Slashdot Mirror
GoDaddy Accounts Vulnerable To Social Engineering (and Photoshop)
itwbennett writes: On Tuesday, Steve Ragan's GoDaddy account was compromised. He knew it was coming, but considering the layered account protections used by the world's largest domain registrar, he didn't think the attacker would be successful. He was wrong. Within days, the attacker gained control over Steve's account just by speaking to customer support and submitting a Photoshopped ID.
This is reason 363956 why you don't want to use GoDaddy to host your name or accounts.
What's next?
Go get a cup of coffee from a store owned by a company run by a bunch of rich white people and be implicitly called a racist?
I'm not sure I believe this story. GoDaddy doesn't offer customer support, so how could the social engineers have spoken to them?
Should sexist opensource developers have their projects censored or removed?
Recently an opensource game release story was removed due to the game developer's open sexism(0) and harrasment(1) of women in tech.
A story posted by the editor of the popular Phoronix linux news site about a release of an Open Source videogame was later manually removed(2). The reason cited was the game developer's unacceptable views on social issues such as gender equality (3).
The release story was titled "Xonotic-Forked ChaosEsqueAnthology Sees New Release - Phoronix" and can be accessed via the google cache(4).
With the recent inclusion of a code of conduct(5) for those wishing to contribute to the Linux Kernel some questions now need to be asked and answered about the inclusion of code from people who are known to engage in or promote socially unacceptable attitudes or harrasments of those whom the free-software movement would prefer to attract in their place:
* Are the social or political views of an author of free software relevant to that software's inherent quality?
* Should the beliefs of an opensource developer weigh when when evaluating whether a piece of opensource software is worthy of any publicity or public notice?
* Should men with unpopular or "forbidden" views be excised from the opensource movement and "not allowed" to contribute, in a manner similar to that which is done in employment?
* Has the free/opensource software movement changed in these respects since its founding? If so is this a positive change?
* Should there be gatekeepers to opensource that decide who may and who may not contribute. Should abusive developers be "blackballed" to maintain proper social order and controls?
and
* What are the consequences of not doing this
Citations:
(0) Past related incident: http://esr.ibiblio.org/?p=1310
(1) http://geekfeminism.wikia.com/...
(2) Removed story URL: http://www.phoronix.com/scan.p...
(3) http://www.phoronix.com/forums...
"Fortunately, the article has been removed now."
"Thanks everybody for speaking up."
(4) https://webcache.googleusercon...
(5) Linux "Code of Conflict"
Has someone informed Fox News? They can call it Godaddygate oder Benghadddy!
Really? Never heard of Identity Theft. Anybody can do the same thing and walk out of a bank with all my money. Unless you are recommending some sort of National ID system hard coded to my DNA, then these type of "hacks" will always happen, or at least you will know its your twin who stole it.
I use Gimp for Linux.
Most secure systems can be overcome by a clever con artist. I am not a fan of GoDaddy, but they are not the only ones who could be tricked in this way. All you have really done with this article is teach the criminals how to con and trick their way past many company's standard security policies.
Thanks for that.
... is the name of a domain name I searched for on their site to see if they'd bite.
A few years ago I thought I'd buy a domain for myself. Went and searched for it on their site. NEVER DO THIS.
It wasn't taken.
I ummed and aahed and slept on it.
I came back. It was taken. By Domains By Proxy LLC. Who are owned by GoDaddy.
It seems to have been sold on to another speculator, unless Afternic are them too. (I just checked. Afternic were bought out by GoDaddy in 2013).
I own the .co.uk variant of it now. I used GANDI, who by all accounts, are not wankers.
So, if you want a domain, be prepared to buy it on the spot if it's available. And use a registrar who aren't arseholes.
man walkIng. It's PPor priorities,
Don't feed the huckster as I inadvertently did...
On the 1st page, I was confused by the alleged victim writing his description of the attack in the wrong person... then on page 3 you learn that the so-called "attack" on which the article was based is actually a fake attack (by the author, looking to boost hid street 'cred' as a security guru?) on an account setup just to be attacked for this article.
This sort of "story" is nothing but a dishonest ad, erroneously promoted on Slashdot.
[ben stein voice]Editor? ... Editor? ... Editor? [/ben stein voice]
I've noticed that a lot of companies demand a photo id to verify your identity when they have doubts. I refuse to ever do it for two reasons:
(1) Its practically inviting identity theft. I mean W T F? How do I know some disgruntled employee isn't keeping a copy of every scanned ID that comes in and then selling the info on some darknet market?
(2) Its totally forgeable. There is no way they verify that a scanned ID has not been photoshopped, all the anti-forgery stuff on them depends on it being the original copy, duh. It isn't like they can pull up a copy from the DMV. Some DMVs do sell the raw data (the ones that still do let you opt out of being sold when you get your license), but they sure don't sell a picture of the ID.
It has got to be one of the stupidest, ineffectual, bass-ackwards policies I've seen. And yet it is so common.
Wow, guy who owns the account managed to get access... to his own account. Wow, what a great story, bro.
>"gained control over Steve's account just by speaking to customer support and submitting a Photoshopped ID."
Are you sure it wasn't a "Gimped ID" or any number of other programs? Yeesh.
Hint: "photoedited" ID.
They should only accept orders as signed emails from a public key you provide on first registration.
I recently transferred one domain (I plan to transfer the rest), but came across an interesting issue in the process. The domain used a proxy registration to hide my information (as recommened in TFA), but, in order to allow the transfer, I had to disable the proxy registration and make it public. Thus, for some time, my privacy protection was not effective. Now this wasn't a big deal for me, but it could be for others.
Also, note that GoDaddy's domains by proxy makes the total cost of a private domain registration far higher than many other registrars.
The real "Libtards" are the Libertarians!
While it's cool to shit on GoDaddy here, it is not only that company that can fall to this type of an attack. They have to implement better security features themselves rather than just trying to sell their own version of 'security' to their customers (extra $$$ for preventing your name and email and whatever else, possibly address from being queried by whois).
I think at the very bare minimum they can implement some sort of a secure word / pin / voice password and maybe a call back to a phone number as a secondary measure.
You can't handle the truth.
This is an obvious example of needing government legislation to make companies behave properly.
You'd think GD would get their shit together, but they never do.
Wrong, it is not. Bad PR and people using or not using the service is all that is needed. Government violence is never the answer.
Sat 3/21/2015 9:53 am. The story simply demonstrates that dedicated human guile will likely win. The point of most security is to make cheap *robot* attacks harder.
After all, if the security guy failed to get through the telephone approach, he could hire a cute girl to suborn someone in the company -- for enough $. And if that didn't work, he could kidnap somebody, etc.
But if you think a service with hundreds or millions of users is proof against high-level efforts, you are dreaming.
NearlyFreeSpeech.net offers many TLDs (not all) for registration. If you use them for DNS, their config page isn't that great IMO (it's a bit slow and cumbersome), but I like just about everything else about them.
Relevant to TFA: you can configure how many "recovery actions," between 2 and 7 (default: 3), which are required before you're granted access to lost account credentials. They also offer a "scorched earth" option: if you lose access to your account, it's gone forever (any associated services will persist until the account runs out of funds).
Screenshot of NFS.net account recovery settings