9 ms·

I contacted Amazon to report an advertiser out of Tel Aviv that was using JavaScript hosted on CloudFront to fingerprint user's devices and if an Android device

I contacted Amazon to report an advertiser out of Tel Aviv that was using JavaScript hosted on CloudFront to fingerprint user's devices and if an Android device was detected a fake media player or fake CAPTCHA would trick user's into accepting push notifications for fake virus warnings to install questionable apps from the Play Store. This script also pushed ads for a fake AdBlock app that was a dropper for banking trojan apps. Amazon refused to do anything about it. More info: https://forum.xda-developers.com/t/massive-mobile-advertising-fraud-campaign-fake-virus-warnings-free-iphone-scams-surveys.4242181/ https://forum.xda-developers.com/t/massive-mobile-advertisin...

ericbarrett 5y ago
Did they reply in the negative or just not respond?
- achow 5y ago
  How does it matter? No response is a response and in this kind of situation it is explicit "I will not do anything and I'm dishonest enough to not acknowledge that.".
  - ericbarrett 5y ago
    I was curious, not being cynical toward sloshnmosh. Much can be inferred from Amazon's choice of reply.
  - jabberwik 5y ago
    To me, a negative response says "We have evaluated our policy and decided that we will not stop this." A non-response says "A frontline agent didn't know how to make a call on a non-downtime ticket from a non-customer so now it's in a bureaucratic black hole and nobody has actually read your email and probably never will." Which is still crappy, but not really malicious in the same way.
jjoonathan 5y ago
It feels like this is more a result of Amazon not being able to connect you with the right escalation path to verify & act on these claims than a considered decision to ignore them. Does anyone here know what an individual reporter should do? Is there an escalation ramp that exists but was so poorly marked that neither sloshnmosh nor Amazon support was able to find it? Does the ramp go through other organizations (e.g. report to CERT or some other org first and come back with a case ID)? Does the ramp not exist and need to be built?
- LoveLeadAcid 5y ago
  Nah, Amazon has a cozy relationship with intelligence agencies (CIA, for instance, uses Amazon for cloud services) and they probably don’t want to step on any dangerous toes or lose money and business.
- bbarnett 5y ago
  It feels like this is more a result of Amazon not being able to connect you with the right escalation path to verify & act on these claims than a considered decision to ignore them. Those two things are actually the same thing, both are wilfully ignoring situations like this.
  - seanmcdirmid 5y ago
    Never assume malice where ignorance and incompetence would suffice instead. Those two things are actually not the same thing at all, depending on how you define “willful.”
    - csharptwdec19 5y ago
      It's malice but from a different aspect; willful malice in the name of 'cost cutting'.
      - deleted 5y ago
        [deleted]
      - 5y ago
reaperducer 5y ago
Amazon refused to do anything about it. Actually "refused" to do anything about it, or didn't respond to you?
- Scoundreller 5y ago
  I’ve had government agencies claim it’s not a refusal/rejection if they refuse at the moment and claim you might (with no guarantee) have success if you try later. I call it a “constructive refusal”.
  - smokelegend 5y ago
    i.e. "differed success"
TechBro8615 5y ago
I wouldn’t be so quick to rush into a future where Amazon takedowns are as easy as YouTube DMCA requests.
- DSingularity 5y ago
  Yes! Let’s stay in a present where Israeli hackers-for-hire can help dictatorships capture and murder dissidents. At a minimum we should demand transparency and accountability from all of these scale-enabling organizations.
  - hef19898 5y ago
    I guess your founder and CEO being victim of something similar helps in these decisions. Or not.
    - deleted 5y ago
      [deleted]
  - ben_w 5y ago
    Obviously I am not in favour of that either. Making takedowns automatic on any user report means the dictators take down the apps of the dissidents. In the absence of AI that would necessarily have to be good enough to also radically change society and the economy, the only solution I can even think of is a big increase in funding for the policing of apps. Who exactly would fund that? Governments would want to use such powers to pursue their own agendas, while Big Tech taking a proportion of App Store income is already being called “[Apple|Google] tax”.
    - DSingularity 5y ago
      Why can’t we we reduce cloud provider margins and use that money to fund it! I mean — why is this not obvious? Force these companies to adhere to certain regulatory standards - the minimum of which is transparency and accountability.
squarefoot 5y ago
That NSO Group infrastructure was burned, the one you reported (still) isn't.

ericbarrett 5y ago

Did they reply in the negative or just not respond?

achow 5y ago
How does it matter? No response is a response and in this kind of situation it is explicit "I will not do anything and I'm dishonest enough to not acknowledge that.".
- ericbarrett 5y ago
  I was curious, not being cynical toward sloshnmosh. Much can be inferred from Amazon's choice of reply.
- jabberwik 5y ago
  To me, a negative response says "We have evaluated our policy and decided that we will not stop this." A non-response says "A frontline agent didn't know how to make a call on a non-downtime ticket from a non-customer so now it's in a bureaucratic black hole and nobody has actually read your email and probably never will." Which is still crappy, but not really malicious in the same way.

jjoonathan 5y ago

It feels like this is more a result of Amazon not being able to connect you with the right escalation path to verify & act on these claims than a considered decision to ignore them. Does anyone here know what an individual reporter should do? Is there an escalation ramp that exists but was so poorly marked that neither sloshnmosh nor Amazon support was able to find it? Does the ramp go through other organizations (e.g. report to CERT or some other org first and come back with a case ID)? Does the ramp not exist and need to be built?

LoveLeadAcid 5y ago
Nah, Amazon has a cozy relationship with intelligence agencies (CIA, for instance, uses Amazon for cloud services) and they probably don’t want to step on any dangerous toes or lose money and business.
bbarnett 5y ago
It feels like this is more a result of Amazon not being able to connect you with the right escalation path to verify & act on these claims than a considered decision to ignore them. Those two things are actually the same thing, both are wilfully ignoring situations like this.
- seanmcdirmid 5y ago
  Never assume malice where ignorance and incompetence would suffice instead. Those two things are actually not the same thing at all, depending on how you define “willful.”
  - csharptwdec19 5y ago
    It's malice but from a different aspect; willful malice in the name of 'cost cutting'.
    - deleted 5y ago
      [deleted]
    - 5y ago

reaperducer 5y ago

Amazon refused to do anything about it. Actually "refused" to do anything about it, or didn't respond to you?

Scoundreller 5y ago
I’ve had government agencies claim it’s not a refusal/rejection if they refuse at the moment and claim you might (with no guarantee) have success if you try later. I call it a “constructive refusal”.
- smokelegend 5y ago
  i.e. "differed success"

TechBro8615 5y ago

I wouldn’t be so quick to rush into a future where Amazon takedowns are as easy as YouTube DMCA requests.

DSingularity 5y ago
Yes! Let’s stay in a present where Israeli hackers-for-hire can help dictatorships capture and murder dissidents. At a minimum we should demand transparency and accountability from all of these scale-enabling organizations.
- hef19898 5y ago
  I guess your founder and CEO being victim of something similar helps in these decisions. Or not.
  - deleted 5y ago
    [deleted]
- ben_w 5y ago
  Obviously I am not in favour of that either. Making takedowns automatic on any user report means the dictators take down the apps of the dissidents. In the absence of AI that would necessarily have to be good enough to also radically change society and the economy, the only solution I can even think of is a big increase in funding for the policing of apps. Who exactly would fund that? Governments would want to use such powers to pursue their own agendas, while Big Tech taking a proportion of App Store income is already being called “[Apple|Google] tax”.
  - DSingularity 5y ago
    Why can’t we we reduce cloud provider margins and use that money to fund it! I mean — why is this not obvious? Force these companies to adhere to certain regulatory standards - the minimum of which is transparency and accountability.

squarefoot 5y ago

That NSO Group infrastructure was burned, the one you reported (still) isn't.