Amazon shuts social engineering hole

By on
Amazon shuts social engineering hole

Phone call no longer enough.

Amazon will no longer allow people to change credit card and email addresses for customers' accounts over the telephone, after a devastating hack on a journalist last week.

Wired reported that Amazon had quietly changed its policy on Monday.

Before the change, people could change account details as long as they were able to identify themselves by name, email address and mailing address.

Those pieces of information are easily found online, and were used by two hackers to gain access and take control of reporter Mat Honan's Amazon account through a simple phone call.

Once the Amazon account had been compromised and hackers knew the last four digits of his credit card number, they were able to trick Apple's customer service into believing they were dealing with Honan himself.

In the ensuing hack, the attackers remotely wiped Honan's laptop, iPad and iPhone, losing irreplacable data. His Twitter account was also compromised, along with a number of email accounts.

"In the space of an hour, my entire digital life was destroyed," Honan said in the aftermath of the attack.

According to Honan's account of the hack, those involved in the attack had purely used social engineering techniques — convincing people to hand over key information — rather than any technical hacks.

Honan and Wired were able to replicate the steps leading to the hack up until Tuesday, when Amazon closed the security hole without announcement.

Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

You must be a registered member of iTnews to post a comment.
| Register

Poll

How should the costs of Australia's piracy scheme be split?
Rights holders should foot the whole bill
50/50
ISPs should foot the whole bill
Government should chip in a bit
Other
Flash is heading towards its grave, and that's...
Great! Good riddance
Sad! Flash had some good qualities
Irrelevant. I don't care
What's Flash?
View poll archive

Whitepapers from our sponsors

What will the stadium of the future look like?
What will the stadium of the future look like?
New technology adoption is pushing enterprise networks to breaking point
New technology adoption is pushing enterprise networks to breaking point
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
The next era of business continuity: Are you ready for an always-on world?
The next era of business continuity: Are you ready for an always-on world?

Log In

Username:
Password:
|  Forgot your password?