon has always refunded my money, refunded me for late deliveries, given me vouchers for even 1 hour late deliveries, supported me against a lousy vendor, etc etc. I even got an extra item that I didn't order that was worth $200 that they told
    • by brunes69 ( 86786 )

      Reasons Google is more secure:

      - Two Factor Authentication built into each and every service by default. Meanwhile you can't even enable two-factor for your AWS account, let alone your Amazon buyer account.

      - No "online chat" customer service. Google has a very simple customer service model - you either fill out a form and start an email case, or you enter a callback number and they phone you, or the service has no customer service whatsoever. I know of no Google service that has an online chat.

  • by Wycliffe ( 116160 ) on Monday January 25, 2016 @10:04AM (#51365165) Homepage

    Banking websites require 1 capital, 1 symbol, and 1 number in the password, doesn't allow you to use the back button and logs you out after 5 minutes but then allows you to reset your password by knowing your pet's name, your birthday, or some other ridiculously easy to find information. Yes, the password is usually sent to an email address but that email address doesn't have any of the same security, a person is always logged in, and usually has similar easy to crack password resets. Oh, and let's not forget that they won't actually allow you to opt out of the password reset or set it to something reasonable (like maybe most recent deposit combined with text message combined with a letter they mail out combined with credit card number)

    In the USA they recently rolled out "Chip and Pin" technology for credit cards but decided that "Chip and Pin" was too inconvenient so instead just made it "Chip" so that when/if they ever implement "Chip and Pin" they will have to retrain everyone a second time (aka won't happen anytime soon) It's not like people weren't already familiar with pins with debit cards. It would have been trivial to just add the pins on in one go.

    As long as we continue to operate on the premise that convenience is more important than security we are going to continue to have security problems.

    • There has to be a balance, however, or you risk rendering your service unusable. Nobody would buy anything online if the checkout process took 30 minutes, required a signed copy of your birth certificate from the doctor who performed the delivery, retinal scans from your grandparents and a full DNA workup.

      Unfortunately, you also have to work within the limits of security unconscious morons who use 'P@55w0rd' and think they're being leet computer techies.

      • by Anonymous Coward

        There has to be a balance, however, or you risk rendering your service unusable. Nobody would buy anything online if the checkout process took 30 minutes, required a signed copy of your birth certificate from the doctor who performed the delivery, retinal scans from your grandparents and a full DNA workup

        that sounds like what the pharmacy requires to buy the good cold medicine now.

    • by Anonymous Coward

      security is not convenient,
      and
      convenience is not secure.

    • by Anonymous Coward

      Don't use your real pet's name.

      For most of us very few people have access to a little book in a drawer at home, but lots of people might know or easily guess our real pets names, first school and so on. So make up false answers and write them down. I'm going to do that with a handful of example questions, I won't write these down because they're not real, if you're doing it for real, write them in a book and put it with your underwear, or whatever, somewhere that if you saw somebody looking there you'd know

    • In the USA they recently rolled out "Chip and Pin" technology for credit cards but decided that "Chip and Pin" was too inconvenient so instead just made it "Chip" so that when/if they ever implement "Chip and Pin" they will have to retrain everyone a second time (aka won't happen anytime soon)

      It's actually worse than that. They gave everyone cards with a chip, but the vast majority of retailers still require swiping the card. The terminals support reading the chip, but you can't use it even if you want to.

    • by nnull ( 1148259 )
      Convenience can be secure. The problem is that a lot of stores will not deal with fraud properly. They refuse to believe you or they'll simply ignore you. Security works two ways. A lot of places put security on the customer while the store does zero.
    • Banking websites require 1 capital, 1 symbol, and 1 number in the password, doesn't allow you to use the back button and logs you out after 5 minutes but then allows you to reset your password by knowing your pet's name, your birthday, or some other ridiculously easy to find information.

      This is exactly how I won a number of bets with friends of mine.

      "$5 says I can break into your Email account!"

      The best one (Worst?) was Myway Email. A small number of questions (Birthday, where do you live, pets name) and it gave me, in cleartext on the website, the password. That friend of mine admitted that password went to a LOT more than his Email.

      This was years ago and I would think things are more secure now, but perhaps not.

  • by Lumpy ( 12016 ) on Monday January 25, 2016 @10:15AM (#51365209) Homepage

    Back when Amazon.com had been in business for a few years I called their tech support to recover my password.

    They read the password to me over the phone. That means passwords at that time were not stored as a hash but as clear text in their database.

    • by rgbscan ( 321794 ) on Monday January 25, 2016 @12:15PM (#51366193) Homepage

      At the end of the 1990's I worked for one of the phone company "bells" that later became part of Verizon. At the time, customer service could pull up a webpage that had your account password as a field, but in display it was hidden with bullets (HTML input tag, type password IIRC). So all you could do was clear the field, type in a new password for the customer and click update. (The customer was then supposed to use that password to go online and change it to something else). Anyway, some technical support rep on customer service duty picking up an extra shift figured out you could just view that page's source and see the existing password in the clear, since it was the html tag obscuring it and not the database being hashed or anything. Well designed security there :-)

    • If you use Hostgator they still email you your billing portal password every time you change it. I have asked for them to change it or allow an optout, but they have said its a feature.
  • by Anonymous Coward

    There is a person in the UK that occasionally types in my email address for their Amazon UK account. Although they shouldn't do that, Amazon UK doesn't verify the email address by requesting a reply. As a result, Amazon UK reroutes all of the customers communication to me.

    In addition, it is almost impossible to contact Amazon UK without logging into the misdirected account (easy to do, since there is absolutely no check to a password reset requested other than to click the link on the email, and since the

  • a bad actor was able to use Amazon's online chat support and a fake address to get the rep to tell him Springer's real address and phone number. That was enough to commit fraud with a couple of unrelated online services

    Wait what?

    Public information, stuff that shows up in phone directories ("white pages" as we used to call 'em) was enough to commit fraud with some online services?

    Amazon may have a problem here -- there are many reasons that company should be burned down and the ground salted -- but think

  • Amazon has this amazing review site where you can post reviews of all the products and services. Just log in and post a scathing 1 star review.
    • by hawguy ( 1600213 )

      Amazon has this amazing review site where you can post reviews of all the products and services. Just log in and post a scathing 1 star review.

      Can you point me to the AWS review site? I'd like to read their reviews.

  • Shatner! (Score:5, Funny)

    by wonkey_monkey ( 2592601 ) on Monday January 25, 2016 @10:59AM (#51365511) Homepage

    In this case, a bad actor was able to use Amazon's online chat support and a fake address to get the rep to tell him Springer's real address and phone number.

    Shatner must be stopped.

  • by hawguy ( 1600213 ) on Monday January 25, 2016 @12:26PM (#51366291)

    Why would an IT professional use the same credentials for his AWS account as he does with his Amazon retail account? Just use a different email address for the AWS account (and not the email address that you've published on your business card, WHOIS, LinkedIn, etc). Either use a second email account just for AWS (they are free, you know?), or use an alias (i.e a gmail username+somespecialalias@gmail.com address)

    He likely uses is Amazon credentials in several different browsers, the Amazon App, Kindle App, perhaps an Amazon instant video viewer on his TV, an Amazon Kindle device, etc. He's trusting a lot of different consumer apps and devices to keep a secret that could affect his livelihood. Not to mention the problem he's complaining about -- customer service for a retail company that wants to make sure he gets his packages.

  • ...real address and phone number. That was enough to commit fraud with a couple of unrelated online services

    This is the problem... when the fuck does it make sense to regard that information as sensitive. In a sane world the companies that allow anonymous customers to set up an account with so little info and verification would be responsible for the fraud.

  • by SirDrinksAlot ( 226001 ) on Monday January 25, 2016 @01:28PM (#51366879) Journal
    Christmas before last I was the lovely new recipient of a brand new amazon account, that I didn't signup for. The problem starts with Amazon not validating email ownership and ends with Amazon not understanding how account ownership works. Some child with my same name was given a brand spanking new Fire HD for Christmas and a pile of Amazon gift certificates which they loaded up in short order, the mistake was made they maybe typoed their email address or they them self didn't understand that you don't inherently own yourname@emailprovider.com

    I tried to contact Amazon support and have them fix this problem with out ruining this kids Christmas. Amazon's response? No problem here with their processes, however I should give him my email address as far as they are concerned he owns my gmail account I've had since the closed gmail beta... After much arguing Amazon wasn't budging, I had already explained that gmail ignores dots in your address among other things, so u.ser@gmail.com u.s.e.r@gmail.com us.er@gmail.com, and user@gmail.com etc all are the same account but amazon will register individual accounts for them, my problem is I use a . in mine just for readability and spam identification and is how I have *MY* amazon account registered. Additional fun is anything after a + sign in your email gets ignored too, so you can use an email like user+is.the.CEO.of@gmail.com and it'll just send any email to that to user@gmail.com, maybe I could have used this and told them that this is not a gmail problem and they should fix it? This behavior on google's part is in my opinion: fantastic, it's an epic step on account security meaning someone else can't come along and pretend to be me just by adding or removing a dot from their email address. Blaming Google in this case was a weak attempt at avoiding responsibility.

    Long story short, Amazon didn't care that I could reset this kids password and buy whatever it is I wanted using it, as far as they were concerned this wasn't their problem. Here's amazon's official response I got before I escalated it to Jeff Bezos and spoke to the executive of customer relations (this is a thing by the way, anyone can do this)

    "Unfortunately, this is an issue that will need to be resolved by Google. We would normally be able to temporarily disable your account in order to sort out the email issues, as these issues can be caused by typos on another person's side. However, as this is not an email typo issue, we will not be able to resolve this issue ourselves. Samantha L"

    I would really like to know beyond handing over my account, what they think Google is going to do about it?
    • So, after you escalated what happened? I'm curious if Amazon has resolved that issue for @gmail.com accounts.
    • by ShaunC ( 203807 )

      It's frustrating how many services don't verify emails, they just run with whatever the user enters and blindly start sending out all sorts of account details and spam. I've had accounts set up using my email address for RBS bank, XBox, EA, Hilton hotels, the official job site for the European Space Agency, and probably three dozen dating sites. Most of this seems to be coming from one guy in Scotland who thinks my email address is his, and he enters it everywhere. I did take the time to send the bank an em

    • So, I looked up the SMTP RFC, and yeah, the "local-part" (as it is determined) is to be treated as opaque by everyone BUT the domain in the address. Meaning that everyone must treat the addresses differently regardless of how GMail or anyone else interprets the semantics...

      AND THEN, it turns out that while things are required to be case-insensitive, things are ALSO required to be case-sensitive. Basically, no one should ever assume that the local-part of the email address can be treated as caseless.

      So, ther

  • The first time, he makes a big deal about the address in question not being really his, but one he did use for WHOIS registration. I know there are people who have legitimate reasons for hiding their personal address when operating a controversial website, but the solution for that isn't to give a totally bogus address. Or maybe the CSA saw that it had been used as a "private" registration (not knowing it had been subsequently revealed) and assumed it was a relevant secret on that basis? And how is it's Am

  • Unfortunately if you fail to pay in Amazon the first thing they take away is your way to log in. :(

  • This advertisement paid for by Google.
  • For all of Apple's defiance of DOJ's requests for access to customer accounts, they did the same thing as Amazon a few years ago. I can't find the details right now but it involved a tech writer, he may have written for Wired. The hacker was able to access the guy's account very easily by providing very little real information. Years ago someone at Bell Canada was using my name as a reference for many new accounts. I kept getting calls from collection agencies asking if I knew such and such person. It was o

There is never time to do it right, but always time to do it over.

Working...