7 ms·
GoDaddy Breach Widens
- wackget 5y ago"Plaintext passwords". Quality.
- circusafro 5y agoHas this data been made available anywhere?
- colbyhub 5y agoasking for a friend
- mmaunder 5y agoOP here - at least for the link. My colleague Ram Gall wrote the post. Haven't seen an official announcement that mentions all the affected resellers like this. We reached out via a friend who works at GoDaddy who put us in contact with the spokesperson who gave us the quote included in the post. That lists the specifically affected hosts.
- deleted 5y ago[deleted]
- prox 5y agoI recently saw a huge uptick in scam activity and probing on my sites. I guess this pretty much explains that.
- hereforphone 5y agoI think everyone is pretty much probed constantly these days. I always see stuff from Shodan and similar organizations, at a minimum.
- prox 5y agoYeah but I saw huge surge starting from end of October to begin of November. Like double from normal.
- hk1337 5y agoI didn’t even realize MediaTemple was still around. I figured godaddy just fully engulfed them when they took over.
- YuccaGloriosa 5y agoWhen is this "small number of users" going to end?
- derekjdanserl 5y ago[flagged]
- notreallyserio 5y agoHey, what do you know, they still haven't acknowled the breach on their "Newsroom" page[0]. 0: https://newsroom.godaddy.net/newsroom/overview/default.aspx https://newsroom.godaddy.net/newsroom/overview/default.aspx
- wjamesg 5y agoI’m not seeing it there but here is something: https://aboutus.godaddy.net/newsroom/company-news/news-details/2021/GoDaddy-Announces-Security-Incident-Affecting-Managed-WordPress-Service/default.aspx https://aboutus.godaddy.net/newsroom/company-news/news-detai...
- skeeter2020 5y agoand they won't. You can't ever get the stink of a data breach off your core website seo, so instead they will use other outlets or buy some throw away domain like "godaddyidentityprotection.net". Lord knows they can do that cheaply (though they might have trouble setting up their wordpress site!)
- croutonwagon 5y agoThey are sending emails to customers. Mine is copied below the line. Here’s the rub though. We haven’t hosted any Wordpress with them, or anything for that matter. We only registered some Vanity domains with them. They aren’t even the registrar on our primary domains. ———————————————- Dear Company, We are writing to inform you of a security incident impacting our GoDaddy Managed WordPress environment you once purchased and used. According to our records your Managed WordPress account is no longer active. On November 17, we identified suspicious activity in our WordPress hosting environment and immediately began an investigation with the help of an IT forensics firm and have contacted law enforcement. Our investigation is ongoing, but we have determined that, on or about September 6, 2021, an unauthorized third party gained access to your customer number, email address associated with your previously used Managed WordPress account; and the password you first used when setting up your WordPress Admin login. If you use that same password for other accounts, we recommend you change your password to those accounts and adopt data security best practices, such as choosing a strong unique password, regularly changing it, and enabling multi-factor authentication where available. We also recommend that you remain vigilant for potentially fraudulent communications sent to your email address purporting to be from GoDaddy or other third parties. For residents living in California, Colorado, Delaware, Illinois, New York, New Jersey, Oregon, Vermont, Washington, and Wyoming, please visit https://www.godaddy.com/help/a-41004 https://www.godaddy.com/help/a-41004 for additional resources that describe additional steps you can take to help protect your information, including recommendations by the Federal Trade Commission regarding identity theft protection and details on how to place a fraud alert or a security freeze on your credit file. Thank you, Demetrius Comes Chief Information Security Officer
- hereforphone 5y agoGoDaddy is garbage. I think most tech-inclined people switched years ago. Namecheap has never let me down.
- traeregan 5y agoSwitched here long ago as well (and still recommended switching to all clients). 1and1 / IONOS isn't much better, and I'd recommend switching from them as well. Hover.com FTW.
- bluedino 5y agoI always find the founder or the first "other" person at the company registered the domain at Godaddy or Netsol or somewhere equally terrible. And then it's "well we bought five years so let's wait to renew it somewhere else"
- djbusby 5y agoWhy fix a bad decision for $100 - amirite? We gotta be "smart" with our money.
- oefrha 5y ago> well we bought five years so let's wait to renew it somewhere else You do realize you can transfer at any time after the 60-day ICANN change of registrant lock period, and it’ll just add to your five years at the new registrar, right?
- edgyquant 5y agoUh oh :( I’ve been using godaddy since like 2005 and never used anywhere else. Of course that’s just for domain names I haven’t hosted with them since VPSs (and the cloud in general) became cheap. I could Google it, but what else is bad with godaddy and should I switch?
- karlshea 5y agoI'll shill for Hover, been with them for many years.
- keyle 5y ago"GoDaddy was storing sFTP credentials either as plaintext, or in a format that could be reversed into plaintext." Goddamn, anyone else, feeling a deep anger rising, when reading this in 2021? "According to the report filed by GoDaddy with the SEC..." In 2021, everyone has to be pissed off by javascript popups about cookie storage, but your passwords safety, screw that. Storing SFTP passwords reversible to plaintext, that's still fine, right? As long as there is a SEC report... We look professional!
- ttybird 5y agoI don't really see the issue. It's not like some sort of deadly sin. If the users re-use passwords then that's on them.
- jjeaff 5y agoAs far as security goes, I would definitely include storing passwords in plaintext in a list of deadly sins.
- djbusby 5y agoI'll bet on base64 "encryption"
- keyle 5y agoVGhhdCdzIGEgc2FmZSBiZXQhIFRoZXknbGwgbmV2ZXIgZmluZCBvdXQhIFRoZSA9IGF0IHRoZSBlbmQgaXMgbmV2ZXIgYSB0ZWxsIHRhbGU=
- ironSkillet 5y agoTranslation: "That's a safe bet! They'll never find out! The = at the end is never a tell tale"
- smolder 5y agoAh yes, be sure to base64 encode your secrets before commiting them to the git repository, everyone!
- kawsper 5y agoI wrote Tsohost about them storing password in cleartext back in 2015, but I never heard anything back, so I wrote a blogpost: http://kaspergrubbe.com/tsohostcom-stores-passwords-in-cleartext http://kaspergrubbe.com/tsohostcom-stores-passwords-in-clear...
- gregoryl 5y agoYour site isn't serving a valid SSL certificate on https://kaspergrubbe.com https://kaspergrubbe.com
- forgotmypw17 5y agoNot everyone wants to buy into centralized, authoritarian infrastructure.
- kstrauser 5y agoThey updated it about 1 minute ago, so it looks like they're OK with buying into it.
- dilyevsky 5y agoIt’s not signed for correct domain
- orf 5y agoThen go use TOR. But if you want to actually publish something people can read, maybe you know… make it so people can read it.
- IntelMiner 5y agoAh, yes. Encrypted web traffic truly is the herald of the cyber apocalypse
- kawsper 5y agoThanks for letting me know - it is a limitation of svbtle.com, it's on my endless list of things to move.
- nerdawson 5y agoI have an account with CloudWays which is very popular in the WP space. Logged in a moment ago and there's a password field for a server's SSH/SFTP that can be revealed. Isn't that the exact thing that GoDaddy have just been stung by?
- hereforphone 5y agoOwning intensifies