Subject: Someone at Amazon fix this NOW

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 12 Aug 2017 23:54:17 -0400

https://petapixel.com/2017/08/11/fell-victim-1500-used-camera-lens-scam-amazon/#1502592977366

You have two problems:

1) Your complaints department is not reading the emails sent.

2) Your customers are being defrauded by someone who understands your
system.

Not good.

---

From: Matthias Merkel <[email-masked]>
Date: Sun, 13 Aug 2017 09:27:19 +0200

Well. This is nothing good but what does the IETF have to do with it?

---- On So, 13 Aug 2017 05:54:17 +0200 [email-masked] wrote ----

You have two problems:

2) Your customers are being defrauded by someone who understands your system.

Not good.

---

From: Nick Hilliard <[email-masked]>
Date: Sun, 13 Aug 2017 12:42:00 +0100

Isn't moral outrage on-topic for ietf@?

Nick

Matthias Merkel wrote:
>     ---- On So, 13 Aug 2017 05:54:17 +0200 [email-masked] *
>     wrote ----
>

---

From: Matthias Merkel <[email-masked]>
Date: Sun, 13 Aug 2017 14:19:22 +0200

Not sure. But the subject and email body more sound like they are directed to Amazon.

On Aug 13, 2017 5:54 AM, Phillip Hallam-Baker <[email-masked]> wrote:

You have two problems:

Not good.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 13 Aug 2017 09:29:42 -0400

Internet Security is an IETF concern.

Unfortunately, most people in IETF seem to think security is limited to
stopping mass surveillance. Confidentiality is a security concern, of
course. But it is not the only security concern.

The security concern that most Internet users are concerned about
personally is theft. That is the main reason that the WebPKI was designed
and built. The primary motive was to prevent theft of credit card numbers.

I think that everyone working on protocol design should understand the real
security concerns. Integrity attacks are almost always more damaging than
confidentiality. Hijack BGP and you can invade a country without firing a
shot (see the episode in South Ossettia).

The attacks are moving up the stack. But they are still our problem if we
want to remain relevant.

What has happened here is that the lower levels of the corporation in
question have been hollowed out into a set of rigid processes that are
blind to actual facts. It is not the only large corporation that has done
that. When that happens, the only way to reboot is to escalate. Since the
victim of the crime attempted every escalation process the company offered,
it is necessary to go outside those processes.

I also have a process. I begin with a personal contact if I have one. Then
I escalate to a public forum where I know there are employees who will
ensure the issue gets the appropriate attention and so on.

At this point it is one incident of fraud involving $1,500. But left
unaddressed it will be a few thousand within months. The template for the
attack is public now. I read the article and thought, how do we stop this,
the criminals will be reading it and asking how they can apply it. And they
won't just be targeting Amazon.

​

On Sun, Aug 13, 2017 at 3:27 AM, Matthias Merkel <[email-masked]>
wrote:

> ---- On So, 13 Aug 2017 05:54:17 +0200 * [email-masked]
> <[email-masked]> * wrote ----
>
>

---

From: Matthias Merkel <[email-masked]>
Date: Sun, 13 Aug 2017 15:35:19 +0200

I care about security. Actually as security researcher it's my job to care about cybersecurity. I also know that going toto the public can help (actually it helped me with Amazon AWS before). I was just unsure if this mailing list was appropriate for it.

On Aug 13, 2017 3:29 PM, Phillip Hallam-Baker <[email-masked]> wrote:

Unfortunately, most people in IETF seem to think security is limited to stopping mass surveillance. Confidentiality is a security concern, of course. But it is not the only security concern.

The security concern that most Internet users are concerned about personally is theft. That is the main reason that the WebPKI was designed and built. The primary motive was to prevent theft of credit card numbers.

I think that everyone working on protocol design should understand the real security concerns. Integrity attacks are almost always more damaging than confidentiality. Hijack BGP and you can invade a country without firing a shot (see the episode in South Ossettia).

The attacks are moving up the stack. But they are still our problem if we want to remain relevant.

What has happened here is that the lower levels of the corporation in question have been hollowed out into a set of rigid processes that are blind to actual facts. It is not the only large corporation that has done that. When that happens, the only way to reboot is to escalate. Since the victim of the crime attempted every escalation process the company offered, it is necessary to go outside those processes.

I also have a process. I begin with a personal contact if I have one. Then I escalate to a public forum where I know there are employees who will ensure the issue gets the appropriate attention and so on.

At this point it is one incident of fraud involving $1,500. But left unaddressed it will be a few thousand within months. The template for the attack is public now. I read the article and thought, how do we stop this, the criminals will be reading it and asking how they can apply it. And they won't just be targeting Amazon.

​

On Sun, Aug 13, 2017 at 3:27 AM, Matthias Merkel <[email-masked]> wrote:

---- On So, 13 Aug 2017 05:54:17 +0200 [email-masked] wrote ----

You have two problems:

Not good.

---

From: Michael Richardson <[email-masked]>
Date: Sun, 13 Aug 2017 10:39:06 -0400

> The seller knew s system. When I made the order, they shipped a box of
> baking maps s address in Gilberts, Illinois, and then used the tracking
> number for my order.to S

So, to put this into something that IETFers can deal with, this would have
been detectable automatically if USPS had sent a signed artifact to Amazon
(or if such a thing was retrievable via the tracking order) that Amazon could
have compared with the correct destination address.

If this IETFs' direct problem?  Not entirely; we have 20yr old protocols for
signing various objects, although PHB knows better than any how unsuccessful
we have been at getting them used.

If anything it outlines the gap between publishing an RFC and getting it
meaningful deployed.  There is a gap in there for motivated early adopters
(such as governments, via procurement) and industry and government to adopt.
I don't understand, for instance, why S/MIME isn't a mandated (by law
societies) standard for emails between lawyers. Instead, we have the silly
disclaimers.

Maybe this is an IASA2 discussion: how could we engage (and collect fees)
From a more diverse set of "stakeholders", such that they'd care when/if we
actual solved their problems.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 13 Aug 2017 10:57:52 -0400

> (such as governments, via procurement) and industry and government to

​I think we are sleepwalking into a similar disaster with IoT. Right now,
the message Congress is getting is that the biggest priority in IoT is to
force devices to accept software updates.

Well no it is not. Software updates are only going to make things worse if
you don't do it securely. The update mechanism provides the attacker with a
vector to own the machine entirely unless you authenticate. Do you think
the IoT folk do that right?

I can't use my Sonos device in one room because every time I try, it is
updating. Same with one of the 'smart' TVs.​

There is a real empathy gap in the industry. Its not just an inability to
see things from the user's point of view, it is a refusal to accept that it
even matters.

---

From: Hosnieh Rafiee <[email-masked]>
Date: Sun, 13 Aug 2017 20:30:16 +0200

IMHO, It is not the problem of IETF or other standards, because
standards can just say what to do but does not enforce it or also does
not say how to do it.

It is the problem of training and knowledge of customers and as a result
industries.

The enforcement cannot happen unless the industries feel the need of
that or there is a kind of competition between industries to have it.
This is not easy as at the moment, the IoT industries just thinking
about adding nice features rather than security or privacy.  One
possibility is that the customer are the one who ask for that. because
if the customer ask for that, then industries will follow the needs of
the customers. For doing that, there need to be a wide understanding and
training for customers to understand the problem. 80% of people just buy
IoT without having a knowledge of security and enjoy its features.

If there are common criterias and customer ask for that, then industries
will follow that goal. Otherwise if security causes additional cost for
industries and customer do not also understand this advantage, then they
prefer to buy what they can have with less price!

Open source or other activities might help but they still cannot enforce
big companies to take care of their security. Otherwise in world there
are whitehat hackers that start activites to show the problems! But
unfortunately based on many countries regulation, even whitehat hackers
can be arrested if the industries did not ask for that....

>
>
> On Sun, Aug 13, 2017 at 10:39 AM, Michael Richardson
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>
>     > number for my order.to <http://order.to> S
>
> ​I think we are sleepwalking into a similar disaster with IoT. Right
> now, the message Congress is getting is that the biggest priority in
> IoT is to force devices to accept software updates.
>
> Well no it is not. Software updates are only going to make things
> worse if you don't do it securely. The update mechanism provides the
> attacker with a vector to own the machine entirely unless you
> authenticate. Do you think the IoT folk do that right?
>
> I can't use my Sonos device in one room because every time I try, it
> is updating. Same with one of the 'smart' TVs.​
>
> There is a real empathy gap in the industry. Its not just an inability
> to see things from the user's point of view, it is a refusal to accept
> that it even matters.