Hackers humiliate Amazon

greenspun.com : LUSENET : Grassroots Information Coordination Center (GICC) : One Thread

Hackers humiliate Amazon

Intruders had access to customer credit details for four months at site owned by world's biggest e-tailer

Stuart Millar, technology correspondent Thursday March 8, 2001 The Guardian

Amazon, the world's biggest online retailer, was embroiled in a humiliating computer security row last night after it emerged that intruders had access to the credit details of thousands of a subsidiary's customers for four months. Bibliofind, which connects buyers and sellers of rare and secondhand books, has contacted users to admit that hackers penetrated its defences in October last year, managing to maintain undetected access to its 98,000-strong customer database until last week. During that time, they are believed to have downloaded names and addresses, credit card details and telephone numbers. It is understood that the attack was only spotted during a security review prompted by the site being defaced.

Some customers have been informed by their credit card issuers that their cards have been suspended because security has been compromised.

The extraordinary breach will come as a huge embarrassment to Amazon.com. The massive books-to-auctions operation, which took over Bibliofind in April 1999, has grown to become the net's biggest retail success with a reputation for electronic security that has helped it overcome widespread public fears about fraud.

Yesterday, Amazon executives in Seattle, Washington, were distancing themselves from the episode. Callers were referred to Bibliofind, which Amazon insisted was an entirely separate operation.

Bibliofind moved to assure customers that there was no evidence that any of the stolen information had been used to commit fraud.

Its spokesman Jim Courtovich said: "We have no information at this time to suggest that customers' credit cards have been misused."

He declined to go into detail about the circumstances of the violation, which is now the subject of an investigation by the US authorities.

The site will no longer hold customer credit details. Instead, all payments will be made directly by the purchaser to the individual bookseller.

Users of the site, which was closed down over the weekend after the breach was spotted, have been sent an email informing them that a security violation "compromised the security of credit card information". The email concluded: "To ensure this doesn't happen again, we have removed all customer credit card information, physical addresses, and phone numbers from Bibliofind's servers. We expect to bring the Bibliofind system back into operation shortly. We apologise for any inconvenience this may cause you."

But in a development that will deepen the embarrassment of Amazon and Bibliofind, a British internet news website claimed yesterday to have evidence that the company had been warned on at least one occasion that its defences may have been violated.

The Register published claims from an American internet retailer that he had detected a spate of attempted credit card frauds around October last year.

Items of between $1,200 and $2,000 in value were ordered with valid US cards, most of them to be shipped to eastern European destinations. But the retailer became suspicious and contacted the individual cardholders.

"We asked them if they shopped online anywhere else, as we suspected someone's database had been hacked," the retailer told the Register. "The only common link was Bibliofind." He had contacted the company, but it denied its site had been hacked into.

Last night, a Bibliofind spokesman said that any warning would have been fully investigated.

http://ads.guardianunlimited.co.uk/html.ng/Params.richmedia=yes&location=bottom&spacedesc=03&site=Books&navsection=5§ion=99819&rand=0853068

-- Martin Thompson (mthom1927@aol.com), March 08, 2001

Answers

CBC

Fri Mar 9, 6:54 am

Hackers

Organized hacker groups apparently are making a move on vulnerable U.S. computer systems. The FBI has warned such groups, especially from Russia and the Ukraine, operate by stealing information on credit cards and then attempt to extort money by offering security services to the victim company. The agency said over 40 companies in 20 states have been identified as victims and over one-Million credit card numbers have been stolen. The FBI said the hackers specifically target computer systems associated with e-commerce or e-banking.

-- Rachel Gibson (rgibson@hotmail.com), March 09, 2001.


Moderation questions? read the FAQ