21 ms·
Namecheap live chat social engineering leads to loss of 2 VPS
- tshtf 11y agoThe most significant security problem with Namecheap is really this: It only takes a 4 digit PIN to perform any action on an account through live chat (which seems to be outsorced to Eastern Europe), even if the account is protected with a 2FA... All you need is the PIN, and an attacker can do anything to the account. Sometimes you get what you pay for.
- castis 11y agoIf I wanted more security on my account, is there a different service I should be using?
- boredpudding 11y agoAmazon Web Services is great, and as far as I experienced, their support knows more than average.
- infinite8s 11y agoYou can get AWS customer support to reset your password if you know the last 4 digits of the credit card used to pay for the account. This is the same info that's printed on any credit card receipt.
- nommm-nommm 11y agoIf they have your bank account number for whatever reason you can also use last 4 of the bank account number. Your bank account number is not secret by design and most people only have one.
- infinite8s 11y agoNot only is it not secret, it's printed on every single check for that account.
- dorfsmay 11y agoI once lost my gandi.net password. It took sending copies of 2 photo id, and answering the phone listed in the who is database before they reset it. I just wish that their DNS updates were push through faster.
- ryanlol 11y agoThat's not good verification. It takes a couple of minutes to produce convincing fake ID scans, and they aren't going to have anything to verify them against. And presumably they wanted you to send those photos to them as an unencrypted email attachment, right?
- celticninja 11y agoits better verification than most will require.
- ryanl0l 11y agoMost will require a password reset email, I'd say that's significantly better than asking for ID scans. Edit: Since I'm getting some downvotes I'd really like to know how one could possibly argue that asking for ID scans is better than email resets. You can't really forge the ability to receive email at an address, but you can very easily replace the name on an ID scan.
- celticninja 11y agoDid you read the article? I ask because one of the problems was a compromised email account.
- ryanlol 11y agoI did. It doesn't change anything, email is still a way better verification method than ID scans that the company will be unable to authenticate.
- matthewdrussell 11y agoUse 2FA on your Email Accounts Use 2FA on your Namecheap account Maintain a sensible backup policy Store your passwords in something secure like KeePass
- roywiggins 11y agoNearlyFreeSpeech seems pretty serious about this sort of thing: https://www.nearlyfreespeech.net/about/faq#LostEverything https://www.nearlyfreespeech.net/about/faq#LostEverything
- mholt 11y ago> Sometimes you get what you pay for. So what expensive provider do you recommend instead?
- simonsarris 11y agohttps://www.gandi.net/ https://www.gandi.net/
- ryanlol 11y agoThey're cool until they start holding your domains hostage and demanding that you email them a scan of your passport.
- ProAm 11y ago> email them a scan of your passport What? Why do they do this?
- smarx007 11y agoApparently, OP wanted to transfer the domain from Gandi.
- Spoom 11y agoFWIW I painlessly transferred five domains away from Gandi (ironically, to Namecheap), and I was never prompted for anything like a scan of my passport.
- pmlnr 11y agoSome country tlds require copies of legal documents.
- ryanlol 11y agoIn my case there was absolutely no legitimate reason for them to request that. And no, it wasn't related to registry rules or transfers as other users have suggested.
- deleted 11y ago[deleted]
- donald123 11y agoI guess you can't blame them too much, they are a domain seller after all.
- awinter-py 11y agoIs password recovery a bug or a feature? cloud providers seem on the fence about this. AWS has certainly had similar problems in the past.
- ToastyMallows 11y agoIt depends on how its implemented. If it's "Whats your mother's maiden name?" and they let you reset it in the browser, it's a bug. But if they send you an email (in my case to Gmail, that has 2FA turned on), then it is a feature, because then you'd be required to either 1) intercept the recovery email (and get the password reset URL) or 2) know the format of the password reset URL and just happen to guess mine after brute-forcing every possible link (assuming there is no timeout for the URL or anything else like that).
- stephenr 11y agoI had an interesting thought (literally as I was reading your comment) about improving "forgot password" emails, albeit only likely useful for the technically minded: Have the customer provide an SSH/GPG public key, and store it with the account. When a password reset is requested, encrypt a random string using said public key, and email it to the email for the account. An attacker who may have breached your webmail is then reasonably unlikely to also have your private key to decrypt the string. Follow the link (which didn't necessarily need to be encrypted) and enter the string you decrypted to reset the password. On a related note: do any/many sites with 2FA, require the 2FA code to do a password reset?
- infinite8s 11y agoThat's basically what TOTP/HOTP authentication tokens are, which many sites (including Google, AWS, Github) etc use for 2FA - https://en.wikipedia.org/wiki/Google_Authenticator https://en.wikipedia.org/wiki/Google_Authenticator. When you set it up, the service provider creates an 80 bit secret key, which you enter into your local device (or some implementations create a QR code) and then whenever you log in you need to provide a 1-time password from the app.
- devereaux 11y agoThat's bad, really bad. No 2auth can save you from humans who do support. I also had one of my VPS attacked recently, and I feel for you. But the name namecheap says "cheap". Maybe they are indeed cheap? I'm not sure the same would have happened with say HE. You pay, but you know what you pay for and get in return. Personally, I am thinking about moving from a "manually setup" distribution to a "no ssh but deploy", so as to ease reimaging in the future. This way, if a server is compromised, all I have to do it to start the install of a new one. Any suggestion for tools to do that with Debian distro? (yeah I could write a shell script, but I think there must be better tools out there)
- zeveb 11y ago> No 2auth can save you from humans who do support. Well, conceivably the second factor could be used to generate crypto key material which is used to decrypt/unlock one's record, so without the second factor even support couldn't read & edit one's record. Nothing can stop support from deleting & recreating a record though.
- stephenr 11y ago> Any suggestion for tools to do that with Debian distort? If you write apps, package them as Debs. If you need to configure other Debs, make config packages with config-package-dev [1] from the DebAthena project. Create a metapackage that depends on your software + config packages, and your setup process just needs to be "add private apt repo, apt update, apt install <metapackage>". [1] https://packages.debian.org/jessie/config-package-dev https://packages.debian.org/jessie/config-package-dev
- voltagex_ 11y agoThis is fantastic, I wish I'd known about this earlier. Now I just need a way of testing Debian preseed faster than spinning up VMs, and I'll be set.
- ryanlm 11y agoOn another note, there 2FA seems to broken as well. I once received a text about resetting my Instagram account from the same number that they send me to authenticate my login session. I've never had an Instagram account.
- tamar 11y agoNamecheap uses the same 2FA provider as Tumblr, Yahoo, Microsoft, and a slew of other services.
- stephenr 11y agoWhat do you mean by "provider"? I find it hard to believe Microsoft of all companies has outsourced two factor authentication.
- tamar 11y agoIt's true :) We hear about it on Twitter all the time that the same number we use for 2FA is also texting 2FA codes for the other services I mentioned. (disclosure: obviously I work for Namecheap.)
- danielweber 11y agoThe source phone number that the text comes from.
- mrrsm 11y agoDoes Namecheap claim to take backups? Even if they do you should be taking backups as well if you care about your data. I do agree with more login forms needing to support 2FA. At this point I wish almost everything did. It is a bit more hassle but is easy to manage for me at least.
- tamar 11y agoThis was a self-managed server. Managed services at Namecheap have backups.
- joe_momma 11y agothe first error was buying server space from namecheap. good domain server but they get hit frequently being a midsize provider of services, they have enough bait and not enough people to protect it.
- matthewdrussell 11y agoThat doesn't really make sense. We're a great domain and hosting provider.
- newjersey 11y agoThis isn't your part of the business but there is room for improvement when it comes to kb articles in domain https://www.namecheap.com/support/knowledgebase/article.aspx/473/2/demo-changing-host-record-settings https://www.namecheap.com/support/knowledgebase/article.aspx... The domain registration process isn't automated from my experience but it works well. However, I think the meta is (I think many people will agree) to not mix domain and hosting with the same provider. For example, if you get your domain from namecheap, you should not do hosting at namecheap. Therefore, the argument is that if you want to buy a domain name from Namecheap (as they're pretty decent), you shouldn't do hosting there. Sorry if I sound like a prick.
- matthewdrussell 11y agoYou're right. And this sounds like constructive feedback which we love and are always open to. Our KB platform is getting some attention as articles are improved and then the UX will be overhauled. We have work to do here and we're doing it.
- MichaelBurge 11y agoI don't use their hosting, but I have a lot of domains with them. Anytime I've had an issue with the settings on a domain, they've been quickly resolved. Just a few weeks ago I was getting a domain set up with Amazon SES, and one Daria P. helped interpret Amazon's docs to get it verified with them, and explained how I was using the dig command incorrectly to inspect the domain's settings. It's rare you see a support person do that at any company. And, of course, they did ask for a support PIN.
- ryanlol 11y agoI for one haven't seen very many services that don't allow you to reset your 2fa if you control the attached email. Would anyone here seriously expect that someone in control of their email wouldn't be able to take control of associated accounts?
- ajmurmann 11y agoI think this is a very good point that I also overlooked when I first read the article. If someone hacked my gmail account, I honestly am not sure if there would be any account of mine that would be safe. Anyone using the Internet today has to put utmost care into protecting their email address and most email providers enable you to do that fairly easily. There was an article here a few months ago promoting logging in via email token as the only way to log in instead using passwords. Because as you said, 99% of websites allow you to reset the password anyway if you control email, so why bother having insecure passwords? If I remember correctly then that article was fairly well received.
- tamar 11y agoAnd this is an argument for making sure your email provider has two factor authentication to avoid having an external breach that could give someone access to accounts that do not support 2FA.
- Pxtl 11y agoI'd love to have an option on services where I define a X-hour wait period for manual password resets. That is, "oh, I've lost my email account and I need to reset a password so I have to access my account through pleading over Live Chat... they can do that but there's an X-hour wait period before you will gain access to the account."
- ryanlol 11y agoWhich is great until the customer actually needs to access the account. $CUSTOMER calls in, their nameservers are down and nobody has the account password. Do you think the management at $CUSTOMER is going to accept "hey we need to wait 6 hours to get our site back up because namecheap wont allow us in"?
- Pxtl 11y agoLet the customer set it during sign-up as part of the password reset process. You set up your email address and password, let them choose $HOURS for last-line-of-defense password reset. I don't see any perfect answer here. Ultimately you need a way to recover your account when you've lost all of the "somethings you have" and you've lost your "something you know", but then that allows a social engineer access to do the same. So let the user decide during sign-up.
- justusw 11y agoWhat legal consequences could there be for Namecheap, if any at all?
- ryanlol 11y agoWhy would there be any? Would there be legal consequences to YC if I hacked your email and reset your HN account password?
- bdcravens 11y agoThe hacker wiped the VPSs, and there was no backup.
- Afforess 11y agoZero. This is why companies have EULA and Terms of Service agreements.
- deleted 11y ago[deleted]
- koolba 11y agoWhat's this crowd think of this idea for solving this problem? 1) Offer an option to opt-out of all automated account recovery. If set, no more email resets, support PINs, or similar. This would be targeted at people truly care about security and have no issue with "forgetting passwords" (i.e. you use a password manager and you're not an idiot about backups). 2) Offer in-person, manual recovery. To participate in this you'd need to pre-register with full contact details (name/address/etc) of the valid people who could use this feature. The person would have to physically come to the office of the company, present two (or more) forms of identification. To add further security, you could add a mandatory wait period between initiating a reset and it taking effect (ex: min 7 days). That way a combination of fake ids and social engineering could (in theory) be stopped by getting an alert that "You initiated a manual reset of your XYZ account. Did you actually do this??" EDIT: For #2 you could also add a non-trivial fee (say $500) that would need to be charged and cleared in advance of the person showing up.
- StavrosK 11y agoWe do something similar at Silent Circle. In your recovery options, there's a page with a high-entropy secret key and a QR code that you can print out to use if you ever forget your password. There's also a checkbox that says "don't ever recover this account" (i.e. the "I have a password database on Dropbox") checkbox. Checking that box actually disables password resets on the admin interface, so your account is pretty much dead if you lose the password.
- jontas 11y agoOT question about Silent Circle: I was just looking at your website, and I noticed that you cannot ship to PO Boxes. Is this a security feature (eg, no government knowledge of the recipient) or a logistics issue (eg, FedEx/UPS can't deliver to PO Boxes). I would imagine it is pretty hard to get service for your SIM card without revealing your identity to degree.
- StavrosK 11y agoI'm not actually sure about that (I assume you're referring to shipping a Blackphone?). The Blackphones are a semi-separate division that I don't have much contact with, unfortunately.
- matthewdrussell 11y agoDisclaimer: I'm CIO @ Namecheap 1. The credentials were resent to an already compromised email account 2. This is an isolated case 3. Established procedure was not followed 4. With thissaid, we've used this as a learning example and additional training has been provided to the individual involved 5. Anyone with any self-managed server with ANY provider should always keep their own multiple backups
- Khao 11y ago> Established procedure was not followed Why have a procedure if your support doesn't follow it? Even if you have a procedure, everything falls apart when it isn't followed. This is the same as having no procedure at all.
- tamar 11y agoKhao - the matter was addressed and the staff was retrained to close the gaps in procedure.
- eximius 11y agoHopefully because the majority will follow it? We have no statistics on this, just this one case that failed.
- deleted 11y ago[deleted]
- SeanDav 11y agoPeople make mistakes. The customer support person was probably just trying to be helpful and not fully aware of all the ramifications. This is unfortunate but presumably there has been some retraining. Note: I have no direct or indirect relationship with Namecheap at all.
- teraflop 11y agoSure, but retraining doesn't change the fact that people make mistakes, so it doesn't really solve the problem at all.
- kayoone 11y agoDon't get the backup complaints, thats bad luck but you can't blame the hoster for not having backups.
- tyingq 11y agoNot trying to be snarky, but the biggest lesson here seems to be "don't operate without off-host backups". Cheap VPS providers don't typically offer that sort of thing as a standard feature. Even when they do, the backups would be on the same infrastructure, and easily wiped from the same (compromised) console. You could have just as easily lost all the data in an accidental way, with no malice or 3rd party involved. That said, I do empathize, and it's disappointing that a major player like namecheap would be so easily socially engineered.
- matthewdrussell 11y agoWe offer full backups with all managed servers/services Self-managed a customer is responsible for their own backups. Just like with DO and that full server loss a couple of months back.
- joenathan 11y agoWe who?
- citricsquid 11y agoMatthew Russell is the VP of Hosting at Namecheap https://www.namecheap.com/about/team.aspx https://www.namecheap.com/about/team.aspx
- nxzero 11y agoWhat if any fault does Namecheap take with the breach and what is being done to resolve it?
- matthewdrussell 11y agoSee my other comments in this thread
- 11y ago
- matthewdrussell 11y agoAlso let me reiterate this is an isolated event. We handle over 10,000 chat sessions every day without a glitch. I invite people to use our live chat service and see what is and what is not possible, as well as the security precautions we have in place.
- ryanl0l 11y ago>Also let me reiterate this is an isolated event. Is it? Does that mean that my ability to reset your users solusvm passwords with or without 2fa constitutes as a 1337 0day? Hey BTW, remember that time you got hacked through your support site and didn't tell anyone?
- onion2k 11y agoAlso let me reiterate this is an isolated event. We handle over 10,000 chat sessions every day without a glitch. What do you use to tell whether a chat session is a genuine user or someone successfully using a social engineering attack against your chat operatives? If the answer is "nothing" then you can't know if this is an isolated event or how many of your chat sessions go without a glitch.
- tamar 11y agoThere are identification methods requested via chat. Matt invited you to try it. Go for it.
- vehementi 11y agoParent's point was, how do you tell whether or not your rep was socially engineered? Only some mistakes get complained about. If you don't have such a method then your "10000 sessions a day without a problem" number is fantasy.
- fefifofu 11y agoWe don't need to try. A hacker already did and was successful.
- 11y ago
- yAnonymous 11y ago1. using a weak password for an important e-mail address 2. not deleting the mail with the login information 3. not having a backup Yeah. This was just as much your fault.
- vehementi 11y agoYou misread the article at a very basic level if you think 2 is related to anything
- r1ch 11y agoI had my 2FA at Singlehop bypassed by social engineering attack. They helpfully changed the entire account contact info without any notice to me, presumably from a phone call. The attacker didn't even have any information to go off other than the IP address. I only found out when I saw the server rebooting into rescue mode and luckily I still had an active management portal cookie (changing the password doesn't log you out of the portal, another big problem) so I immediately knew what was happening. I wish there was a way to disable the "customer support backdoor" in all these kinds of services. I've started to deploy full disk encryption to all my servers now so if the attacker does manage to get into the management account the server itself is still protected from single user / rescue mode / etc.
- nxzero 11y agoEven better, have the option to disable tech support and get an alert if a reset is requested with the metadata related to the party making the request.
- brianwawok 11y agoFairly common for enterprise type apps to have a list of preapproved contact points, not on the list they won't even talk to you. Maybe other places could take this up... not foolproof, but at least adds another layer to the challenge.
- nxzero 11y agoI've personally gotten past lists like that a number of times simply by stating that person is not on staff any more, I'm their replacement; legitimately did replace the old point of contact. Getting people to do stuff on the phone is easy a huge amount of the time.
- Piskvorrr 11y agoIndeed. "Oh, we have this completely impenetrable fortress, immune to any sort of attack." "Let me in, pretty pretty please." "Okay."
- adamowen 11y agoThe lesson here is you should always keep your own off-site backups - especially if you don't pay for a 'managed' server. There will always be rare occasions such as this, but considering how many customers Namecheap handle, I don't think we should be seriously concerned. I'm pretty confident lessons will be learned.
- mpnordland 11y agoMoved my domains off Namecheap because I could find a better deal elsewhere, but man I'm glad I don't have anything there now.
- tamar 11y agoIt wouldn't happen to you. As you may see by other comments here (written by @matthewdrussell), this was an isolated incident that occurred specifically to an already-compromised email account. Still, we could always do better, and there have already been many meetings and policy improvements that have resulted from this single incident. We always take these opportunities to improve. Yes, I work for Namecheap, but that's probably implied by my comment.
- bdcravens 11y agoI use them for domains, but I wouldn't host there. (nor any other registrar, and if Starbucks started selling burgers, I doubt I'd buy one of those either)
- willyyr 11y agoSo he is using 2FA for all the important accounts but for the most important one (the email which he used to register an account at all these services) he's using a weak pw and no 2FA? Am i missing something here? Yes they did not follow protocol but why would one not use 2FA for such an important email addy?
- arturhoo 11y agoI thought the same thing! Although he is definitely right to complain about Namecheap, the biggest takeaway is, your email is the most important service you have on the internet: > I’m pretty careful to use 2FA for any service that I consider important
- matthewdrussell 11y agoCorrect. I'm surprised no one else has mentioned no 2FA for the email. The email being compromised opened the door to this happening.
- mbrameld 11y agoThe email being compromised opened the door to his email being compromised. The door to his Namecheap account being compromised was apparently already wide open.
- levemi 11y agoNo, OP didn't have 2FA enabled on their namecheap account. It was namecheap's fault for improper handling of the social engineering attack but OP could have protected themselves by having 2FA
- cname 11y agoThe article pretty clearly states 2FA was enabled for the Namecheap account in question. In fact, that is sort of the whole point of the article.
- kelukelugames 11y agoCan you get your stuff back from namecheap?
- joering2 11y agoSTOP. USING. NAMECHEAP. Its been months since I wanted to write a detailed summary, but the notion that "namecheap is hackers best domain registrar" is not valid anymore! About year ago I noticed DNS changes on many of my there-parked domains. Upon reaching via Chat (no phone support so that angry customers cannot vent off) I was told that they cannot help me cause Im not the owner of the account! Upon full verification even with CC on file and telling them purchase history going back to 2009, I was still denied the access. As it turned out, all hacker needed to know is my public WHOIS info to take over my account!! That was insane! Only continuance of threats from my side that I will plaster it all over the net made them change their mind, which again is a breach of trust - what if I was actually the hacker?? What really made me start moving domains to NameSilo (Im not affiliated) is that upon doing a thorough research, I found many cases where Namecheap gives up on fighting for peoples domain! I seen names like nanotmz where company was building some sort of magnetic devices and TMZ came in and threat to sue Namecheap if they dont shut the domain down. That's where I found similar cases for NameSilo and learnt that they stand their ground and would not give up on your domains, even if are threatened with legal action. I'm out of Namecheap completely as of last month with last SSL expiring.
- tamar 11y agoNamecheap has had two factor authentication and was the first provider to have it. Knowing public whois would not grant someone access to anyone's account at Namecheap. They'd still need to know your Namecheap username, your password, and your PIN, and if you had 2FA, that would need to be provided as well.
- joering2 11y ago... unless their Ukraine-based customer support that sometimes doesn't speak English is intimidated enough.
- tamar 11y agoIf you have specific information, you are welcome to contact us with full details. Policies and procedures are in place to ensure no one falls victim to social engineering and as you call it, "intimidation."
- 0x0 11y agoI remember when NameCheap launched the "security notifications" feature where it would email you whenever there was a login or activity on your account. I noticed that logging in on the mobile site didn't trigger any emails. When asked, they replied that the mobile site was just a beta version. It doesn't help that the front door is securely locked when the back door is not! :-/
- mikeash 11y agoCrazy. I have trouble figuring out how you'd even program it that way. Is it not obvious that security notifications belong in the authentication layer that everything uses, and not in platform-specific front-end code?
- danielweber 11y agoI'm leaning more and more towards treating the email address that you use to register for business-critical services as secret. It's a level of security-through-obscurity, yes, but that doesn't mean it's wrong. It means you can keep that address monitored well. You could make any activity on it send a page, for example.
- matthewdrussell 11y ago+ Better email security with 2FA on your email address.
- danielsamuels 11y ago> but on the way out decided to click the conveniently located “Re-install” button next to each VPS. This instantly wipes everything and installs a new OS. Again this action requires no 2FA authentication or any other form of confirmation This is the same for DigitalOcean. I'm always amazed that clicking "Rebuild" or "Delete + Scrub Data" doesn't require _any_ confirmation at all.
- moviuro 11y agohttps://twitter.com/NameCheapCEO/with_replies https://twitter.com/NameCheapCEO/with_replies "This was an isolated case and procedure was not followed. I can assure you we have addressed it so it won't happen again."
- jqueryin 11y agoAs someone in the domain registrar industry, are there any features beyond 2FA that you would like to see implemented by registrars? More bluntly, what is it that you think your current registrar is lacking? I read a few comments on Gandi and support of GPG keys. I'm guessing this is what you're referring to: https://wiki.gandi.net/en/gandi/documents https://wiki.gandi.net/en/gandi/documents
- bhartzer 11y agoI have seen some registrars offer USB devices that must be plugged into a laptop in order to gain access to an account.
- tamar 11y agoHey Bill - when I was remote staff at AOL in the 90s, we had SecurIDs too (which is basically a key fob with 6 numbers that changed every 60 seconds, pretty reminiscent of 2FA on phones/Authy/Google Authenticator). Problem is if you lose that, you're not able to get into your account...
- extrapickles 11y agoI would like to see something where a postcard is mailed and a phone call, each with half of the code needed for a reset. Postcard should not be sent using a method that supports forwarding so an attacker cannot setup a mail forward. Customer support should not be able to see anything about these accounts except for a reset button. I do expect to be charge a fee for a reset if I need to use it. This would need to be rate limited to prevent people from dosing an account through it.
- PhantomGremlin 11y agoa postcard is mailed If you want them to go thru the trouble of mailing something, at least require it to be a letter. Inside an opaque envelope. A postcard is the exact opposite of something you want to use to send sensitive information.
- 11y ago
- greggman 11y agoSo I just was about the enable 2FA on namecheap but at least from the description it only supports SMS I'm traveling constantly. I always have a different country's SIM in my phone meaning I can't receive SMSs to a static number. Is SMS only 2FA acceptable?
- jaredsohn 11y agoA few ideas: * If they happen to be using authy for 2FA and you have the Authy app on your phone, it will use that instead of sending an SMS. You could also just have it send to Authy's Chrome extension. * Consider setting up a Google Voice number to receive the SMS.
- pfarnsworth 11y agoSocial engineering in tech has been around since before Kevin Mitnick publicized it and went to jail (unjustly). Why do we keep making the same mistakes over and over again as an industry? We NEED UNIFORM security standards with ALL trusted companies with customer support, where we have tiers of support, and 1st tier doesn't have any access that could compromised security. Similar to ISO standards. This means there can't be any "impedance" mismatching that can be used from one service to another. For example, one company gives out the last 4 digits of the credit card, and the other uses the last 4 as security info. What we need is a uniform security standard and training for ALL customer support personnel so that you can use Apple to break into Amazon, or Digital Ocean or Namecheap. The staff need to be trained to never succumb to social engineering ever, and in fact make it impossible for 1st line support to reset anything. Have any security information get passed up to second tier support who are extremely well-trained. Etc. And have this standardized so that there is incentive for customers to look for this certification so that we don't have to keep suffering the same mistakes over and over again.
- Someone1234 11y ago> Kevin Mitnick publicized it and went to jail (unjustly) You're joking right? He even fully admits that he did what they accused him of doing.
- Negative1 11y agoEver heard of a plea deal? He was obligated to 'admit wrongdoing' in order to get a reduced sentence. Sure, he could have stuck to his guns, but, jail has very bad internet.
- Someone1234 11y agoI meant in his book and speeches he has since given he has admitted doing more or less what they accused him of doing. I'd definitely agree that the solitary confinement was cruel and unusual. I'd also agree that the law wasn't mature enough when he was charged so he was charged with proxy-laws. But ultimately he did do what they said he did, and some of it was pretty messed up. He would definitely be charged today with computer crimes (or generic crimes) for many of his exploits at the time.
- smoyer 11y agoHmm ... I have my VPS' set up so that I can only log into them using a private key, but I hadn't thought about the possible security flaws in my provider's control panel. Time for another audit!
- suresh70 11y agonamecheap PR is going all guns
- tamar 11y agoWe're always keeping tabs on what's going on - it's called taking care of our customers and making sure we learn from our mistakes. This isn't new behavior for us. I've been at this since 2009.
- gk1 11y agoIn 2014 I was able to bypass .htaccess restrictions of a site hosted on Namecheap using social engineering through the live chat... Twice. All I had to do was tell the chat operator I was having some issue with .htaccess and .htpasswd until they offered to delete it temporarily. In the few minutes between them deleting it and reuploading it, you're free to do whatever you want. I reported this and was told it was resolved (I guess with new policies).
- jiiam 11y agoThe whole point of social engineering is that, no matter how good the protocol you use, if there is a point of failure involving a person (like a tech support guy with access to a console), then it will fail. The only solution is to remove these sort of powers from your general tech support guy and let them in the hands of a few highly technical, well trained, well paid staff members (presumably managers?). Of course, I made the blind assumption that your average support staff member is not paranoid enough, but based on my acquaintance with a few guys in the business it seems to me that the salary is not high enough to expect well trained technical stuff doing support. I might be wrong, and in that case I would gladly know which companies employ such well trained staff, so that I can move my servers there.
- moviuro 11y agoOkay, so just for fun, I tried to do the same with my Google Account: Login: my email address Password: forgot it "Please note that without your phone, the recovery procedure will take 3 to 5 days". hopefully, this means that there will be many many checks to avoid social engineering
- aeturnum 11y agoIncidents like this remind me of Blizzard's policies vis-a-vie their 2-factor auth system. I don't know if it's changed since this happened, but in the early-ish days my friend's phone broke and he lost his ability to generate 2FA codes. Blizzard was happy to remove his 2FA once he had made a photocopy of at least one (maybe two?) forms of ID and (I think?) some evidence he owned the credit card paying for the account. Once he mailed that in to Blizzard hq, some human confirmed the info and they removed the 2FA. If Blizzard can do that, and they're protecting MMO characters, certainly other providers can do so as well (maybe for an increased fee as I realize it's more expensive than online chat). IIRC, people hacking into Blizzard games resorted to compromising users' computers and capturing the 2FA codes in flight - then logging in and changing the credentials before the user could react. That's a much higher bar to clear than the one here.
- stevepaulo 11y agoIf you only use 2FA on ONE THING online, make it your email! How could you not consider your email the most important service of all? It is your identity!
- r3bl 11y agoI'm going to go ahead and say that he used an email service which does not offer 2FA since every email service that does support 2FA probably has a good brute force protection.
- po1nter 11y agoSince the CIO (and another employee) are here. Why are you not offering support for Google Authenticator? Last time someone asked for it was 2 years ago[1] and still no sign of the feature. Cheap prices are good to have but combining that with more security can only add value. [1]: https://www.namecheap.com/support/knowledgebase/article.aspx/9253/45/how-to-two-factor-authentication#comment-1103776931 https://www.namecheap.com/support/knowledgebase/article.aspx...
- sn 11y agoThe real problem here is customer support not following established procedures. Maybe simulated social engineering attacks to test compliance should be part of SOP, like some companies do simulated phishing attacks.
- tamar 11y agoYes, and this matter has been appropriately handled. We'll be doing a lot more to ensure it doesn't recur.
- site-dot-onion 11y agoSo full of failure, this thread. No, it is never okay to compromise security just because "it's good when you forget your password". There should be no way around this for any reason; a bypass via SE or any other mechanism is a failure of the company, end of. If you forget your password or you do not have your 2FA/security questions available, tough, you should lose access. For the sake of "workarounds for legitimate users", that just translates to "a security hole". Special pleading is a logical fallacy and if it works on a support rep, that rep has failed at their job.
- HemanHeartYou 11y ago>No, it is never okay to compromise security just because "it's good when you forget your password". No one is arguing that.
- johnnyfaehell 11y agoAt the end of the post he seems quite snarky and bad mouthing namecheap's security for things that aren't even their fault or even security issues. > The VPS panel allows full serial console with only a login/password (no 2FA required or possible) Yea that's because it's a serial console, if you want 2FA or something then that's a matter for your operating serivce. A serial console is literally like you're plugged directly into the machine. > They send out your VPS panel login/password in plain text emails when you sign up, and when you reset the password. So if you ever failed to delete one of those emails completely and someone gets into your email…your totally screwed… To be fair this is pretty standard. It's your job to secure your passwords once they've given them to you. If they're storing it in plain text then you can complain but this basically sounds like you're complaining that they're not encrypting emails. Sure they could only show you it once when you boot it up. But since this action was done via customer support they would have to give you the password some how. To your email address the most secure other than the chat which can be by an attacker like it was in this case. > VPS can be irrevocably wiped within seconds without any prompts or confirmations just by the click of one button; whether the server is turn on/off it doesn’t matter. This isn't a security issue. A UX issue yea, but it's not even that big of a deal. It's in an area you won't be that often and where you know you're doing admin related thing. > They keep no backups, even to cover hardware or security failure. This isn't a security issue. It's your job to back up your stuff not a VPS provider. > And of course the icing on the cake is that they ignore 2FA and are willing to send out your username/password to anyone that asks. Yep. Pretty valid.
- dougmany 11y ago>> They send out your VPS panel login/password in plain text emails >To be fair this is pretty standard. This practice has always bothered me. An expiring link to reset is much better.
- jimktrains2 11y ago> Yea that's because it's a serial console, if you want 2FA or something then that's a matter for your operating serivce. A serial console is literally like you're plugged directly into the machine. Which, once the machine is up, is basically just exporting getty and exposing the system login prompt. Why couldn't the system login prompt require 2FA. Mostly for historical reasons I'm assuming, but just because it's serial doesn't mean it isn't just some software on the other end.
- pcl 11y agoThis refers to the loss of two virtual private servers -- two VPSs. I read through this looking for the part where two Vice Presidents from Namecheap were fired over the incident.
- deleted 11y ago[deleted]
- RawInfoSec 11y agoIf you can't secure your email, why would you be surprised when your servers dissapop? I understand that there should have been more layers beyond this and all, but really, what is the point if you're vulnerable across several OpSec levels?
- tamar 11y agoNamecheap made a response here: https://blog.namecheap.com/social-engineering-issue/ https://blog.namecheap.com/social-engineering-issue/
- mikestew 11y agoI'd give money to a VPS, or what have you, that had a stated policy along the lines of, "here is a recovery key, here is the 2FA setup, here's how you recover your password with those items if you forget. If you call about account recovery and you do not have $REQUIRED_ITEMS, our service reps have been instructed to hang up on you. If you lose access to your account without $REQUIRED_ITEMS, you have lost access to your account permanently because we have set procedures from which we do not, under any circumstances, deviate. With a name like Ft. Knox VPS, our customers value the security of their accounts. As security is our priority, we have chosen to trade convenience and possible loss of data for the elimination of a large threat surface. If you regularly lose your car keys, don't use a password manager, or get angry when companies won't just email you your password instead of making you reset it, we're probably not the right choice for your VPS needs."
- matheweis 11y agoI don't know... Apple did this for a while, and it backfired on them. The average user (even technically savvy user) simply wasn't competent enough to understand that they really truly would be locked out forever. From 2014: http://thenextweb.com/apple/2014/12/08/lost-apple-id-learnt-hard-way-careful-two-factor-authentication/ http://thenextweb.com/apple/2014/12/08/lost-apple-id-learnt-... They no longer do this: https://support.apple.com/en-us/HT204921 https://support.apple.com/en-us/HT204921
- mikestew 11y agoI by no means intend such a system be sold to average consumers. As you point out, it would be doomed to failure. More for the hard-core "I'd rather lose my customer DB than watch it walk off in the hands of someone with a good sob story" crowd. And I'm not 100% sure that there is large enough, bold enough type to forestall some customer saying, "but I didn't think you meant it!"
- PhantomGremlin 11y agowe have set procedures from which we do not, under any circumstances, deviate Fair enough. There's a subset of people who want that and would agree to that beforehand. But, and here's an important "but", do not just display a checkbox and an Agree button. Instead display a sentence something like this: I UNDERSTAND THAT I WILL PERMANENTLY LOSE ALL ACCESS IF I FORGET MY PASSWORD AND MY RECOVERY KEY In order to agree to the terms, make the customer type out: I UNDERSTAND THAT I WILL PERMANENTLY LOSE ALL ACCESS IF I FORGET MY PASSWORD AND MY RECOVERY KEY BTW, don't allow "paste" into the reply field, try to enforce actual typing of characters. After you've done that, if a customer is later locked out, that customer will STILL be mad at you. It will be the providers fault that the customer can't get access. No matter how explicitly the customer agreed to the terms. That's human nature. I don't care how explicit you make it, you simply can't win this one.
- z3t4 11y agoDon't call them hackers! A better word would be thief or vandal.
- sverige 11y agoThe comments remind me of the time I tried to get a copy of my credit report from one of the big 3 agencies back in '09. One of the authentication questions was, "What is the name of your mortgage company?" My house had been foreclosed during a divorce 5 years earlier, and of course the mortgage had been sliced and diced about 15 times by different companies during the heyday of mortgage-based derivatives before the '08 crash. I finally gave up trying to get a copy from those guys.
- PhantomGremlin 11y agoI finally gave up trying to get a copy from those guys I had a similar experience. IIRC TransUnion was the problem one. They wanted something like 3 credit card numbers as part of the identification. But I only had two active credit cards. Fortunately I was able to find an old cancelled one in a drawer and they accepted the number!??? The problem is that you're not their customer, you're just an irritant that the federal govt demands that they give "free" information to. They treat their real customers much better. E.g., go to a used car dealer. Give them your SSN and they'll have your life story in front of them in about 10 seconds. They get good service because they're paying for it.
- Kephael 11y agoI transferred all my domains away from namecheap several months ago when the Ukrainian based live chat support was adamant they couldn't send an "ACK" message and have my domain transfer out automatically, and instead had to wait nearly a week for the "AUTO-ACK" to process. They lied to me and insisted ICANN require a five day wait even when I linked the ICANN documentation stating otherwise.
- deleted 11y ago[deleted]
- neotek 11y agoI've been battling with Namecheap for over a month now just to try and get the registrant details updated on a handful of .com.au domains I own. Their "support" is hands down the worst I've ever experienced, and the moment I'm able to move every domain I have away from Namecheap to a registrar that actually gives a shit, I'm going to do just that.
- rebootthesystem 11y agoDon't think anyone asked the obvious question: Which VPS providers do it right? Which are safest from social engineering attacks?
- turbohz 11y ago"On April 9, 2016 I had an email address compromised, with the attacker brute-forcing a weak password." Namecheap is obviously to blame for the compromise of the VPS, but failing to secure an email account which can be used for password resets is even a bigger fail, IMO.
- rootw0rm 11y agohashbackup + backblaze. you're welcome.
- majcherek128 11y agoI agree with most people that calling to reset password should be a service that can be entirely disabled, or at least require 2FA. But think about this. All of this could have been avoided if they had the simple policy of calling you back. The only thing you would have to do as a user, would be to keep your number up-to-date. Of course this also requires that you should never be able to add a number using the phone though, but this makes sense, since they can just say: "To do that you just have to sign in and click on..."
- voiper1 11y agoWhoa. I turned on my 2FA at Linode. Their policy to disable is to require a copy of credit card + government ID so hopefully that's followed... https://www.linode.com/docs/security/linode-manager-security-controls#recovery-procedure https://www.linode.com/docs/security/linode-manager-security... Also checked: if you pay for their backup service, nobody can delete the backups, so those backups are even safe if compromised.