Sad story of hacking and sync failure

[BillJ]

I was getting false logins.

At 4:32 PM 4/23/2019 I changed my email account.
---------------
4:32 PM 4/23/2019 Amazon.com Revision to your Amazon.com Account
From: Amazon <account-update@amazon.com>
Reply-To: account-update@amazon.com
To:
Message-ID: <0100016a4be6cdc8-0e746680-dc5c-4b2c-b687-bc827ff59eb0-000000@email.amazonses.com>
Subject: Revision to Your Amazon.com Account
Thanks for visiting Amazon.com! Per your request, we have changed the e-mail address associated with your account
---------------------

The next morning I got this:

----------------------
At 4:31 AM 4/24/2019 Amazon.in Amazon Login OTP
From: "Amazon.in" <account-update@amazon.in>
To:
Message-ID: <0102016a4e78d870-aabd7005-0d6a-4d30-bd71-a6191b732211-000000@eu-west-1.amazonses.com>
Subject: Amazon Login OTP
Login OTP

Your login OTP is:
xxxxxxx
This OTP is confidential. For security reasons, DO NOT share the OTP with anyone.

Amazon takes your account security very seriously. Amazon will never email you and ask you to disclose or verify your Amazon password, credit card, or banking account number. If you receive a suspicious email with a link to update your account information, do not click on the link*instead, report the email to Amazon for investigation.
-------------------------

I phoned Amazon and complained that the address was still being hacked and it appeared targeted. They must have closed the account. The Fire wouldn't connect. I deregistered but it wouldn't reregister. It won't accept a firmware replacement via adb sideload either.

[pdurrant]

Amazon customer service hasn't been up to its usual standard it seems.

I would call again, and insist that the problem is the status of your account, not the ability to download one particular ebook. Indeed, I wouldn't even mention any difficulties with downloading ebooks to start with. Just concentrate on the lack of order history, and lack of books in your contents pages.

Looking at the transcript, the operators were desperate to put your problem into one of the boxes they knew how to handle, and the box they chose was 'can't download ebook'.

[BillJ]

Yes. And I made the mistake early on by hanging up on an Amazon operator who seemed to be reading from a script and didn't seem to have heard what I said.

My past 6 months orders are showing on the new email address account but only the one book.

I'm not overly up set about the missing content. I had been getting free books from BookBud and had a lot. One I had started reading was grossly racist and tried to obscure that with blatant sex scenes. I could easily delete it from the Paperwhite and the Fire but not my online account. So, that's gone.

But the Fire refuses to re-register. It seems to update software then gives me a login error.

I tried sideloading the same firmware from an RPI3+ (linux) using both stock adb and adb-dev/5.1.1 and in both cases the device is recognized and its correct serial number displayed but can't push the firmware to the Fire.

[janrey]

I would try and see if you can access using your old email address. You will probably have to do a reset password. Try and do it while India is asleep and hopefully they are stupid and haven't setup two step verification or added a mobile number for password resets. If you can accomplish this, first step is to put your mobile number in there and setup two step verification on this account plus change the password. Then call Amazon and ask for a tier 2 person and tell them what is going on, especially if it says the account if valid but you don't receive a password reset. Then I would do a virus and key logger check on your computer because you potentially have a virus.

[BillJ]

Tried to register again last night. Failed. Previously I tried Forgot Password and used my mobile phone as the ID, when the website asked for the code, the texted code failed. Tried that again last night but this time gave my new email address. Code was sent to a gmail address. This code worked. I was in. I could see the Kindle Cloud Reader and the one book. Fine. I looked for a way to register the Fire. No good. I disconnected and tried logging in. Failed again. So, something fails that way.

I may have gotten someone in Cambodia angry. I was an early subscriber to buying a Koompi linux laptop before they were shipping. Elections there came. Hard ass head of state. Suppression of opposition not unlike Turkey or Venezuela. The laptop team salesman was aggressively trying to friend me on FB. I didn't like his tone. We couldn't agree on money transfer, I wanted Paypal or wire from my bank or bitcoin. He wanted, what was it, Telegram? I canceled the order. Later I got emails from hundreds of BBS's in Asia, Russia, all over asking to confirm. Password resets on websites I use continue to this day (6 months). Just this morning, Coinbase. Koompi computer buys parts from China. I suspect they turned my email address over to a professional, government, hacker, Cambodian or Chinese.

BillJ

[stumped]

sounds like that lap top needs a very thorough sanitising
I't take the time to run every adware/ skyware/ phishware detector that I could find on it and see what comes up
malwarebytes is a good starter, also trend micro housecalls. there may be more specialised ones for key loggers that I am not aware of.
its probably time to completely abandon some email addresses also , AFTER cleaning the laptop, and be careful who you give new ones to .

Given how quick and easy a new install of Windows can be ,. nowadays, I'd shortlist that option also. i don't think there is much malware that can survive a format & fresh install.
I know that amazon's policy is not to transfer content between accounts, but maybe they will make an exception if you convince them that an account is compromised ? That would not be my 1st choice though. Why risk a "shoot the messenger" response. I would look to get in once, download and de-drm all purchases, then switch to new accounts with new clean emails

[janrey]

Originally Posted by stumped

sounds like that lap top needs a very thorough sanitising
I't take the time to run every adware/ skyware/ phishware detector that I could find on it and see what comes up
malwarebytes is a good starter, also trend micro housecalls. there may be more specialised ones for key loggers that I am not aware of.
its probably time to completely abandon some email addresses also , AFTER cleaning the laptop, and be careful who you give new ones to .

Given how quick and easy a new install of Windows can be ,. nowadays, I'd shortlist that option also. i don't think there is much malware that can survive a format & fresh install.
I know that amazon's policy is not to transfer content between accounts, but maybe they will make an exception if you convince them that an account is compromised ? That would not be my 1st choice though. Why risk a "shoot the messenger" response. I would look to get in once, download and de-drm all purchases, then switch to new accounts with new clean emails

I agree with this. Personally I would be out getting a new computer from a reliable shop and kicking the one you are currently using to the curb. A format should work but who knows if they got a virus into the bios. If this is the case, a format and fresh install won't work because the virus will be reinstalled on boot. I would then download Calibre and transfer from my devices all the books including the one you recently purchased. I would then open a new account with Amazon with a new email address and then call Amazon to close that other account and talk with someone higher up to see if it is possible to transfer over the books you have on the old account or perhaps give you a credit to repurchase the latest one you bought. This they can do. I would do this with all your accounts. If they are bank or credit card accounts contact by phone or in person and have them change the email address without sending out any reset notice to your old email address. It is easy to create email addresses so create one that is restricted to use only on Amazon and another that is used only on your bank/credit card sites, another email address for websites like this one and one for general purposes for emailing purposes. Do not give any of these email addresses out.

[BillJ]

Originally Posted by BillJ

Chat
So we can't cancel it or refund the gift

I have 1 click Amazon Purchases turned off. I went to buy the ebook. It seemed that 1 click was the ONLY way I could buy the book. But, I saw I could send it to myself as a gift and it would go into the cart. I did.

[stumped]

Originally Posted by janrey

I agree with this. .... It is easy to create email addresses so create one that is restricted to use only on Amazon and another that is used only on your bank/credit card sites, another email address for websites like this one and one for general purposes for emailing purposes. Do not give any of these email addresses out.

i second that also. I did that when my amazon account somehow got compromised, so now I have one just for amazon shopping. Never use it for other online stores. Amazon and ebay/paypal are the most dangerous sites to have compromised as so much can be stolen, so fast...

PS when my amazon account did get hacked, Amazon were most unhelpful. Lots of amazon coins were being bought on the account and though they blocked those eventually, they refused to give me any info like " from what country were the purchases made, from what IP, from what device... " and kept insisting that their systems are unhackable. I think my email got compromised, a bit like what is happening here, so then the password resets can get intercepted/hidden.... And I was guilty of using same password on multiple retails sites... lesson learned the hard way there.

[BillJ]

Amazon has been getting out of China. Amazon has so many foreign country local presence that the possibility of Amazon employees of those countries being rogue is high. You give the employees the keys and what's to be done!

And MAGA believers in this country as Amazon employees aren't above suspicion.

[stumped]

Surely though,. Systems are designed so that customer services cannot see or access passwords.
For example I was dealing with sky TV on live chat. She had to send in the chat window , a link to a web page which prompted for a security question , then I had to type done into the chat after interacting with that's so I guess all she got to see was a success of fail result of that. She does not see the question or the answer.
I recall encountering something similar when buying ram from crucial by phone. I had to be transferred into some robot thing and type in a sixteen digit card numbers then got transferred back. The guy on the phone was not allowed to ask for Or enter that. He just got told that number was accepted. Or not!.
I think everything that Amazon CS do is managed by computer prompts. It tells them what goodwill offers to make etc, what replace or refund Options to offer. And most checks are done like this : they ask a question, like your email address , and compare your verbal answer to what their screen is showing. ...

[stumped]

Fire devices, tablets, TV, use same registration process as everything else. - you enter an email on a virtual keyboard, then a password. Most login errors are due to making errors in that. Like upper vs lower case errors.
I cannot recall if password characters get hidden as you type them. That makes it harder to spot if you miss one or repeat one

But from memory it works just like registering a Kindle.
You could though, look at my devices on the web site, to see what is registered , and what is not.
And you can de register a device using the web page.
And you could do through a de register, re register on the tablet. With it online finger device and web site in sync.
Or call in and ask them to watch while you try to register, maybe they can see error messages that you can't.
Could be that login error is really network error.
If the fire will not register and is in warranty they should send you a new one.

[Little.Egret]

Originally Posted by BillJ

I have 1 click Amazon Purchases turned off. I went to buy the ebook. It seemed that 1 click was the ONLY way I could buy the book. But, I saw I could send it to myself as a gift and it would go into the cart. I did.

You have never (since before 2012) been able to buy an ebook on Amazon without one-click being allowed for ebooks. Same for give as a gift, just a different click. An ebook never goes in your basket.

[BillJ]

No argument. At 70+ memory ain't too good. I used anti-seize compound on something just the other day and can't remember what.

[BillJ]

I had a good chat with an Amazon-chat with a UK extension. A transcript was sent to my email address. But it was to no avail apparently. That was about a week ago. I suspect that a telephone call is required. My take is that a telephone call isn't necessary except that selling voice prints is profitable. I have no need to hide my voice. But, this seems to be a requirement by the cable company and others as well, voice conversations where an online chat should suffice.