Abusing Amazon‘s Look Inside feature to leak unreleased content | Hacker News Reader

Abusing Amazon‘s Look Inside feature to leak unreleased content

justmaku.org

139 pointsjustMaku29 comments

> Disclaimer: Amazon doesn't have a bug bounty program and didn't offer anything other than thanks and gratefulness for bringing the vulnerability to their attention. Blizzard Entertainment (as the copyright holder for the book I was testing with) has also been notified of this vulnerability and has offered a small gift but never fulfilled that promise.

I'm not surprised Amazon would pay with nothing more than a nice email. What's more surprising is that Blizzard would give the author the shaft like that. They're usually pretty good about this sort of thing.

Perhaps Blizzard was. Activision-Blizzard seems to have abandoned their virtues.

Yeah, I remember interviewing just after the merger when they opened the Cork office. I was 17, flew to Ireland, and the guy who was supposed to interview me face to face had taken a late lunch, so I got interviewed in about 5 minutes by someone who was clearly not interested, and it then took them 6 months to get back to me.

Nice one, good job guys.

I imagine they get thousands of people applying a day. Sad you flew to Ireland, that's messed up that they forgot.

The bad practices for me, are their pivoting toward lootbox pay2win gambling designs.

Are you sure? In their latest COD loot boxes do not contain anything pay to win. Same with Overwatch which falsely gets blamed for the whole lootbox thing we have going on atm - https://youtu.be/PTLFNlu2N_M

Destiny2 had some issue with theirs but didn’t they listen to the community and fix those.

I’m not a fan of loot boxes but their are not as bad as others in the industry.

I was thinking hearthstone card packs as loot boxes, and they sort of popularized skinner boxes in games with the epic drops in wow

> epic drops in wow

Which was a feature in games before WoW but isn't a pay to win mechanic as you can not pay for "drops". WoW for the longest time refused to have a real money gold shop as was more that people were buying in game gold from 3rd parties anyway so might as well make a safe way to do it (which isn't a direct cash for gold transaction, more that another player has to buy your game time token, but that will usually happen within 30 mins).

As for hearthstone I would lay the blame more at Magic: The Gathering Online personally (though not the first), but I see you point that the game has very popular and became the "cardboard crack" that IRL Magic was (Atleast with Magic: The Gathering Online you could trade / sell your online cards with others until you piss off WotC and they nuke your account).

another similar recent move was the widespread disdane mobile Diablo got at blizzcon, fun YouTube clips of that.

My point about the drops is that skinner boxes are dangerous. My RA flunked out due to wow. Some small group of people really struggle with casino stuff

Then next time someone finds an Amazon bug, they should release it 0-day on their blog for the lulz^H^H^H^H credit.

Or sell it to someone who can make use of it.

It's incredibly entitled for a company to not run a bug bounty program then complain when people drop 0-days on their github blogs.

If you find that someone forgot their car door open, do you deserve money for not telling thieves where you can find a car with an open door?

Bug bounties are a good incentive for hardening your security, but is exploiting flaws the moral thing to do by default? Does there need to be a monetary incentive for people to do the right thing?

I run a service that has a few users and makes about $200/mo. Someone once emailed me that they found a bug and whether I run a bug bounty program. I told them I couldn't really afford one and they never replied. Are they now morally justified to publicize the flaw?

You can't afford aa bug bounty program. Amazon can.

Does that make it moral for someone to disclose the bug? "This parking lot leaves cars unlocked, but since they seem busy and aren't paying me not to, it's okay if I tell thieves about it".

Telling thieves in particular? Absolutely not.

Telling everyone (unfortunately including thieves)? I think it is. Such negligence should be disclosed.

Your analogy has cause and effect reversed. The correct analogy is that if I know there is a reward for telling people their car doors are open, I will go around town specifically looking for open car doors. With no reward, I'm just going to go about my life not even looking at car doors.

Your service may be too small for this, but a company like Amazon typically saves money overall by running a bug bounty program because uncaught bugs can be extremely expensive.

The GP said "the next time someone finds a bug", ie the assumption is that a bug has been found. They didn't talk about whether bugs would be found or not.

Selling zero day exploits is an amoral act.

That being said, your analogy is broken and doesn't fit here at all. First, parking lots are passive and have no intelligence. Amazon is neither of those things. Also, there are no such people who dedicate their career to lawfully testing the security of parking lots in exchange for money.

In the real world of mega corporation technology (which is almost as different from a parking lot as you can get) there are countless black hats motivated by money to steal from Amazon, and countless grey hats who would help combat or mitigate the issues if properly compensated. White hats are the rare exception and report issues even without compensation.

There are numerous grey hats who: 1) If there is a bug bounty program, would report the issue to be fixed 2) else, would ignore the issue entirely.

You know this is true because you experienced it yourself. The difference is you can't afford the service of a grey hat.

So forget the morality of these hackers.

Amazon refusing to pay out a bug bounty program is amoral. Because what you're seeing is Amazon trading the security of their customers, and for what? Greed and hubris it seems.

>If you find that someone forgot their car door open, do you deserve money for not telling thieves where you can find a car with an open door?

Conversely, if you accuse the person who tells you the door is open of stealing from you and threaten to call the police, should you really be surprised if next time that happens they tell someone, maybe in exchange for a cut of the profit?

> their car door open,

Not at all similar. One is leaving open the door to your own car. The other is someone who is being entrusted with keeping something safe for third parties "leaving the door open", i.e. being in breach of that trust, and essentially saying that they don't give a frack about their infraction.

So how can Amazon be sanctioned for this infraction?

While I also don't see "breaking in" as necessarily a great option, it may be less bad than letting Amazon just get away with it. Unless there is a good way to fine or otherwise sanction Amazon, I am not sure there is an actual good option.

Sorry, that's ridiculous and borderline extortion. Sounds like protection money for the mob.

If there's any entitlement, it's within the small but vocal subset of security researchers that feel that unsolicited bug finding should be compensated under threat of public disclosure.

Interesting, the "stitch together a bunch of substrings of a large string" task also comes up in DNA sequencing: the physical process basically randomly samples a bunch of snippets that are each a few hundred bases long, and you need to use software to detect overlaps combine them into one long sequence. It's a pretty heavily-researched computational problem, I believe. The author's simple algorithm seems to have worked, but I guess the DNA case is harder because you don't really have the "page number", you have a lot more snippets to combine, and snippets may have errors, with more errors occurring toward the ends.

Some information on the topic: https://en.wikibooks.org/wiki/Next_Generation_Sequencing_(NG...

The use of that feature to extract significant amounts of content was noticed over a decade ago by Fravia and his followers:

http://search.lores.eu/books.htm (near bottom of page)

Of course, back then it was the norm to publish this information in a place for those seeking information or otherwise "keep it tight", and not instead let them tighten the nooses around our necks by instantly snitching to the company for the hope of a paltry monetary reward...

I think you should consider that some people need money more than a goofy clandestine comradery with other “information seekers” on the internet and also that bug bounties frequently exceed “paltry.”

This is sort of tangential, but: it doesn't make any sense that there's OCR going on in that process. Surely Amazon could just ask for the digital version of the book as a requirement for SearchInside participation?

Not sure how the specifics of this works on amazon but when I read it initially I assumed the results were returned as images which seems to make a little bit more sense, although possibly not that much.

Although reading it again it does seem to be quite unclear...

What was the fix? The article doesn't say.

Reply on news.ycombinator.com