2

My wife's Amazon account was hacked yesterday. She discovered the purchases, changed her password to both gmail and Amazon, and enabled Amazon's 2-step verification (2FA) through SMS on her phone and figured the matter was done. However 3 times now the malicious actor has disabled Amazon's 2SV without her receiving a single text from when they are logging in. Amazon also seems to require providing a OTP when attempting to change any security settings, including disabling 2SV. The last of these occurred overnight while her laptop was shut and presumably asleep. Amazon does send e-mails stating that 2SV has been disabled, but that is her only warning that fraudulent purchases are about to start again.

She's completely on the Apple ecosystem with only a MBP and an iPhone 11 which are behind a Unifi firewall with no ingress allowed to those machines. I don't see any malicious processes running on her MBP, and she has not installed anything recently that did not come from the App Store, and her phone is definitely not jailbroken. I can't completely rule out something running on either her physical devices, but it seems unlikely.

How is someone able to disable Amazon's 2FA without the specified 2FA device receiving ANY notification? I feel like I've ruled out everything except someone with physical access to Amazon's systems which seems crazy. Is there something I'm missing? Something else I should try?

Edit: On recommendation of another website we disabled SMS 2FA and switched it to voice. Less than an hour later it was disabled again. I'm completely stumped.

Edit 2: We finally had Amazon fully disable my wife's account. She received an e-mail stating that to re-enable the account, she would need to call a number and speak to a live representative. Sometime during the night the hacker got her account re-enabled (unsure if they actually talked to someone) and resumed making fraudulent purchases. They still have not bothered to change her e-mail address (which is odd!) but when re-enabling the account they changed the password so we're truly locked out at the moment.

Because we never logged in, it rules out a leaked session token, but it's still possible that her MacBook was being remotely controlled in the middle of the night. I was not logging any network traffic thinking it wasn't needed while the account was disabled.

  • 2
    AFAIK the answer is currently unknown. Of course Amazon's fraud detection could be a lot better - it's unlikely that a customer will change the email address in the middle of the night and immediately purchase something. Some cool down period could work wonders. – Martin Schröder Jun 9 at 17:27
  • 1
    @AnthonyGrist We contacted Amazon and they were mostly unhelpful but finally locked her account for 48 hours which we wanted. At this point they hackers are only stealing from Amazon because I had my wife remove all credit cards from her account. The hacker has been "returning" items we've legitimately bought, getting an instant refund gift card and spending that balance. – Mordred Jun 9 at 19:18
  • 1
    @user Well the protection against that should be the 2FA. Assuming there is a keylogger, they'd have to first control her device to disable 2FA from Amazon there and then sign in on a remote device. – Mordred Jun 9 at 19:30
  • 1
    From what @AnthonyGrist was saying, it doesn't look like Amazon's 2FA is working like a typical 2FA. It's possible that the "don't require 2FA on this browser" option persists through password and 2FA changes as well. – user Jun 9 at 19:35
  • 1
    Update: The hackers were able to get my wife's disabled account re-enabled, which according to the e-mail she got last night, supposedly required actually talking to someone at Amazon on the phone. They've also changed the password to something else and so we're truly locked out at the moment, although they didn't bother changing her e-mail address so she's still getting purchase notifications. It's unclear if the account was re-enabled from her computer (using a C&C server?) as I didn't have network logging turned on since her account was already disabled. – Mordred Jun 10 at 17:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.