5

My wife's Amazon account was hacked yesterday. She discovered the purchases, changed her password to both gmail and Amazon, and enabled Amazon's 2-step verification (2FA) through SMS on her phone and figured the matter was done. However 3 times now the malicious actor has disabled Amazon's 2SV without her receiving a single text from when they are logging in. Amazon also seems to require providing a OTP when attempting to change any security settings, including disabling 2SV. The last of these occurred overnight while her laptop was shut and presumably asleep. Amazon does send e-mails stating that 2SV has been disabled, but that is her only warning that fraudulent purchases are about to start again.

She's completely on the Apple ecosystem with only a MBP and an iPhone 11 which are behind a Unifi firewall with no ingress allowed to those machines. I don't see any malicious processes running on her MBP, and she has not installed anything recently that did not come from the App Store, and her phone is definitely not jailbroken. I can't completely rule out something running on either her physical devices, but it seems unlikely.

How is someone able to disable Amazon's 2FA without the specified 2FA device receiving ANY notification? I feel like I've ruled out everything except someone with physical access to Amazon's systems which seems crazy. Is there something I'm missing? Something else I should try?

Edit: On recommendation of another website we disabled SMS 2FA and switched it to voice. Less than an hour later it was disabled again. I'm completely stumped.

Edit 2: We finally had Amazon fully disable my wife's account. She received an e-mail stating that to re-enable the account, she would need to call a number and speak to a live representative. Sometime during the night the hacker got her account re-enabled (unsure if they actually talked to someone) and resumed making fraudulent purchases. They still have not bothered to change her e-mail address (which is odd!) but when re-enabling the account they changed the password so we're truly locked out at the moment.

Because we never logged in, it rules out a leaked session token, but it's still possible that her MacBook was being remotely controlled in the middle of the night. I was not logging any network traffic thinking it wasn't needed while the account was disabled.

Final Edit: We were able to talk to another Amazon rep on the phone, and had them disable the account. This time the account did not get re-enabled. Unsure if the hackers just gave up, or if they were unable to get reps to re-enable. We left it disabled for about 3 weeks, then called and had them re-enable the account. It's over a year later and we've had no issues since. Unfortunately no resolution, but I'm inclined to believe the hack was happening on Amazon's side.

Improve this question
22
  • 2
    AFAIK the answer is currently unknown. Of course Amazon's fraud detection could be a lot better - it's unlikely that a customer will change the email address in the middle of the night and immediately purchase something. Some cool down period could work wonders.
    – Martin Schröder
    Jun 9, 2020 at 17:27
  • 1
    @AnthonyGrist We contacted Amazon and they were mostly unhelpful but finally locked her account for 48 hours which we wanted. At this point they hackers are only stealing from Amazon because I had my wife remove all credit cards from her account. The hacker has been "returning" items we've legitimately bought, getting an instant refund gift card and spending that balance.
    – Mordred
    Jun 9, 2020 at 19:18
  • 1
    @user Well the protection against that should be the 2FA. Assuming there is a keylogger, they'd have to first control her device to disable 2FA from Amazon there and then sign in on a remote device.
    – Mordred
    Jun 9, 2020 at 19:30
  • 1
    From what @AnthonyGrist was saying, it doesn't look like Amazon's 2FA is working like a typical 2FA. It's possible that the "don't require 2FA on this browser" option persists through password and 2FA changes as well.
    – user
    Jun 9, 2020 at 19:35
  • 2
    Update: The hackers were able to get my wife's disabled account re-enabled, which according to the e-mail she got last night, supposedly required actually talking to someone at Amazon on the phone. They've also changed the password to something else and so we're truly locked out at the moment, although they didn't bother changing her e-mail address so she's still getting purchase notifications. It's unclear if the account was re-enabled from her computer (using a C&C server?) as I didn't have network logging turned on since her account was already disabled.
    – Mordred
    Jun 10, 2020 at 17:37

1 Answer 1

Reset to default
1

To be clear: this is a guess. However, it occurs to me that, running on the Apple ecosystem like that, there's one account which is in the security-critical path but which you did not mention checking the security of: your (wife's) Apple ID account. If the attacker got into that, then they could potentially use iMessage to access incoming SMS in real time, or get them from the phone on demand. They could also potentially delete them from the phone so you wouldn't know. I don't know if there's an equivalent for calls - I'm not primarily an Apple user - but it wouldn't surprise me. Breaching somebody's Apple ID account as a way to get access to their messages is a known attack pattern, and one of the reasons why SMS-based authentication is not very secure.

Improve this answer
1
  • That is an interesting theory, and one I don't remember investigating at the time. I haven't heard of the ability for someone else to receive your phone calls as well before, but maybe that's possible and could potentially explain some of the weirdness.
    – Mordred
    Nov 5, 2021 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .