8 ms·
No surprise at all that this happened. They had not turned on multi-factor authentication and hackers got in through a static password. Over 80% of data breache
by 1cvmask 5y ago
No surprise at all that this happened. They had not turned on multi-factor authentication and hackers got in through a static password. Over 80% of data breaches are through static passwords.
From the official GoDaddy statement:
Using a compromised password, an unauthorized third party accessed the provisioning system in our legacy code base for Managed WordPress.
-
This could have been an easily avoidable data breach.
- bilekas 5y agoBut they said : > We, GoDaddy leadership and employees, take our responsibility to protect our customers’ data very seriously So that makes it okay right ?
- kreeben 5y agoNo. You should only work with partners who take that responsibility extremely seriously. "Very" is an order of magnitude too low.
- cpach 5y agoI’m pretty sure 'bilekas was being sarcastic :)
- RankingMember 5y agokreeben was continuing the joke
- cpach 5y agoOuch. Sorry!
- gizdan 5y agoTotally makes it okay! I assume that's after the data is stolen and sold.
- Zancarius 5y agoSee, the trick is to sell customer data before the bad guys get it!
- polote 5y ago> This could have been an easily avoidable data breach. Like Twitter has done it https://en.wikipedia.org/wiki/2020_Twitter_account_hijacking https://en.wikipedia.org/wiki/2020_Twitter_account_hijacking ? It is super easy to give lessons after the fact
- mooreds 5y ago> Over 80% of data breaches are through static passwords. Static passwords are bad, for sure. But do you have a source for this?
- alexis2b 5y agoOver 80% of statistics posted in comments are made on the spot.
- mellavora 5y agono, the correct figure is 78%
- 1cvmask 5y agoThe figure that I used was one from the Verizon Data Breach report in 2017 of 81%. Page 5 in the executive summary: https://www.verizon.com/business/resources/reports/2017_dbir.pdf https://www.verizon.com/business/resources/reports/2017_dbir...
- indymike 5y ago> no, the correct figure is 78% Not credible. There should be some odd number of tenths: 78.3% is clearly more credible than 78%
- 1cvmask 5y agoSee page 5 of the Verizon report and the number is 81%: https://www.verizon.com/business/resources/reports/2017_dbir.pdf https://www.verizon.com/business/resources/reports/2017_dbir...
- mooreds 5y agoAwesome, thanks for sharing that link from 2017. For everyone not going to go to the PDF, the text is "81% of hacking-related breaches leveraged either stolen and/or weak passwords." So I'm not sure that you can say that all data breaches are related to static passwords, but it sure a big number and a problem. I looked at the 2020 Verizon report, but unfortunately they changed their methodology or reporting so I didn't see a figure for that year for "hacking-related breaches".
- paulpauper 5y agoA static password is fine if you have a good strength and rate limiting or other ways to prevent brute forcing
- vimda 5y agoIt's really not... Password reuse, other breaches, there's many ways a password can be leaked that isn't bruteforcing. Considering how low the barrier to entry to 2fa is, there really is no excuse these days
- 1cvmask 5y agoAnd the classic keyloggers which have been known to be around for over 4 decades ever since the typewriter.... https://en.wikipedia.org/wiki/Keystroke_logging#History https://en.wikipedia.org/wiki/Keystroke_logging#History https://en.wikipedia.org/wiki/Keystroke_logging https://en.wikipedia.org/wiki/Keystroke_logging
- theplumber 5y agoAn even better solution is webAuthn...I don't understand why it's not supported more than "2nd factor" which very often happens to be a phone/sms verification service, easy to steal as well.
- hknapp 5y agoWhat is a static password?