45
votes
Amazon let me place an order without me ever being asked for 3-D secure password
I just read my bank's page on 3D security. It says:
If the site supports payments to be made in additional security, you will see the logos of the respective card organization Verified by Visa or ...
- 979
45
votes
Amazon let me place an order without me ever being asked for 3-D secure password
Security measures like "3D password", CVV, etc. do not exist to protect you the cardholder. Do not assume that someone who lacks them can't use your card number fraudulently. All they do is allow a ...
24
votes
Accepted
Keeping AWS account ID secret
An AWS Account ID can be shared, when required.
Like the documentation says, the main thing anyone can use your AWS Account Number for is to construct ARN's. For example, if I had an AWS Account ...
- 421
22
votes
Amazon let me place an order without me ever being asked for 3-D secure password
Credit card transactions have varying levels of authentication, ranging from simply submitting the card number, to card+cvc, various password systems, chip-and-pin, and so on.
The important thing ...
- 34.6k
10
votes
Keeping AWS account ID secret
Knowing an AWS account ID doesn't expose you to any attack in itself, but it can make it easier for an attacker to obtaining other compromising information.
Rhino Security Labs demonstrate a ...
- 209
7
votes
Accepted
Security mechanism differences between Google and Amazon APIs
I think the question here should more be answered from a marketing than a security perspective.
In general, I would say that Google probably uses a relatively simple API key for usability/...
- 6,665
7
votes
Is this "security update" from [email protected] an advanced phishing scam or a real security measure from Amazon?
I called Amazon and the representative verified that no such email had been sent by Amazon. This is may be a phishing attempt. The original email seems (according to other reports) to include link ...
- 1,310
7
votes
Amazon let me place an order without me ever being asked for 3-D secure password
Amazon does not even request the CVV. The only piece needed to bill a card is the card number. Processing the transaction without the CVV or the 3D will be considered riskier by the card processor (...
- 18.8k
6
votes
Accepted
How to get a SSL Certificate for a public IP
1) Can I use my Public DNS address to get the SSL certificate?
No; to quote this Amazon tutorial,
If you plan to use your EC2 instance to host a public web site, you
need to register a domain name ...
- 72.9k
5
votes
Accepted
Why can't I delete the default AWS security group?
The default security group is created when a VPC is created.
By default, it allows ALL traffic from instances that belong to that security group and all incoming traffic. The fact that your default ...
- 206
5
votes
Accepted
Amazon RDS MySQL SSL connection, is the password sent in clear?
If you look at the MySQL Internals Documentation, you can see that the protocol initialises SSL/TLS after the initial handshake packet, but before the authentication step:
The two paths shown ...
- 135k
5
votes
Why http request signatures are useful?
You've kind of answered it in your question: HTTPS provides encryption, which prevents tampering with the request in a lot of cases, but doesn't prove anything about the identity of the person making ...
- 27.3k
5
votes
What would be required to monitor Amazon Alexa traffic?
As you noticed, Alexa could record all the time and send it only after you say the wake word. You could notice it by larger upload size. But at the same time Alexa could analyse the recordings and ...
- 2,998
4
votes
Accepted
Penetration Testing Vocabulary
White card:
white card is a simulated event in an operational test. White cards are used when a system is too fragile or operationally critical for the adversarial team to pursue an exploitation, ...
- 2,037
4
votes
Accepted
Amazon AWS KMS - Concept of signing in general and with JWT
KMS + JWT is confusing and easily misused. This question is about pragmatics, so summary answers below, happy to expand on them but the details are intricate.
1) Is signing barely encryption of the ...
- 3,507
3
votes
Why does Ubuntu make requests to these Amazon EC2 IPs at startup?
The gnome-software process contacts 54.173.79.111 for update purposes, as suggested in this forum thread. There's nothing inherently dodgy about these IPs, they both belong to the AWS cloud.
That ...
- 44.8k
3
votes
Accepted
OpenSSL version causes PCI Compliance failure
Until you can either get a clean scan or have your PCI-QSA sign off on proof that you are compliant the responsibility is on you to meet compliance requirements regardless of real-world security ...
- 14.2k
3
votes
Is this "security update" from [email protected] an advanced phishing scam or a real security measure from Amazon?
I'm going to say it's fake. If it's a real Amazon password reset demand, then you should be prompted to change your password at next login, not need to follow all those steps.
You can also check: ...
- 2,659
3
votes
Accepted
MySQL database (non-SSL) connections secured via origin/destination IPs, how unsafe are they?
You are correct to be concerned about the scenarios you presented:
If a MITM attack occurs, it cannot be thwarted unless you use SSL. The IP filter will not help because the attack is already "in the ...
- 9,212
3
votes
Accepted
Minimum required processes with open ports on AWS?
You're correct, lsof on an AWS EC-2 does not really provide a good image of what can be accessed on your box from outside. As you already cite in the question, AWS provides you with an extra firewall ...
- 5,877
3
votes
Is this "security update" from [email protected] an advanced phishing scam or a real security measure from Amazon?
I've just received a similar email and the email appears legit. I was searching for information on what list it would be to know what else might have been affected.
It has the right headers in ...
- 147
3
votes
How can I protect myself from one of my AWS EC2 instances being subverted and creating other instances?
AWS maintains the notion of "Roles" for EC2 instances. When launching a new instance you are able to assign the server a role. The role must be applied during the build and cannot be added to an ...
- 5,185
3
votes
Why would Amazon include an already trusted Root CA in the bug report they filed to get into Mozilla's truststore?
See comment #9 on that bug from Peter Bowen at Amazon:
It also includes one additional root CA already in the Mozilla program which we wish to have enabled for EV certificate issuance.
That ...
- 610
3
votes
Why does Amazon verify a TLS certificate?
https://support.mozilla.org's certificate is signed by the Amazon Certificate Authority, Amazon Trust Services. This is widely considered a trustworthy third party for signing certificates, and your ...
- 895
3
votes
Has it been proven, that Google Home & Alexa do not record before their respective key phrases?
If you have a device in your room which can record data and which from time to time sends data to some server on the internet there don't need to be any kind of relationship when the device records ...
- 201k
3
votes
Accepted
Why is my computer connected to amazon instances
Whenever you browse a website, your computer makes a connection to the site itself and to the servers hosting any resources requested by that website. I've seen sites that include literally dozens of ...
- 16.1k
3
votes
How might this Amazon account hack occur?
What can we do to stop the attack?
The damage and the extent of the breach might be more than you think of.
The email account that is tied to the Amazon account needs the same security steps ...
- 1,676
2
votes
What are the compliance requirements or standards for a non-US firm hosting personal data in the US?
I'd think that you don't have to cover US privacy law if you don't have US customers or operate in the US.
However, you will probably have to conform to the privacy laws of the country or countries ...
- 1,093
2
votes
Accepted
Random SYN_SENT connections to Amazon EC2?
I noticed this same phenomenon with my Ubuntu 14.04 machine today (all kinds of connections to EC2 instances such as ec2-52-22-249-100.compute-1.amazonaws.com from Chrome), and on my machine at least, ...
2
votes
AWS declined to give me details on Multi-Factor Authentication reset procedure
AWS already answered your question about transparency
Disclosing our processes violate our privacy and security policies.
To avoid being locked out of your root account, backup your two factor ...
- 245
Only top scored, non community-wiki answers of a minimum length are eligible