advice How Two Factor Auth totally saved my A**!

[frostify]

I'm hoping that this post serves to vouch for how two factor authentication on your domain accounts can protect your account and keep your investments secure.
-
The true story:

The night before I got a strange email from a Chinese company asking if I would permit a company in China to operate under the company name "Frostify" which as you may recognize is and has been my username on NamePros (as well as Flippa, Pheenix, and other domaining related sites). As I am the owner of Frostify.com (which is available to anyone on BB had this company wanted to rightfully buy it) and have used it as my username/"brand" for about 5 years, I told them they cannot have it unless they were willing to buy the rights along with the .COM on BB.

Now keep in mind this email (which I read from my @yahoo.com account on Yahoo.com itself through the web browser on chrome with a Mac Mini that I keep up to date and basically malware/virus free) had no file attachments or downloads or anything like that.

No response from Chinese company, I go to sleep.

So I was awaken at 8AM before my commute to work when my phone went off with a text message. I thought maybe it was a friend or family wanting to chat but this message came from GoDaddy and said "Your 2-Step Verification Code is: 123456" (obviously not the actual code). The only time I receive this message is after a successful username/password attempt on my GoDaddy account and then the final step would be to enter this code. LUCKILY the two factor auth is the ONLY thing that stopped a potential hacker from getting into the account (which has Frostify.com assigned to it as well as many other investment domains and even personal names such as *firstname*.xyz and *firstlastname*.com and domains of website projects I have.) I would honestly say it would be much worse for me financially to have my GoDaddy account hacked then it would be to have my bank acc hacked. (it's harder to recover from a domain hack, I also have more in "savings" with domains than I do in USD).

I have no proof that it was the company from the email the night before that had attempted to hack my account but it is possible. I don't mean to wrongfully accuse them as I have no proof. This is speculation on my part.

I immediately contacted GoDaddy and they were able to confirm that 2 factor stopped them and then urged me to change my pass which I immediately did.

I still have no clue as to how they got my password as it was a password I only used on GoDaddy and it was very secure with symbols, upper case, lower case, and numbers. That part still concerns me.

Now I'm not going to lie, two factor auth is very annoying at times, especially when you just need to make a quick change or check on something you need to wait for them to text you a pin and enter it and all that but it's worth it!

Moral of the story, please enable 2 factor auth on your domain accounts to keep it secure, by having it I totally avoided a nightmare situation where I would have stood to loose my NP username .COM, my personal name .COM, multiple LLLL.com's, One Word Dictionary .com's, and more.

TL;DR: A company *may have* tried to hack into my GoDaddy account, 2 factor auth saved me, everything was fine all due to 2 factor, go now and enable 2 factor.

Edits: disclaimers regarding potential source of the attack.

 

[AuctionBio]

I use GoDaddy, and reading this just makes me want to go implement two step auth right now.

You got to be quick, as I am sure they(hacker) will be following this thread who tried to hack @frostify
so you would not want them to read your comment.

 

[frostify]

I know how they did it. They just used your "frostify" username (chancing it was the same as your GoDaddy username), then used a dictionary attack.

Any password can be cracked, it just takes time. I've seen these hackers work... it's unbelievable. They have special software (like ddos) where they probably try out combos at intervals so it won't be detected by the server.

My username on GoDaddy is not Frostify, still very confused.

 

[frostify]

Another thing I wanted to point out (although it didn't effect my outcome all that much) is to use a different password on your domain accounts that is completely separate from your other accounts especially your email accounts. If the hacker gets 1 password but that 1 password is used everywhere, they have all your passwords. Note: my GD password was unique to that acc though.

 

[Jv1999]

My username on GoDaddy is not Frostify, still very confused.

Is the email you use for GoDaddy login, the same as the email you're using to correspond with the company?

Notice that Godaddy lets you log in with either your username OR email.

 

[frostify]

Is the email you use for GoDaddy login, the same as the email you're using to correspond with the company?

Notice that Godaddy lets you log in with either your username OR email.

No the email was @yahoo.com that I used to correspond with them, my GD email was one @mydomain.com.

 

[Jv1999]

No the email was @yahoo.com that I used to correspond with them, my GD email was one @mydomain.com.

well. that's scary. There's only two possibilities...

1. they've hacked your pc and have some kind of keylogger. (only way really)
2. You somehow inadvertently leaked your username somehow or login email. Somehow. Maybe it's your profile name or something. signature... somewhere.

 

[slimjim270]

@frostify

Is the email used on your Whois for your domains the same email used for your GD account?

If so, you might want to change your password for your @gmail account immediately.

The reason I suggest this... if a hacker gains access to your @gmail account, then clicks "I forgot my password" during the GoDaddy login process - you would be exposed if you didn't have 2FA in place.

A perfect reason to have 2FA for your GoDaddy account and also a good reason for anyone to avoid using your GoDaddy email in your Whois info.

Not sure if that is your situation, but if so, I hope the suggestion helps..

-Jim

 

[slimjim270]

Another quick suggestion...

If your GoDaddy email is a from a Wordpress site that you own, then I would suggest adding a 3-try login lock (delay) Plugin to your Wordpress site. It will slow down a hackers ability to automate their attempts at getting your Wordpress password.

Hope it's helpful...

-Jim

 

[frostify]

Just wanted to say that overall, I am still satisfied with GoDaddy's level of security as my account was not compromised despite a scary first layer attack on the username/password level. Cheers to them and their security team.

 

[ulasbbtr]

Sometimes Godaddy sends two 2FA codes one in at the time of your login and another a couple of hours later after your login. I even received one code two days later. How do you be sure that they got your login password? Did you click any link or open attachment at their mail? Do you have static ip and web services in your computer?

 

[frostify]

My computer is locked down. I actually work in IT. It is a Mac Mini 2014 and I keep it very secure. There was no recent GoDaddy login at the time this happened (by me at least).

 

[BrandChimp]

Apparently Godaddy alows brute force attacks, scary!

 

[WilsonM]

Glad I stumbled upon this thread.

Pretty scary.

 

[Centaur]

To be safe is difficult these days. People are downloading all sorts of extra extensions all day and expect to be safe.
Most likely it was a keylogger (G³ iSam, Spyrix, Actual, etc..)
Don't use Windows, Mac,Chrome, Firefox, Safari, microsof edge, IE ( all the popular ones) Even Chromium is not that safe. If you do just boot from a USB, leave no trace.

 

[frostify]

To be safe is difficult these days. People are downloading all sorts of extra extensions all day and expect to be safe.
Most likely it was a keylogger (G³ iSam, Spyrix, Actual, etc..)
Don't use Windows, Mac,Chrome, Firefox, Safari, microsof edge, IE ( all the popular ones) Even Chromium is not that safe. If you do just boot from a USB, leave no trace.

This problem was long resolved but good advice.
Also, always enable 2FA

 

[Nitindomains]

This problem was long resolved but good advice.
Also, always enable 2FA

Were you using a Yahoo account to handle emails?
Did you reply back to the Chinese company using your Yahoo account?
If yes, then the problem is Yahoo. They must have sniffed the IP and could have installed a stealth malware/program/keylogger to do the needful.

Must only use Gmail for IP masking.

 

[DN_Hunter]

I think there's another possible explanation.

A potential hacker might have called GoDaddy support looking for help to retrieve their account. They can't remember their email used or the username. So the GD Support person will ask fro a Domain Name that is in the account. When the GD Support person tries to access the account associated with the domain name provided by the "hacker", the 2FA will trigger a text with the code. NOTE: it might not be a "hacker" -- it could be a person who actually needs help retrieving their account, but they lost a domain name in GD Expired Auctions but they still think they own it.

Regards,
DN

 

[Ted.T]

Since I enabled 2FA I contacted support several times through chat. I wouldn't believe that a potential hacker contacted support and the sms was the last barrier between him and the desired account. First, when you contact support, you need to add your customer number. Second, every support member asks for your 4 Digit code, and only then the sms is sent.

As I see, potential hacker needs a lot of account info to contact the support, so I don't think it's the situation.
It looks like a coordinated attack, and as others said, a potential malware installed. I'm sure that the lists of compromised yahoo accounts are being sold on the black-market, and for chinese companies it's very easy to buy and use them. So, a compromised email could be the first step in this attack.

 

[frostify]

I believe social engineering is how they hacked my account.
I did not use yahoo, I used a self hosted [email protected] email that was hosted with GoDaddy.

Again, nothing was lost, all is secured now, but be cautious.

 

[dommmain]

It's strange that there are still registrars these days that do not offer their customers 2 factor auth.