Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don't get it. What does the dot-email have to do with them social engineering their way to your order numbers?

Is the fact that they used a dot-email the weak link here, and what thankfully allowed you to catch on to the problem early?

If that is the case, why would an attacker use a dot-email, when they could just use any email.



Perhaps the CSRs use the email to pull up a history of previous chats, and by using a "new" email they can avoid the new CSR knowing about the previous ones?


I think they used the dot-notation to legitimate it, basically just a brick in the social engineering scheme pulled on the support rep.


That's my thinking. I assume they figured that because the account they were "chatting as" was so close, it might help. Or they thought it had a dot initially and found out they were wrong when the rep said there were no orders.

Amazon lets you chat without signing in and you can claim to have any email address you want at that point, so it's tricky to say if this was intentional (hoping the reps were "dot blind") or if it was just a mistake/bad initial guess.


Yeah that confused me too .. I assumed it had something to do with creating a new amazon account with the dot-email address?


as mentioned in some other replies, probably to legitimize it. As the author mentioned, they allowed the item to be shipped to a new address. If I'm not mistaken, a dot-email would be considered a new Amazon account, thus with no address associated with it, so maybe this helps the attacker in that regard?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: