Month: January 2016

Over the weekend a story appeared on Medium that will make any Amazon user wince. According to customer Eric Springer, all a hacker needs to unlock your whole damn life is your name, email address, and a mailing address—and the mailing address doesn’t even have to be correct.

Here’s the story: Four months ago Springer received an email from Amazon thanking him for contacting customer service. How polite! The only problem was, Springer hadn’t actually contacted Amazon at all.

Springer was troubled by the auto-reply email response he received, so he reached out to Amazon and managed to get a hold of the transcript. He discovered that a social engineer—a hacker—was pretending to be him in order to gain access to critical account information on Amazon.

The kicker is that the address provided to Amazon’s customer service wasn’t even Springer’s real home. It was a bogus address he used to register websites online. Yet with that confirmation, the hacker was able to get Springer’s real address. With Springer’s real residence, his email address, and his name, the hacker could do a good bit of damage.

Springer informed Amazon of the colossal failure on their part and the company promised to improve security. Eric assumed he was done with the mess—until he received another email from Amazon last week.

Again, he asked for the transcripts. And again, it showed that all a hacker needed to gain access was a name, email address, and mailing address. Eric’s only relief was seeing that the hacker failed to get a credit card number out of the overly helpful customer service representative. That’s an improvement from 2012, when hackers social engineered that information out of a customer service representative and gained access to the online life of Gizmodo-alum Mat Honan.

Curious to reproduce Eric’s story, Redditor bot-vladimir attempted the hack as well. They used the address of a nearby hotel and Amazon quickly handed over the redditor’s real address, much to bot-vladimir’s disappointment.

However in my own trial, I was met with much less success. I have an old address that’s publicly available online thanks to WhoIs, so I gave the hack a go. The Amazon Customer Service Representative seemed to pick up on my scam quickly and turned me down flat when I provided the old address. Then, after giving them my actual address, they refused to give out any more information until we had a chat on the phone.

So it seems success is entirely dependent on the customer service rep you happen to be speaking to. Mind you this is a fairly common target for social engineer hacks. The biggest vulnerability isn’t a password or an email address; it’s the gullibility of the person on the other end of the line.

The best way to protect yourself±besides avoiding the internet altogether—is to use a mailing address you’re okay with broadcasting across the internet. That could be your office, a local FedEx or UPS store, or an Amazon locker. Take the time to set up two-step verification too. That way hackers have at least one more hoop they have to get through before learning where you sleep at night.

We’ve reached out to Amazon for comment on the story and will update accordingly. For now this tale serves as a great reminder that even the best passwords and most carefully plotted online lives aren’t immune to a really savvy and determined social engineer.

[Medium via Reddit]

---

Contact the author at alex.cranz@gizmodo.com.

via Gizmodo
This Amazon Customer Service Story Will Freak You Out

While patrolling the aisles at SHOT Show 2016, I noticed the MegaBOOM display, and circled back for a closer look. I soon ascertained that MegaBOOM is an adapter, to which you attach plastic bottles – such as 2-liter or smaller soda bottles – which you then pressurize with air and shoot, to get a loud[…..]

The post MegaBOOM Lets You Make Exploding Targets Without Chemicals – SHOT Show 2016 appeared first on AllOutdoor.com.

via AllOutdoor.com
MegaBOOM Lets You Make Exploding Targets Without Chemicals – SHOT Show 2016

via kottke.org
Recipe for making McDonald’s Egg McMuffins at home

Microsoft Surface Pro tablets stopped working on the sidelines of a major U.S. football game today, causing a spectacular black eye for the struggling product just as its maker was performing an advertising blitz for the hybrid tablet device integrated into the game itself.
via AppleInsider – Frontpage News
Microsoft Surface blamed for NFL football playoffs meltdown

Body cameras are working as intended. Of course, this is a very limited sampling and the fact that anything happened at all to the abusive cop was reliant on him being either too stupid or too arrogant to shut his body-worn camera off.

A former Las Vegas police officer was indicted by a federal grand jury Tuesday on felony charges of roughing up a woman he suspected was a prostitute.

Richard Scavone, 49, was charged with violating the civil rights of the woman when he used excessive force while arresting her in January 2015 and falsifying his report of the encounter to obstruct an FBI investigation, according to the Justice Department.

The woman was identified in the indictment only by her initials, A.O.

Scavone, who also faces a local misdemeanor battery charge in the incident, has been summoned to answer the two felony counts in federal court on Jan. 20. He is to appear in Las Vegas Justice Court that day, as well.

The Las Vegas Review-Journal’s depiction of the events ("roughed up") is far kinder than the DOJ’s press release.

According to the indictment, on Jan. 6, 2015, while acting as a police officer, Scavone allegedly assaulted “A.O.” resulting in bodily injury. The indictment alleges that Scavone grabbed the victim around the neck with his hand and threw A.O. to the ground; struck A.O. in the forehead with an open palm; twice slammed A.O.’s head onto the hood of his patrol vehicle; and slammed A.O. into the door of his patrol vehicle.

And that is far, far kinder than the Las Vegas Sun’s description of the incident from early 2015, when Scavone was only facing a misdemeanor battery charge.

Scavone said in a statement that the woman turned her back to officers, a statement police said was refuted by the corrections officer.

When she asked how she could put her palms together if he had her hands, Scavone threatened to "dump (her) on the floor" and handcuffed her, the report said.

He then told her to spread her feet, and when she replied, "My feet are straight," he grabbed the back of her neck and threw her on the ground, according to the report.

The woman cursed and told him to take her to jail, and Scavone struck her face with an open hand before grabbing her left shoulder and dragging her several feet away from his vehicle to get her on her stomach, the report said.

Scavone asked the woman if she was "finished fighting" him, the report said.

The corrections officer and Scavone picked the woman up and walked her back to the vehicle, where Scavone grabbed her elbow and reached for her necklace, police said.

When she turned away, he slammed her head twice on the patrol car, police said.

He reportedly told her not to pull away from him and reached inside her dress, pulling out a condom and a cellphone, the report said.

Scavone said in his statement he retrieved the items, which were in the area near her breast and armpit, at least partially for officer safety because they could have been weapons, police said.

The woman, who was not wearing a bra, told Scavone multiple times not to touch her breast, and Scavone pinched her right breast through her dress before removing an undisclosed item from inside the dress, police said.

Police did not find any weapons on the woman, the report said.

Scavone accused the woman of reaching for something, and he grabbed her ponytail and slammed her head on the patrol vehicle again, police said.

He pulled her ponytail as he pushed her head against the vehicle, and she screamed, the report said.

He led her to the back seat of the patrol vehicle while holding her ponytail and slammed her into the passenger window, police said.

"You resisted and fought me," he told the woman, according to the report.

The federal grand jury indictment is just that: a grand jury indictment. It doesn’t take much to convince a grand jury to hand down an indictment, but it is rather unusual to see one stick to a law enforcement officer. The video captured by his camera apparently played a significant part in the bringing of charges — something that will be applauded by accountability advocates and derided by police unions, etc. who still believe body cameras are nothing more than a nefarious conspiracy to punish cops for doing normal cop stuff.

The assault charge is one thing. It’s the falsification charge that’s going to hurt, if it sticks. According to the DOJ, Scavone lied in his use of force report. That’s netting him a federal obstruction charge which could add another 10-20 years to his sentence if convicted. The civil rights charges alone come with a potential 10-year sentence and $250,000 fine.

Without the footage captured by his own camera, it’s very likely Officer Scavone would still have his job and zero indictments. After all, the woman he apparently abused was suspected of being a prostitute. When it comes down to "her word against ours," a woman portrayed as a sex worker has no chance against an officer who had previously received a commendation for meritorious service. And contrary to the assertions of body camera critics, the department Scavone worked for doesn’t appear to be poring through its recordings in hopes of finding cops to bust.

Las Vegas police Undersheriff Kevin McMahill said it’s the first time his police department brought “criminal charges associated with the review of a body camera on an on-duty use of force incident.”

That the DOJ’s press release doesn’t mention the use of body camera footage in the indictment process is a little strange considering its push to spread this technology to law enforcement agencies around the nation. Of course, the DOJ is also instrumental in defending law enforcement officers against alleged civil rights violations. Sure, it investigates agencies with abusive histories, but it also works hard to ensure agencies remain legally immunized from the consequences of their actions and has mounted several efforts to keep Fourth Amendment protections to a minimum.

It’s often a house divided against itself, which may explain why this detail has been glossed over, even if the tech that turned a non-event (according to the officer’s police report) into a federal indictment is part of its overall plan to improve the nation’s policing.

Permalink | Comments | Email This Story

via Techdirt.
Body Cam Footage Leads To Federal Indictment Of Abusive Las Vegas Cop

 Francis Sollano, one of the World Economic Forum’s Global Shapers and the executive director of Youth For A Livable Cebu, truly believes that your trash is his treasure. Read More

via TechCrunch
At The WEF The Future Of Fashion Could Be “Trashion”

Star Wars: The Force Awakens has been lauded for its return to the in-camera and practical effects style of Episodes IV-VI, but the magic on screen was a deft blending of traditional and modern techniques, as demonstrated in these clips from Wired’s DesignFX and IAMAG.
via The Awesomer
Inside The Force Awakens’ VFX