As a security conscious user who follows the best practices—using unique passwords, two-factor authentication, only using a secure computer, and being able to spot phishing attacks from a mile away—I thought my accounts and details would be pretty safe. I was wrong.
That's because when someone went after me, all those precautions were for nothing. That’s because most systems come with a backdoor called customer support. In this post I’m going to focus on the most grievous offender: Amazon.com. Amazon.com was one of the few companies I trusted with my personal information. I shop there, I am a heavy AWS user (raking up well over $600/month), and I used to work there as a software developer.
My story began with a rather innocuous e-mail:
At first, I assumed it might be a mistake or a delayed e-mail from the time I contacted them months earlier. But curiosity got the better of me, and I contacted Amazon to ask what this was about. They told me that I had a conversation with Amazon support. It was a text chat, and they e-mailed me a transcript:
Let's stop right there, so I can point out the address isn’t mine. It’s just a fake address of a hotel that was in the same zip code where I lived. I used it to register some domains, knowing that whois information all too often becomes public. I used the same general area where I lived so that my IP address would match up with it.
So, wow, the attacker gave Amazon my fake details from a whois query and got my real address and phone number in exchange. Now they had enough to bounce around a few services, even convincing my bank to issue them a new copy of my credit card.
Trying very hard to not take out my frustrations on an unrelated support rep, I contacted both Amazon Retail and AWS. I expressed my disappointment and asked them to put a note on my account—it is at extremely high risk of social engineering and I will always be capable of logging in. Amazon Retail said they would make that note and have a specialist contact me (who never did) while AWS was dismissive of a risk even existing.
Fast forward a couple of months, I made the big mistake of thinking the risk was gone. I gave Amazon my fresh credit card and new address details. I received another e-mail.
Once again, I contacted Amazon support to see what happened. This time I had the pleasure of dealing with a support agent who seemed 100 percent incapable of realizing that someone was impersonating me. I had trouble keeping my composure when he told me I should change my password to prevent people impersonating me. Eventually I had to basically tell him that it was “me” that contacted support and I wanted “my” transcript, which he provided.
Next, the attacker unsuccessfully tried to get the last four digits of my credit card:
I should count my blessings that Amazon didn’t give the last digits of my credit card. I again contacted Amazon to reiterate how important it is that they keep my account secure and not give out my details to anyone with a name and address. They promised to put a note on my account and said it’ll never happen again. Amazon also told me that I would be contacted by a specialist (which never happened, again). This time, however, I decided I can no longer trust Amazon with my address. I deleted it from my account.
Fast forward another day:
This time, I couldn't get a transcript of the conversation. The attacker contacted Amazon by phone, but the company couldn't give a recording to me. Despite all my efforts, I had to assume the attacker finally got the last digits of my credit card.
In total, Amazon completely betrayed my trust three times. I did absolutely everything in my power to secure my account, but it was hopeless. Today, I am in the process of closing my Amazon account and migrating as much as I can to Google services, which seem significantly more robust at stopping these attacks.
After being the victim of these attacks for months, all I'm left with are a few recommendations to offer these services going forward:
- NEVER DO CUSTOMER SUPPORT UNLESS THE USER CAN LOG IN TO THEIR ACCOUNT. The only exception to this would be if the user forgot the password, and the company should have a very strict policy. The problem is that 9999 times out of 10000 support requests are legitimate, and agents get trained to assume they’re legitimate. In the one case they’re not, legitimate, you're putting that user at a huge risk.
- Show support agents the IP address of the person connecting. Is it a usual one? Is it a VPN/tor address? Warn agents to be suspicious.
- E-mail services should allow me to easily create lots of aliases. Right now the best defense against social engineering seems to be my fastmail account, which allows me to create one e-mail address alias per service. This makes it incredibly difficult for an attacker when they can’t even figure out your e-mail.
- Please make whois protection the default. Mine leaked because a stupid domain I didn’t care about had its namecheap whois protection expire.
For users, continue to be extremely careful with information you share. Even big companies like Amazon can’t keep it safe.
This post was originally published on Medium and has been reposted here with the author's permission. It has been lightly edited to adhere to house style.
reader comments
140