Amazon shuts social engineering hole

Powered by SC Magazine
 

Phone call no longer enough.

Amazon will no longer allow people to change credit card and email addresses for customers' accounts over the telephone, after a devastating hack on a journalist last week.

Wired reported that Amazon had quietly changed its policy on Monday.

Before the change, people could change account details as long as they were able to identify themselves by name, email address and mailing address.

Those pieces of information are easily found online, and were used by two hackers to gain access and take control of reporter Mat Honan's Amazon account through a simple phone call.

Once the Amazon account had been compromised and hackers knew the last four digits of his credit card number, they were able to trick Apple's customer service into believing they were dealing with Honan himself.

In the ensuing hack, the attackers remotely wiped Honan's laptop, iPad and iPhone, losing irreplacable data. His Twitter account was also compromised, along with a number of email accounts.

"In the space of an hour, my entire digital life was destroyed," Honan said in the aftermath of the attack.

According to Honan's account of the hack, those involved in the attack had purely used social engineering techniques — convincing people to hand over key information — rather than any technical hacks.

Honan and Wired were able to replicate the steps leading to the hack up until Tuesday, when Amazon closed the security hole without announcement.

Copyright © iTnews.com.au . All rights reserved.


Amazon shuts social engineering hole
 
 
 
Top Stories
Windows 10 lands in Australia
Campaign to get business to upgrade kicks off.
 
NSW to build its own myGov
Service NSW digital profiles available by September.
 
Android bug leaves a billion phones open to attack
Hackers only need phone number to target devices.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Should law enforcement be able to buy and use exploits?



   |   View results
Yes
  14%
 
No
  51%
 
Only in special circumstances
  17%
 
Yes, but with more transparency
  18%
TOTAL VOTES: 771

Vote