GoDaddy Breach Widens

https://www.wordfence.com/blog/2021/11/godaddy-tsohost-mediatemple-123reg-domain-factory-heart-internet-host-europe/

by mmaunder • 5 years ago

167 65 5 years ago

wordfence.com

circusafro• 5 years ago

Has this data been made available anywhere?

colbyhub• 5 years ago

asking for a friend

mmaunder2• 5 years ago

OP here - at least for the link. My colleague Ram Gall wrote the post. Haven't seen an official announcement that mentions all the affected resellers like this. We reached out via a friend who works at GoDaddy who put us in contact with the spokesperson who gave us the quote included in the post. That lists the specifically affected hosts.

prox3• 5 years ago

I recently saw a huge uptick in scam activity and probing on my sites. I guess this pretty much explains that.

hereforphone3• 5 years ago

I think everyone is pretty much probed constantly these days. I always see stuff from Shodan and similar organizations, at a minimum.

prox3• 5 years ago

Yeah but I saw huge surge starting from end of October to begin of November. Like double from normal.

hk1337• 5 years ago

I didn’t even realize MediaTemple was still around. I figured godaddy just fully engulfed them when they took over.

YuccaGloriosa• 5 years ago

When is this "small number of users" going to end?

notreallyserio• 5 years ago

Hey, what do you know, they still haven't acknowled the breach on their "Newsroom" page[0].

0: https://newsroom.godaddy.net/newsroom/overview/default.aspx

wjamesg• 5 years ago

I’m not seeing it there but here is something:

https://aboutus.godaddy.net/newsroom/company-news/news-detai...

skeeter2020• 5 years ago

and they won't. You can't ever get the stink of a data breach off your core website seo, so instead they will use other outlets or buy some throw away domain like "godaddyidentityprotection.net". Lord knows they can do that cheaply (though they might have trouble setting up their wordpress site!)

croutonwagon• 5 years ago

They are sending emails to customers.

Mine is copied below the line.

Here’s the rub though. We haven’t hosted any Wordpress with them, or anything for that matter. We only registered some Vanity domains with them. They aren’t even the registrar on our primary domains.

———————————————-

Dear Company,

We are writing to inform you of a security incident impacting our GoDaddy Managed WordPress environment you once purchased and used. According to our records your Managed WordPress account is no longer active.

On November 17, we identified suspicious activity in our WordPress hosting environment and immediately began an investigation with the help of an IT forensics firm and have contacted law enforcement. Our investigation is ongoing, but we have determined that, on or about September 6, 2021, an unauthorized third party gained access to your customer number, email address associated with your previously used Managed WordPress account; and the password you first used when setting up your WordPress Admin login.

If you use that same password for other accounts, we recommend you change your password to those accounts and adopt data security best practices, such as choosing a strong unique password, regularly changing it, and enabling multi-factor authentication where available. We also recommend that you remain vigilant for potentially fraudulent communications sent to your email address purporting to be from GoDaddy or other third parties.

For residents living in California, Colorado, Delaware, Illinois, New York, New Jersey, Oregon, Vermont, Washington, and Wyoming, please visit https://www.godaddy.com/help/a-41004 for additional resources that describe additional steps you can take to help protect your information, including recommendations by the Federal Trade Commission regarding identity theft protection and details on how to place a fraud alert or a security freeze on your credit file.

Thank you,

Demetrius Comes

Chief Information Security Officer

d1sxeyes• 5 years ago

"If you live in a state other than California, Colorado, Delaware, Illinois, New York, New Jersey, Oregon, Vermont, Washington, or Wyoming, we're under no legal obligation to do anything to help you, so don't bother checking that help article".

Seriously, why list out those specific states rather than just saying 'check our help guide available at https://www.godaddy.com/help/a-41004 for additional resources that describe additional steps you can take to help protect your information, including recommendations by the Federal Trade Commission regarding identity theft protection and details on how to place a fraud alert or a security freeze on your credit file.'?

Just seems a bit poorly thought through.

wackget• 5 years ago

"Plaintext passwords". Quality.

hereforphone3• 5 years ago

GoDaddy is garbage. I think most tech-inclined people switched years ago. Namecheap has never let me down.

bluedino• 5 years ago

I always find the founder or the first "other" person at the company registered the domain at Godaddy or Netsol or somewhere equally terrible.

And then it's "well we bought five years so let's wait to renew it somewhere else"

djbusby2• 5 years ago

Why fix a bad decision for $100 - amirite? We gotta be "smart" with our money.

oefrha• 5 years ago

well we bought five years so let's wait to renew it somewhere else

You do realize you can transfer at any time after the 60-day ICANN change of registrant lock period, and it’ll just add to your five years at the new registrar, right?

edgyquant4• 5 years ago

Uh oh :( I’ve been using godaddy since like 2005 and never used anywhere else. Of course that’s just for domain names I haven’t hosted with them since VPSs (and the cloud in general) became cheap.

I could Google it, but what else is bad with godaddy and should I switch?

Fckd2• 5 years ago

they steel domain names if thats not good enough, i do not what else can be

wswope• 5 years ago

I’ve used quite a few different registrars over the years, and the only one that really stood out as bad was in fact GoDaddy (tacky UX* and dark patterns in registration flow). Most other big name services you choose will be fine; personally I’ve been using Google Domains… but I’m not exactly a Google fan either. As for historical reasons people dislike GoDaddy, here’s a starter: https://en.wikipedia.org/wiki/GoDaddy#Controversies

*NOI if you’re reading this, Darren

karlshea• 5 years ago

I'll shill for Hover, been with them for many years.

guessbest2• 5 years ago

I used to think the same thing, but considering their name registration isn't even price compatible $13 annually without coupons and their shared hosting is over $10 a month, they are worth considering moving on from. I did because their hosting was just too expensive with them refusing to offer coupons to existing customers to renew hosting or domains. They used to be a lot better.

sanat• 5 years ago

I can attest that GoDaddy managed WordPress hosting is Garbage too.

Have been a very happy customer of WPEngine - and have had a lot of clients thank me for WPEngine's brilliant support.

Get 5 months free on annual shared plans, effective 11/22 - 11/30 - for cyber week.

Here's an affiliate link if you feel like supporting me. https://wpengine.com/plans/?coupon=cyberweek2021&SSAID=13835...

traeregan2• 5 years ago

Switched here long ago as well (and still recommended switching to all clients).

1and1 / IONOS isn't much better, and I'd recommend switching from them as well.

Hover.com FTW.

aww_dang• 5 years ago

They recently bought Uniregistry and transferred all of the customer domains. If you had a Uniregistry account, you can't transfer away from GoDaddy for 3 months from the date, coming up in a few weeks.

As much as I am looking forward to getting away from them, I'm not looking forward to jumping through the hoops they'll inevitably put in my way.

I was shocked at how terrible their service and prices were. Whenever I renew a domain I'm met with an absurd stunt billing attempt. Support is horrible, they can't even do email with tickets. Instead they have a chat system which automatically closes and the support staff game it by stalling.

prox3• 5 years ago

What kind of practice is that??

keyle3• 5 years ago

   "GoDaddy was storing sFTP credentials either as plaintext, or in a format that could be reversed into plaintext."

Goddamn, anyone else, feeling a deep anger rising, when reading this in 2021?

   "According to the report filed by GoDaddy with the SEC..."

In 2021, everyone has to be pissed off by javascript popups about cookie storage, but your passwords safety, screw that. Storing SFTP passwords reversible to plaintext, that's still fine, right?

As long as there is a SEC report... We look professional!

djbusby2• 5 years ago

I'll bet on base64 "encryption"

keyle3• 5 years ago

VGhhdCdzIGEgc2FmZSBiZXQhIFRoZXknbGwgbmV2ZXIgZmluZCBvdXQhIFRoZSA9IGF0IHRoZSBlbmQgaXMgbmV2ZXIgYSB0ZWxsIHRhbGU=

smolder• 5 years ago

Ah yes, be sure to base64 encode your secrets before commiting them to the git repository, everyone!

slivanes• 5 years ago

I would rot13() it twice to be extra safe. /jk

coldcode• 5 years ago

As long as companies view security as a worthless expense, and the only penalty is some monitoring (that no one uses) and a brief story everyone will forget, nothing will change. I doubt the stock will even be affected.

Maybe the CEO should be required to be put in stocks in the town square or something. With no real penalty, there is no change.

mmaunder2• 5 years ago

Stock is down 9% since announcement. It’s an interesting case study because you get clear arithmetic on how much this breach cost shareholders. Almost exactly one billion dollars. May be short lived but useful data nonetheless. Will inform infosec budgets going forward.

https://ibb.co/QMy8pZb

Fckd2• 5 years ago

Back in 2006 as a college student, i had a sense of hashing passwords with salt.

geoduck142• 5 years ago

What a visionary!

dreyfan• 5 years ago

anyone else, feeling a deep anger rising, when reading this in 2021?

Look at most of the stories on the front-page of HN these days. Often some shiny tool to allow front-end JS devs to write and deploy full-stack applications automatically upon commit. I guarantee you they’re making similar newbie mistakes. Instead of SFTP it’ll be a serverless endpoint that returns entire User records, unhashed password and all, without any sort of auth check.

tinco• 5 years ago

This has nothing to do with newbie mistakes. GoDaddy has been a household name for decades. This was not a newbie mistake, this was negligence and refusal to invest in modern technologies.

I'd rather risk it with the newbies, modern stacks usually have good tutorials and standard solutions to most security sensitive problems.

Last time I dodged a product because its website looked like it was designed in the early 2000's it was SolarWinds just over a year ago..

sombremesa• 5 years ago

Yep, just left a company where the contractors building out a core solution had just such an endpoint where you could get anyone's data, and worse, personal photos.

And of course, every API key and secret was just hanging out in the repo as well.

ttybird• 5 years ago

I don't really see the issue. It's not like some sort of deadly sin. If the users re-use passwords then that's on them.

jjeaff• 5 years ago

As far as security goes, I would definitely include storing passwords in plaintext in a list of deadly sins.

kawsper2• 5 years ago

I wrote Tsohost about them storing password in cleartext back in 2015, but I never heard anything back, so I wrote a blogpost: http://kaspergrubbe.com/tsohostcom-stores-passwords-in-clear...

gregoryl• 5 years ago

Your site isn't serving a valid SSL certificate on https://kaspergrubbe.com

forgotmypw17• 5 years ago

Not everyone wants to buy into centralized, authoritarian infrastructure.

kawsper2• 5 years ago

Thanks for letting me know - it is a limitation of svbtle.com, it's on my endless list of things to move.

nerdawson• 5 years ago

I have an account with CloudWays which is very popular in the WP space. Logged in a moment ago and there's a password field for a server's SSH/SFTP that can be revealed. Isn't that the exact thing that GoDaddy have just been stung by?

hereforphone3• 5 years ago

Owning intensifies

GoDaddy Breach Widens

Related Stories