PayPal assisted GoDaddy account hacker

[eqz13489]

http://domaingang.com/domain-news/p...tort-owner-of-single-letter-twitter-handle-n/

Still trying to get a hang on this fourm - unsure if i am posting in the wrong spot. Wanted to share this article.

LE: spell checked the Title of post "assisted" lol

 

[enlytend]

Folks should read the whole story (linked from that one) - Allegedly, GD let someone hack into an account (and change all the contact and registrant info) using a partial credit card # as proof of ID. If true, that's a shocking and inexcusable security fail.

 

[Dave_Z]

Correct me if I' wrong but...hasn't Go Daddy consistently asked for (I think) the last 4 digits of the customer's credit card on file for authentication? I gather that that's not their immediate security option, but rather the third or so method if the previous ones fail.

Of course, no registrar wants to necessarily reveal their security procedures, so...

 

[shiftaction]

I'd believe it though, shared on my site

 

[Paul]

The hardest part of circumventing security is learning how it works. After that, the rest is a walk in the park.

 

[enlytend]

If it is true, Paypal is just as much to blame - lame all around.

Anyone handling authentication requests should have it beaten into their heads with a 2x4 that you follow procedures 100% of the time and verify EVERYTHING even if you think the request comes from the ******* CEO. And you test randomly to see who drops the ball and needs a little reminder.

 

[Ms Domainer]

Here We Go Again...

*

I have always said that using the same email address for both account and domain info is foolish because that is a weak point in security.

Most importantly, Go Daddy needs to stop revealing account sellers' numbers/usernames to buyers. Keeping this a secret like a password adds a double layer of protection to the account holder. I have never understood why this concept is so elusive to domain registrars.

Also, account holders can protect themselves by setting up a verification system with Go Daddy.

Had that system been in place, Go Daddy would have never released that info.

But I do blame Go Daddy here.

Ridiculous that this crap keeps occurring.

*

 

[forge]

*
Most importantly, Go Daddy needs to stop revealing account sellers' numbers/usernames to buyers. Keeping this a secret like a password adds a double layer of protection to the account holder. I have never understood why this concept is so elusive to domain registrars.

*

Really good point. That has always weirded me out more than a little.

 

[Paul]

Most importantly, Go Daddy needs to stop revealing account sellers' numbers/usernames to buyers. Keeping this a secret like a password adds a double layer of protection to the account holder. I have never understood why this concept is so elusive to domain registrars.

Well, see, it's so you feel accountable for your actions. Because we all know that if you know someone else's PayPal username, they'll never scam you.

 

[Ms Domainer]

Weak Go Daddy Protocols

*

I'm not quite sure what you're getting at, Paul, although I do believe that users must own part of the responsibility for breaches and take strong measures to protect their accounts -- for example, using strong passwords and usernames, not clicking on dodgy links, and not (inadvertently) giving scammers personal information --

BUT many registrars, including Go Daddy, are not doing enough on their end to plug obvious breach points, mainly the username (numeral account number), which is handed over to buyers -- I'm not sure why they do this. A buyer could just buy a cheap name from the seller, snag the buyer's account number (which is an alternate username), and then hack the account, especially if the password is weak. (I guess one can't fix stupid, though.)

However, when Go Daddy just hands over information to someone who doesn't even know *his* CC number, well, that's a major problem that places all customers at potential risk.

That numpty support person needs to be fired or, at best, go into intensive security training.

I sent off a message to a Go Daddy manager and posted the info on Facebook.

Go Daddy needs to address this problem ASAP.

The thief in question needs to be caught and do some serious jail time.

And Twitter needs to return the victim's handle.

*

 

[jamesosix]

*

I'm not quite sure what you're getting at, Paul, although I do believe that users must own part of the responsibility for breaches and take strong measures to protect their accounts -- for example, using strong passwords and usernames, not clicking on dodgy links, and not (inadvertently) giving scammers personal information --

BUT many registrars, including Go Daddy, are not doing enough on their end to plug obvious breach points, mainly the username (numeral account number), which is handed over to buyers -- I'm not sure why they do this. A buyer could just buy a cheap name from the seller, snag the buyer's account number (which is an alternate username), and then hack the account, especially if the password is weak. (I guess one can't fix stupid, though.)

However, when Go Daddy just hands over information to someone who doesn't even know *his* CC number, well, that's a major problem that places all customers at potential risk.

That numpty support person needs to be fired or, at best, go into intensive security training.

I sent off a message to a Go Daddy manager and posted the info on Facebook.

Go Daddy needs to address this problem ASAP.

The thief in question needs to be caught and do some serious jail time.

And Twitter needs to return the victim's handle.

*

You raise some good points.

I dont think GD or PP will offer the victim any form of compensation, but I do think once this story gathers some pace then Twitter are normally pretty good at fixing things like this in my experience.

 

[forge]

So GoDaddy has switched up its (OUR) navigation for accessing/managing our domains YET AGAIN, and it stinks. Why, oh why, do they insist on doing this? Is this in response to the breach(es)?

Having to play this game every time I want to modify/renew my domains is getting mighty tiresome.

 

[Paul]

I'm not quite sure what you're getting at, Paul, although I do believe that users must own part of the responsibility for breaches and take strong measures to protect their accounts -- for example, using strong passwords and usernames, not clicking on dodgy links, and not (inadvertently) giving scammers personal information

I've edited the post to explain what I was referencing. If it helps, the second sentence was meant to be taken with a heavy dose of sarcasm.

 

[Dave_Z]

mainly the username (numeral account number), which is handed over to buyers -- I'm not sure why they do this.

I imagine for convenience to buyers. Of course, a convenience can also be a (security) flaw.

So far, PayPal (expectedly?) denied:

http://thenextweb.com/insider/2014/...acker-hijacked-50000-twitter-username/#!tUHGM

Expect Go Daddy to do the same, albeit they don't have any other choice anyway.

 

[bmugford]

GoDaddy statement -

Our review of the situation reveals that the hacker was already in possession of a large portion of the customer information needed to access the account at the time he contacted GoDaddy. The hacker then socially engineered an employee to provide the remaining information needed to access the customer account. The customer has since regained full access to his GoDaddy account, and we are working with industry partners to help restore services from other providers. We are making necessary changes to employee training to ensure we continue to provide industry-leading security to our customers and stay ahead of evolving hacker techniques.

-Todd Redfoot

GoDaddy CISO

Contact
GoDaddy Public Relations, [email protected]

 

[Dave_Z]

Well, well, that's nice of Go Daddy to acknowledge their part in the incident. First time for everything.

Reasonably fast, too:

http://godaddy.com/news/article/godaddy-statement-re-n-issue.aspx

 

[Ms Domainer]

I imagine for convenience to buyers. Of course, a convenience can also be a (security) flaw.

So far, PayPal (expectedly?) denied:

http://thenextweb.com/insider/2014/...acker-hijacked-50000-twitter-username/#!tUHGM

Expect Go Daddy to do the same, albeit they don't have any other choice anyway.

*

When I sell a name at Sedo, my user name/account number is not revealed to my buyer. My other details may be, but they are accessible via whois.

Go Daddy could find another way to identify sellers, thus protecting their identity better.

I hope that Go Daddy takes this kind of stuff seriously.

*

 

[Name Trader]

I always use a different account for my domain purchases than the account where I hold my domains. And like Ms_Domainer said your account and whois emails should also be different.

 

[enlytend]

We are making necessary changes to employee training to ensure we continue to provide industry-leading security to our customers and stay ahead of evolving hacker techniques.

Not sure is "continue to provide" is the right choice of words, but about time!

A little slow getting with the program (I wouldn't call social engineering an "evolving hacker technique") but better late than never ... good of them not sweeping it under the rug ...

 

[Zoltan P.]

Here is an update on the story:

http://techcrunch.com/2014/01/29/go...it-to-divulge-info-in-n-twitter-account-hack/

 

[techgal128]

"In the end, Hiroshima surrendered the Twitter handle to the hacker, and regained access to his GoDaddy account. The hacker, advised him to leave GoDaddy for a more secure registrar, such as NameCheap or eNom. He also suggested that he should call PayPal and ask them to record a note disabling the release of any personal info over the phone."

I like how the hacker gave the guy security tips after stealing from him. "This is how to protect yourself from thieving a-holes like me."

 

[timestamp]

And I like how hacker is promoting namecheap and enom, and how namecheap uses N for their logo, and how namecheap used this situation for their transfer code: byebyegd, and how namecheap has been to some hacker meetup lately, and how...
Well, welcome to the future of advertising!

 

[Ms Domainer]

And I like how hacker is promoting namecheap and enom, and how namecheap uses N for their logo, and how namecheap used this situation for their transfer code: byebyegd, and how namecheap has been to some hacker meetup lately, and how...
Well, welcome to the future of advertising!

*

Are you saying that the coincidences regarding the hacker pumping Namecheap and the "N" logo are causes for some suspicion and concern?

:o:?

*

 

[Paul]

Conspiracies, conspiracies everywhere!

If Namecheap/eNom did go the hacker route, they sure wouldn't be dropping their name along the way. That'd be silly. Hackers certainly have their favorites, though--favorite programming languages, technologies, banks, and registrars. Not realizing the negative impact that it has on various reputations, they love to advertise their support. They also have their nemeses, and take any opportunity to make them look bad.

PayPal tends to be pretty secure as long as you know the caveats, but it doesn't cater to hackers. When they're sending funds to each other, it's too easy for them to reverse the payments. (This is why they stick to irreversible payment options, like Bitcoin.) PayPal also forbids a lot of controversial sales, even when legal. They make it very clear who their intended customers are and aren't. Naturally, the hacker crowd isn't too happy about this. Thus, PayPal becomes a prime target: they're not worried about PayPal's reputation.

I'm anything but a GoDaddy fan, and I don't condone such lack of security, but I don't really blame them. They market to small web developers; the sort of people who don't expect their hosting provider to be acting like a bank. This has always been their sector, and they've always offered support accordingly. They aim to walk users through every step of the process, and account recovery is probably an issue that they deal with on a regular basis. You can't sign up for such a service and not expect a generally low level of security. It's a risk you take.

There are plenty of registrars and hosting providers who are prepared to handle more serious customers. My registrar of choice has a completely different interface from GoDaddy's: you can tell it's geared toward a different crowd. Security features are more obvious. They focus on domains; I think they do offer hosting, but it doesn't seem to be a popular feature. My hosting provider has enterprise-grade security with two-factor authentication, support for various one-time codes, an advanced permissions system, complete API support, and RSA key authentication for logging into servers instead of passwords--and it's significantly cheaper than GoDaddy. It doesn't have the easy-to-use website builders, the coveted photo album, or horribly insecure things like FTP.

Did I mention that anyone who knows how to use Linux can intercept your FTP username and password without even being on the same Wi-Fi network as you? It doesn't really matter if it's a secured network. Many hosting providers support SFTP, or at the very least FTPS, so it is possible to securely access your files. GoDaddy doesn't bother to mention this because security isn't a big deal around those parts, even though they do seem to support FTPS (at least, they did as of a few months ago).

 

[timestamp]

Tweet from victim:
Naoki Hiroshima @N_is_stolen Jan 31
Finally, all my domains are belong to @Namecheap. Thanks a lot for your help!

All I can say is well done Namecheap!