Amazon purges account hijacking threat from site

Amazon.com administrators on Tuesday closed a security vulnerability that made it possible for attackers to steal user login credentials for the highly trafficked e-commerce website.

The XSS, or cross-site scripting, bug on Amazon Wireless allowed attackers to steal the session IDs that are used to grant users access to their accounts after they enter their password. It exposed the credentials of customers who clicked on this link while logged in to the main Amazon.com page.

It was discovered by Nir Goldshlager, a researcher from security consulting company Avnet. It was purged from Amazon about 12 hours after The Register brought it to the attention of the website's security team.

"This is very bad news," web application expert Jeremiah Grossman of WhiteHat Security said of the flaw shortly before it was fixed. People who fell for the attack would likely be unaware anything was amiss "since it all takes place on Amazon's website."

XSS bugs are the most commonly found security vulnerability, Grossman added. A similar flaw was recently exploited to give malicious hackers access to a heavily fortified server operated by the security-conscious Apache Foundation. ®