Skip to main content

Lack of HTTPS on Amazon 2015

If you are browsing Amazon and someone is trying to capture your data and connection, then the person can easily see what you are browsing on Amazon or things you are buy.
If you commonly visit Amazon then you might have noticed 
that Amazon is not using HTTPS everywhere on their 
website. Only a few pages are HTTPS .

amazon_lock_http

Even, the person who is spying can see what has been purchased. This is how it can be done. Suppose you bought an IPod on Amazon one month ago. One day, you thought you need to see the warranty date. You go back to the website and click on My purchases. That page is secure(HTTPS). Then you click on your item. You go back to the page which is not  secure(HTTP). The hacker again gained access to what you are looking at. The hacker gained access because of the ref field in the url bar, which tells the hacker from which page the victim is coming.
amazon_lock_order_history
So, in this way, you compromise your security because of the fault of website. Stephen Merity found this problem and contacted Amazon they replied with no good news so he thought to share it with others. Stephen Merity wrote this in his blog :-
I reported this to Amazon previously via their security email but received a boilerplate response. Considering anyone interested in utilizing this information leak would already be doing so, I feel it’s worth raising awareness about the situation. At the very least, it adds to some of my previous articles on the lack of default HTTPS on Google Analytics and when HTTP referrers appear and disappear.
This could have been easily fixed by removing the ref variable from the URL bar , but Amazon did nothing.
The attacker can also get information, like last purchased, or from whom, etc
STAY CONNECTED!!
Labels:

Comments

Post a Comment

Popular Posts

Create Your Own Social Networking Site

Create Your Own Social Networking Site JCOW: Ethical Hacking Top 10 reasons to choose Jcow:- 1. Handle more traffic - Clean codes and Dynamic caching can lower the CPU load and  speed up your website. 2 Make your site more interactive - Well designed Jcow applications help you members to connect and communicate with others more effectively. 3 Add questions to the Registration Form - You can add new member fields, which will be displayed to the registration form, profile form, and the member browsing form. 4 Easily share stuff - Within the AJAX sharing Box, your members can publish status,  photos, videos, and blogs. 5 Customize and Extend your Jcow Network - A Jcow network consists of core apps(like "Friends" and "Messages") and optional apps(like "Blogs" and ""Videos"). You can enable/disable optional apps. You can also develop your own apps. 6 Every profile could be Unique - Members can customize their own profile theme and  add music play...
Post a Comment
Read more

The Problem of Abstraction in Definitions of Data Objects

I think there is a major problem in not being able to understand and work with different levels of abstraction.  By "abstraction" in this sense I mean one concept system that somehow describes or defines (not merely relates to) another concept system.  I think this is a big problem for definitions in data models. Let us take an example in a retail business such as mortgage banking: Customer Name.  Customer Name exists in the business.  They use it all the time.  Maybe it is sometimes called Borrower Name, but the concept is the same.  This is the Level 1 abstraction. Now let us think of data values in a column in a table that holds Customer Name.  These data values are stored as a code of 1's and 0's.  Of course these bits are rendered into something we can read.  However, this is not the same as the Customer Name in the business.  I worked for a place where they prefixed the name of anyone who had recently left with "ZZZ"....
Post a Comment
Read more

The Humpty-Dumpty Principle in Definitions

In dealing with empty concepts, we came across the issue that if somebody uses a term that potentially has an unintelligible definition, they are likely to defend themselves by quickly making up some kind of definition.   I strongly suspect that in such cases, the usage of the term will be inconsistent with the definition.  Which brings us to Humpty-Dumpty. Lewis Carroll (Rev. Charles Lutwidge Dodgson) is best known for his children's' books Alice's Adventures in Wonderland and Through the Looking Glass .  It is in the latter that Humpty Dumpty - an argumentative egg perched on a wall has the following exchange with Alice: 'And only one for birthday presents, you know. There's glory for you!' `I don't know what you mean by "glory",' Alice said. Humpty Dumpty smiled contemptuously. `Of course you don't -- till I tell you. I meant "there's a nice knock-down argument for you!"' `But "glory" doesn't mean "...
Post a Comment
Read more