Slashdot Mirror
Web-Based Office Suite Zoho Taken Offline By Registrar After Alleged Phishing Complaints (techcrunch.com)
New submitter atxlakeshore writes: On Monday, ICANN-approved domain registrar Tierra.net turned off access to all Zoho domains, affecting 40 million customers worldwide. Zoho, a web-based office suite company, which provides customer relationship and invoicing services to small businesses, tweeted that the site was 'blocked' earlier in the day by Tierra.Net, which administers its domain name.
Zoho customers affected by the disruption reached out to the registrar's support chat and email. Tierra.net then discussed Zoho's account details with these third parties, claiming that phishing attempts were originating from Zoho's webmail service, and these attempts necessitated blocking the company's domains. Zoho is a privately held India-based competitor to Google's G Suite platform, and maintains US offices in Austin, Texas. The dispute has resulted in calls for censure from ICANN. In a series of tweets, Zoho CEO Sridhar Vembu said TierraNet blocked the domain without "ever notifying us of any issue." He also expressed frustrations at not being able to easily reach out to TierraNet executives.
Zoho customers affected by the disruption reached out to the registrar's support chat and email. Tierra.net then discussed Zoho's account details with these third parties, claiming that phishing attempts were originating from Zoho's webmail service, and these attempts necessitated blocking the company's domains. Zoho is a privately held India-based competitor to Google's G Suite platform, and maintains US offices in Austin, Texas. The dispute has resulted in calls for censure from ICANN. In a series of tweets, Zoho CEO Sridhar Vembu said TierraNet blocked the domain without "ever notifying us of any issue." He also expressed frustrations at not being able to easily reach out to TierraNet executives.
It seems the rule of law is breaking down and the presumption of innocence is no longer required and instant guilt is all that's required.
Here's something else ICANN will happily do: You know those emails that come once a year asking you to verify your domain registrant contacts? If you fail to click and verify your address (no matter if it hasn't changed in 20 years) ICANN will also suspend your domain. Though the suspension is miraculously immediate, it takes 6-8 hours to be reinstated.
Millions of business are losing revenue and data because of this. It is ridiculous that a registrar would take such an arbitrary action knowing full well the impact it would have.
I had a client using Zoho Apps for a major portion of their infrastructure. It was terrible, with frequent outages, and tech support completely unable to help with anything. It was actually worse than not helping - they would pretend to help, and then burn three weeks of calendar time saying that they could perform a restoration, when they couldn't.
We migrated them off of Zoho, and are grateful to have done so. I wish we would have gotten away from Zoho sooner. They are absolutely terrible, and I feel genuinely sorry for anyone using any portion of their infrastructure.
You won the lottery.... found a bad domain registrar.
Now I suggest reaching out to CloudFlare or CSC for help transfer your corporate registrar services to; even if it costs $50K a year --- it's better than registering your domain on some fly by night operation ICANN should've discredited for thinking they're the internet police and shutting down domains based on bogus "phishing site" or other charges which have nothing to do with the DNS system.
How would this help in the given situation? ANYONE can technically setup a DNS server for ANY domain name. It is the registrar which lists either the GLUE record or authoritative DNS servers to use. The registrar can simply offline the record entirely, preventing anyone from even knowing which DNS servers to contact for the needed records.
I guess a Mercedes GLS is a competitor to a Radio Flyer... Zoho is WAY more than G Suite...
Browsing at +1 - no ACs, I ignore their posts. So refreshing!
Anti-phishing, not the same thing. The article gives only one side of the issue, nothing from TieraNet.
I don't know how Zoho is or what they do, but if phishing emails are originating from their domain then they should be responsible for it and they can't blame it on their customers.
How do you use Google docs for phishing? Do they allow any customer to send phishing email originating from that domain?
(I never use online apps, so I don't know what these services do or allow)
I'm kind of curious about this too. I'm sure that pretty much every email service out there has been used by unscrupulous users to send out spam, phishing emails, etc. Why single out one service that's probably not even one of the biggest?
"In a series of tweets, Zoho CEO Sridhar Vembu said TierraNet blocked the domain without 'ever notifying us of any issue.' He also expressed frustrations at not being able to easily reach out to TierraNet executives."
Coincidentally, Microsoft and Google announced that carefully-selected business executives have been offered the opportunity to attend multi-week, all-expense-paid team-building retreats at luxury resorts in Thailand and the Bahamas.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
The higher the reliance on a centralized cloud, the more "eggs in the same basket" which break on a whim of some paper pusher in a company you don't control, caused by their incompetence, by their own beliefs or by some viral social outrage. Then of course there is "if we loose your data all you get is your monthly subscription cost back for this month", or "sorry, we're not going to fight a government request for your data", "we're shutting down the service, all the content you purchased and/or created is now gone". The industry keep cycling between centralized and decentralized computing. I wonder when the cloud based services are going to go the way of a mainframe.
Zoho are a major cloud provider for office stuff including email.
Sure there might be some people using it for phishing, but I'd wager they are using gmail, yahoo mail, microsoft 365 mail etc etc.
Should they ALSO be taken offline everytime someone abuses the service? We're talking potentially billions of people constantly (Possibly hundreds of times a day) losing access.
I mean how much guilt by association are we talking here?
Excuse the Unicode crap in my posts. That's an apostrophe, and slashdot is busted.
No, but this is refering to cloud email services. So the better question is "How would you use gmail for phishing". The answer to which is "very easily".
Because thats what we are talking about here. People abusing zohos email service, and then millions of people getting punished for it.
Excuse the Unicode crap in my posts. That's an apostrophe, and slashdot is busted.
This is totally wrong!
Unless, you know, Zoho was promoting a political opinion I didn't like, or something. In that case de-platforming is totally cool.
No. It highlights the danger of not vetting vendors. There's nothing here cloud specific. A shitty vendor had a poor step with a crappy 3rd party that had the ability (and exercised it) to bring them down.
I mean shit I had this same example on a welding job recently. Company we engaged didn't have the necessary quality control to vet their sub contractors and ensure that they wouldn't suddenly leave them high and dry during a critical day. Fortunately we identified this months ago and had a plan b ready.
There's no inherent problem with outsourcing to cloud providers, you just have to know how to vet the cloud providers.
Show me one cloud vendor who will pay for actual losses cause by their outages (rather than maybe refund this months fee), or one that will not provide government with data they request or simply provide a back-door. It's nice how many providers claim 99.999% availability but are unable to offer insurance against it assuming those odds (for example break even insurance would be I pay $1 per day, and for outage I get paid $100,000 per day, or $69.4 per minute, if they paid $50/minute of outage and charged $1 per day for this insurance, they'd be making money, unless of course 99.999% outage is a fake number).
Show me one cloud vendor who will pay for actual losses cause by their outages
Amazon, Microsoft, Google to name a few. Just because you're using a shitty little free service doesn't mean that enterprise contracts don't have very long and strict performance metrics with legal teams on both ends.
or one that will not provide government with data they request or simply provide a back-door.
Rather than asking to prove a negative, you can start by displaying the positive.
It's nice how many providers claim 99.999% availability but are unable to offer insurance against it assuming those odds
And yet that insurance is precisely what is in enterprise contracts.
But ultimately your complaints are completely off point. Before you start incorrectly criticizing the reliability and insurance of cloud based vendors you should first ask yourself: Can I do better? *You* may be able to. The hordes of small business owners on the other hand whose backup strategy involves coping files from one folder to another on the same disk i.e. the types of people who use Zoho in the first place aren't able to.
But then everyone likes to think they are better or top shit until they actually come across a problem of their own. Mersk didn't use a cloud vendor when they managed to globally take down their entire very well funded IT infrastructure including geographically disperse and redundant AD controllers. Maybe they should have.