Blog

Amazon Firesale Exploit - Amazon lief Gefahr, das gesamte Einkommen des Amazon Sale Programmes durch BOT Netzwerke einzubüßen!!! Letztendlich wurde dieses Problem sehr kurzfristig behoben. Durch einen Fehler in der Weboberfläche und der Verwaltung von Nutzersitzungen war es möglich, die Verkäufe von Konkurrenten zu sabotieren, eigene Angebote auf die Startseite von Amazon zu heften oder sogar das ganze Salesprogramm von Amazon lahmzulegen. Es gab hierfür zwar keine Belohnung, allerdings ist dies auch zweitrangig, da in erster Linie meine Absicht war tausende von Assoziierten, Angestellten, Investoren und deren Familien vor einem bösen Erwachen zu schützen, die finanziell (indirekt) abhängig sind von Amazon. Der folgende Fehlerbericht, basierend auf einer gründlichen Analyse, verhinderter danke der schnellen Reaktion von Amazon Security weltweit finanzielle Schäden im mindestens 7 stelligen Bereich.

Folgendes wurde am 28.03.2018 unter der Fallnummer RM135****** durch die Amazon Security bestätigt:

BUG/EXPLOIT: Vendors pushing up their offers, today's deals and special offers
by adding their goods to fake accounts' baskets.

DESCRIPTION: Several vendors at Amazon are using fake accounts to push up
their offers and special offers adding those products to new accounts' baskets
using different IPs by VPN or proxy connections.
Accessing Amazons Vendor Items with an automated algorithm and adding Items to
baskets works like a charm (I gave a demonstration).

RISKS: This could be done even automated by browser emulations or algorithms
having JavaScript interpreters implemented. With the additional use of proxies
and/or VPN connections, this will look like real user activity.

ATTACK VECTORS: - Target: WEB API of Amazon
- Access: Access by automated algorithms on Port 80/443
- Weakness Used: Instant Account Creation (no validation
required)
- Attack Method:
1) Find a seller or any seller on Amazon
2) Add their product(s) to a shopping cart
3) Do not purchase the product(s), leave it in the cart
4) repeat steps 2 and 3 until the company has almost no
items left
5) This offer will be now listed on top.

Or:
1) Find a seller or work or any seller or any work on
Amazon
2) Add their product(s) to a shopping cart
3) Do not purchase the product(s), leave it in the cart
4) repeat steps 2 and 3 until the company has no inventory
that is not marked as in someone's cart
5) A legitimate buyer now has to go to a
different seller to buy the product

-!!!ATTACK IMPACT!!!:
-This way 1 person could easily make a Vendor sold out/or
push it up to be on top of the list due to Amazon's item ranking method.
-1 Person using a big network / many nodes could easily make
Amazon completely sold out!

ATTACK IMPACT:
This Attack could easily ruin the whole income of Amazon and it's vendors.

LEGAL STATUS:This is unfair management and contradicts to the laws for fair
competition in a context of (e)commerce.
According to German/European law, Amazon can be hold liable for those fraud
account activities. This is the case of negligence for letting fraud activity
reach out to users which did not even register at Amazon but will receive
emails. This is also a violation according to pretending of false facts.

HOW TO REPRODUCE:
Create several accounts using different IPS or not and start adding products
especially special offers. Creating accounts fake accounts is made easy since
you are logged in after registration without any validation process. The
attacker can give any email address, even a not self owned one and will have
access to a fake account for adding items to it's basket. Proxifying or using
various VPN connections per fake client will let this look like real user
activity. After ~15 minutes, the basket will be refreshed if the session is not
refreshed by user activity. Items will be added to the basket again to keep the offer on
top or sold out.

HOW TO FIX:
- Purge not by email and/or mobile phone confirmed accounts.
- First check for validity before letting new users log in.
- add email, mobile phone, address or passport/personal id validations for
registering process.
- reject proxy networks like tor

-> This will not just prevent the loss of income, but also prevent Amazon of
being held responsible in some countries for careless forwarding of fraud
activity to customers or partners/vendors harming their income.

BUGFIX IMPACT ON User experience:
- adding an email validation linking to a instant login with authenticated
email will not impact the users' experience negatively.
- Just decreasing the basket purge time would harm the user's experience.