Amazon shuts social engineering hole

Powered by SC Magazine
 

Phone call no longer enough.

Amazon will no longer allow people to change credit card and email addresses for customers' accounts over the telephone, after a devastating hack on a journalist last week.

Wired reported that Amazon had quietly changed its policy on Monday.

Before the change, people could change account details as long as they were able to identify themselves by name, email address and mailing address.

Those pieces of information are easily found online, and were used by two hackers to gain access and take control of reporter Mat Honan's Amazon account through a simple phone call.

Once the Amazon account had been compromised and hackers knew the last four digits of his credit card number, they were able to trick Apple's customer service into believing they were dealing with Honan himself.

In the ensuing hack, the attackers remotely wiped Honan's laptop, iPad and iPhone, losing irreplacable data. His Twitter account was also compromised, along with a number of email accounts.

"In the space of an hour, my entire digital life was destroyed," Honan said in the aftermath of the attack.

According to Honan's account of the hack, those involved in the attack had purely used social engineering techniques — convincing people to hand over key information — rather than any technical hacks.

Honan and Wired were able to replicate the steps leading to the hack up until Tuesday, when Amazon closed the security hole without announcement.

Copyright © iTnews.com.au . All rights reserved.


Amazon shuts social engineering hole
 
 
 
Top Stories
The True Cost of BYOD - 2014 survey
Twelve months on from our first study, is BYOD a better proposition?
 
Photos: Unboxing the Magnus supercomputer
Pawsey's biggest beast slots into place.
 
ANZ looks to life beyond the transaction
If digital disruptors think an online payments startup could rock the big four, they’ve missed the point of why people use banks, says Patrick Maes.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  29%
 
Application integration concerns
  3%
 
Security and compliance concerns
  28%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 1114

Vote