Feeds

Amazon, despite denials, was warned about hack

Company 'spin' goes over the top

  • alert
  • submit to reddit

Seven Steps to Software Security

Exclusive A humiliating hack which resulted in four months of continuous credit-card data vulnerability for Amazon subsidiary Bibliofind, originally broken by the Wall Street Journal Tuesday, appears to involve fraud on more than one level.

Intruders downloaded the company's customer records, including their credit card details, names and addresses, over a four-month period during which Bibliofind claims, incredibly, that it remained ignorant of any wrongdoing.

"We have no information at this time to suggest that customers' credit cards have been misused," company spinmeister Jim Courtovich is quoted as saying.

The Register has reason to believe that Courtovich's statement, while painfully predictable, is misleading.

At least one merchant known to us experienced "a spate of credit-card fraud starting late last year," at just the time when Bibliofind's security breach began.

Items of between $1200-$2000 in value were bought with valid US credit cards and ordered "to be shipped mostly to eastern-European destinations."

Our sources, who requested that their identity be withheld, explained that their operations manager "got suspicious and phoned the cardholders concerned, who confirmed that they'd not placed any orders."

"We asked them if they shopped on-line anywhere else, as we suspected someone's database had been hacked. The only common link was Bibliofind," the source told us.

No good deed goes unpunished

The merchant dutifully contacted both Bibliofind and Amazon to warn them that they had trouble, and perhaps vainly hoping get a 'thank-you' in reply.

"The Bibliofind sysadmin seemed quite interested and mentioned that there was a possible security weakness within the system used by vendors to log in, although he understandably didn't give details," a second source continues.

So far so good, but "I then spoke with an Amazon sysadmin and the Amazon fraud department manager. I forwarded the details that I had collated and expected them to quietly close the hole."

"I was a bit put out to get an aggravated phone call from Amazon a few weeks later threatening legal action because I had discussed the [situation] with the card holders I had contacted. They insisted that there was no evidence that their site had been broken."

So much for one's good deed of the day. "I muttered a few appropriate words and left it at that," the disgusted merchant says.

"They had been made aware of this months ago, but have done absolutely nothing. We still get fraudulent orders, quite possibly from the same database," he added.

Lies, damned lies, and statistics

So how shall we reconcile Jim Courtovich's bold assertion that the company has "no information at this time to suggest that customers' credit cards have been misused," with what we've just learned? Is this pure ignorance? Or a bald-faced lie? Or Clintonesque hair-splitting akin to discriminating what the meaning of is is?

We'll take option three. We don't think Courtovich is an imbecile; and we rather expect he has better sense than to lie outright to the press, who make it their habit to test relentlessly the self-serving pronouncements of little PR bunnies like himself.

But if we assume that the information supplied to Amazon and Bibliofind by our merchant has since been discarded, then "we have no information at this time" becomes a quite true, if patently misleading, statement of which Slick Willie himself would no doubt be proud. ®

Previous Coverage

Amazon division hacked, thousands of CCs exposed

Mobile application security vulnerability report

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.