security Social engineering still works! Unfortunately...

[TestCase]

From Krebs On Security.

If you’re running a business online, few things can be as disruptive or destructive to your brand as someone stealing your company’s domain name and doing whatever they wish with it. Even so, most major Web site owners aren’t taking full advantage of the security tools available to protect their domains from being hijacked. Here’s the story of one recent victim who was doing almost everything possible to avoid such a situation and still had a key domain stolen by scammers.

On December 23, 2019, unknown attackers began contacting customer support people at OpenProvider, a popular domain name registrar based in The Netherlands. The scammers told the customer representatives they had just purchased from the original owner the domain e-hawk.net — which is part of a service that helps Web sites detect and block fraud — and that they were having trouble transferring the domain from OpenProvider to a different registrar.

The real owner of e-hawk.net is Raymond Dijkxhoorn, a security expert and entrepreneur who has spent much of his career making life harder for cybercrooks and spammers. Dijkxhoorn and E-HAWK’s CEO Peter Cholnoky had already protected their domain with a “registrar lock,” a service that requires the registrar to confirm any requested changes with the domain owner via whatever communications method is specified by the registrant.

In the case of e-hawk.net, however, the scammers managed to trick an OpenProvider customer service rep into transferring the domain to another registrar with a fairly lame social engineering ruse — and without triggering any verification to the real owners of the domain.

Be careful out there!

https://krebsonsecurity.com/2020/01/does-your-domain-have-a-registry-lock/

 

[equity78]

From Krebs On Security.


Be careful out there!

https://krebsonsecurity.com/2020/01/does-your-domain-have-a-registry-lock/

You would think there would be better employee training and systems in place.

Thanks for posting.

 

[equity78]

Uniregistry does make a point about Social engineering, other registrars should do that.

Social engineering protection
A common tactic employed by criminals to access a secure account is a "social engineering attack", in which the criminal will pretend to be you, hoping that support staff will divulge enough information to make the account vulnerable.

Uniregistry support staff is strictly forbidden from discussing the particulars of your account without first verifying your identity. We guard against attacks from all angles, ensuring the safety and security of your valuable domain portfolio.

https://uniregistry.com/security

 

[RJ]

Earlier today I came across a registrar's homepage that has a picture of their 30 smiling employees sitting together outside their office. I know the photo is meant to instill trust, but it made me wonder how many of those employees might have access to my account to hijack domains or mistakenly grant access to a skilled social engineer. Who can you truly trust to protect your domain names?

Years ago, Moniker used to make the claim that no domain had ever been hijacked from them. These days I don't know which registrars can make that claim. Social engineering is a vulnerability that all registrars need to be aware of and trained to handle. If you have domain assets that are potentially worth millions, this is something to consider when picking a registrar.

Good for Uniregistry for actually addressing this concern. Does anyone else?

 

[bmugford]

Earlier today I came across a registrar's homepage that has a picture of their 30 smiling employees sitting together outside their office. I know the photo is meant to instill trust, but it made me wonder how many of those employees might have access to my account to hijack domains or mistakenly grant access to a skilled social engineer. Who can you truly trust to protect your domain names?

Years ago, Moniker used to make the claim that no domain had ever been hijacked from them.

Yeah, until they had a bunch of valuable domains stolen from FMA (Elequa) -
https://domaingang.com/domain-news/several-valuable-domains-reportedly-stolen-moniker-accounts/

The truth is your security is only as strong as the weakest link, which is often the employees.
You can do everything right on your end, then there can be a massive security breach or an employee being socially engineered. It is a major issue.

Here was another social engineering event that happened involving GoDaddy & Paypal -
https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd

GoDaddy made several security related changes after that event including employee access to accounts.

Brad

 

[Indianad]

From Krebs On Security.


Be careful out there!

https://krebsonsecurity.com/2020/01/does-your-domain-have-a-registry-lock/

Thanks for posting this information!

 

[pb]

Earlier today I came across a registrar's homepage that has a picture of their 30 smiling employees sitting together outside their office. I know the photo is meant to instill trust, but it made me wonder how many of those employees might have access to my account to hijack domains or mistakenly grant access to a skilled social engineer.

More importantly, who was guarding the office when they all went out to snap that foto?
Most registrars, like most companies, are likely to cut costs on customer service, which results in high rotation and inexperienced staff. Lots of times you don't even know who you're mailing with, as they are signing the mails "Jeff R." and the like (if even that). Yeah, privacy concerns are understandable, but so are trust concerns...