Comments on: The security hole I found on Amazon.com

By: Jim Ciallella

Jim Ciallella — Fri, 13 Jun 2014 15:57:52 +0000

Bunch of amateurs over there at Amazon. Good find.

By: Diego Plentz

Diego Plentz — Sat, 07 Jun 2014 21:26:45 +0000

I hope that they paid a good reward.

By: peroyotambien

peroyotambien — Sat, 07 Jun 2014 06:53:26 +0000

Superficially, that exploit is actually to Amazon's benefit. More products sold means more money for Amazon.

Of course, the ensuing customer complaints and hooplah would more than negate that benefit. Did they compensate you?

By: PalpablePsyonics

PalpablePsyonics — Sat, 07 Jun 2014 06:26:48 +0000

It's rather interesting that larger companies don't have an individual dedicated to specific tasks such as gradual security chechecks. An example list of workflow would be as follows, for an individual like this:

-Each time something is updated and/or altered that affects the live version, have a hired security technician spend time chechecking possible intrusions etc.

Part of their job would be searching and storing information of various exploits and their explanations, and studying them to learn the thought processes that cause these vulnerabilities. Part of their job would be to test the website every so often, to check if certain code and/or input is vulnerable. Another part of their job would be implementing temporary and permanent fixes to various possibilities of future vulnerabilities, as it seems some vulnerabilities often repeat themselves, but in different forms.

Then again getting businesses to actually hire people is like pulling nose hairs from a Dragon. (Just saying, if they had nose hairs that's what it'd be like.)

By: Anon

Anon — Sat, 07 Jun 2014 03:47:38 +0000

And you’ve just confirmed why I do not have, and never will enable, one-click purchasing on Amazon.

By: Anon

Anon — Fri, 06 Jun 2014 21:51:42 +0000

Did they give you a reward for finding it?