(05-18-2022, 06:24 AM)Canadian Moose Wrote: (02-09-2022, 08:40 PM)batmaner Wrote: So guys I'm tweaking a method on Amazon but I get my acc banned.
This method requires multiple accounts a day to be created and used, and need to be anonymous ofc.
Up until now they have stated that I didn't follow their terms and agreements and once about linking the account to an already blocked one.
I am fully aware that the company in question is one of the wealthiest and most developed, but I have a vague understanding as to how they may be linking the accs and banning them.
IP Address
- This one is tricky with them, apparently you can't use a VPN because your payment method gets blocked instantly. Using Socks5 is apparently also bad because you get flagged or something.
So I changed my IP Address by restarting my internet modem and according to IP checkers it changed the IPv4 and IPv6.
Cookies
- For this one I think a CCleaner should be sufficient after the creation of a new acc, just clean the browser and I should be good to go again.
Mac Address
-I want to use a tool here after every acc created.
Account Names and Passwords
-Apparently Amazon's security system can cross reference acc names and pass and should be able to find you because of the repetition of these values.
My question here is do you guys know of some Information that can be used to track me down and connect the accounts together?
Thanks in advance
Some of my own experiences:
I've used VPNs to order off Amazon no problem, that's usually only the case with gift cards when you're using a VPN from another country (only case I've seen it an issue)
Account names, ok that makes sense, but passwords? Someone who's more knowledgeable when it comes to encryption, maybe @vittring can comment on that. If they truly can cross check passwords, doesn't that mean they can decrypt them? Might sound super dumb but my understanding is encryption is not meant to be identical so if they can cross-check passwords, that either means they can see them or decrypt them? Clearly I'm not well versed in this sort of security
Your IP can easily correlate services using the same IP to access them. That's why it's recommended to use a VPN, so the services aren't using the same IP. VPN's provide this to the user but this is not to be confused with anonymity. You are not anonymous using a VPN, because the VPN provider still knows you and what you're doing unless you signed up by paying cash and using a fake name and other information, it's directly traceable back to you. Some services automate the blocking of clients on their apps, websites, etc. The ISP can see what clearweb services you sign up to and this information, you can guess, will be logged indefinitely. It can be requested by officials seeking to check your service usage across multiple accounts. An easier way to check for "alt" accounts is by checking their own database for accounts using IP's in the same range or net block. Changing your IP generally does not provide any form of anonymity and your accounts are being correlated by net range, third party tracking and cookies, etc. What method are you using to create these accounts? If you're using a VPN that just means you're now using that VPN net range for every service further deanonymizing you. You lose all OPSEC because now an attacker knows you use that VPN on everything. A VPN is not Tor, and most VPNs use 128 or 256 bits to encrypt your data, which isn't much anyway. My VPN setup on my home network is giving me 256 bits encryption which is then wrapped in multiple layers of encryption via Tor, then coming out of the exit node still encrypted. I use a daily setup of Tor > VPN > Tor. You can also do VPN over Tor or Tor over VPN, just Tor, etc.
Moreover, you are able to purchase goods from services and vendors in general while using a VPN. But you may be flagged if you use multiple different IP addresses in one account or IP's that are already on a block list, because this looks "suspicious" to the provider of the service. This process is usually automated and places you on a short- or long-term shadowban list that is set to stop fraudulent activity at Amazon and others.
Cookies (LSO cookies, especially) are very tricky and can be used to not only track your usage of the service but also track your usage of other services across the internet. There are such things as long term cookies that only sanitizing your OS in specific areas. Cookies are generally stored inside your machine in various places to make it harder to remove them. You are better off cleaning your entire OS using a clean install to completely remove their presence. You must sanitize your browser per session, and you must also prioritize compartmentalizing your different tasks. Something that helps is Qubes, but it is very technical and requires a lot of RTFM hours.
MAC is another tricky one. Generally speaking, your MAC is a hardware identifier and is logged by every router you access, because it ideintifies your device on the network. It is propogated across your entire network because if your network is not properly compartmentalized, your data is spoken from one device to the next, especially IoT devices. Smart devices are a huge proponent of the evil that is cross-device tracking. If you access your TV to watch YouTube, it sends the usage statistics including all hardware identifiers, down to serial number, to the service provider and YouTube. Your in-home activites are monitored and tracked by companies to build a profile of you in their various databases. The IAO is collecting all information and aggregating data simply because it can, but also because this is how data brokers make money.
Account names are easy to address. Just don't use the same (even remotely similar) usernames across services. Use something like fakenamegenerator to do this for you. This way, you will never have to worry about being correlated across services. It's good to use random names that look real, but even then, it can still be circumvented with automated services that are setup to demand your PII for further use of the account. Twitter, Facebook, Instagram, all require basic IRL identifiers like an ID or phone number, while also blocking those accounts that sign up using fake emails, phone numbers (VIOP as well, even if it's legitimate and not used for fraud).
Your passwords are usually not stored in clear text, at least, not by any service living in the modern age. These sites get flagged as unsafe and should never be used by any means. Passwords are usually stored in encrypted format. That said, when stored encrypted (and salted, hopefully), the passwords that are saved across services can only be seen by people with authorized access to the data such as developers, administrators, and site owners. You're safe as long as you use a strong passphrase, both cryptographically and logically. Never use the same passwords or passphrases or pins across multiple services, especially your important accounts, to prevent one hack turning into a full identity takeover. If someone gains access to your email account, they have access to every service which uses that email for password resets and authorization. That includes your bank account, your cell provider, all accounts using that email for access. It would be catastrophic to use one weak password across 5 services. If one is hacked, it can end up in a database, your password can be added to a dictionary of hacked passwords, etc. It's bad, in short. Always use a strong master pass phrase that protects your other passwords in your password manager, protected by multi factor authentication (MFA).
That said, most providers will already have access to your passwords as stated above. Do not mistake database encryption to mean your account passwords are invisible to the owners of the service. It's easily viewable internally, so you're trusting the service to store it. Again, another reason you shouldn't use the same one on another account on a separate service. It's very bad OPSEC to use one password on multiple accounts.