Forgot your password?
typodupeerror
Security IT

Name.com Resets All Passwords Following Security Breach 35

Posted by timothy
from the hope-the-email-went-to-the-right-place dept.
An anonymous reader writes "Internet registrar Name.com on Wednesday revealed it was hit by a security breach. The company sent an email to its customers informing them that their usernames, email addresses, passwords, and credit card account information "may have been accessed by unauthorized individuals.""
This discussion has been archived. No new comments can be posted.

Name.com Resets All Passwords Following Security Breach

Comments Filter:
  • by Anonymous Coward

    And I did not receive any emails from them today.

    • by Anonymous Coward

      i did. check your spam folder

  • by Secret Agent Man (915574) on Wednesday May 08, 2013 @07:20PM (#43670341) Homepage
    I went in and changed it manually after I saw this, but it was never reset by name.com in the first place...
    • My first thought was that it was a phishing attempt, but after inspecting the email I decided to go directlt to name.com amd do a password reset through the "I forgot my password" thing. Used my trusty KeePassX and generated a new 32 character password.

  • Nothing new ... (Score:5, Interesting)

    by Cammi (1956130) on Wednesday May 08, 2013 @07:20PM (#43670345)
    This is NOT news. Name.com has had an annual security breach for a minimum of 5 years. This is not news at all.
    • by quasius (1075773)
      I'm glad you're not concerned with it, but as a name.com customer, it does concern me and I'm pretty glad this story was posted so I could take action.
      • by Cammi (1956130)
        You get notices already as a name.com customer, same as I as a name.com customer. You get emails with the following subject lines ... Failed Login Warning Request for Password Change Usually by criminals at the following ip address: 93.36.180.153
    • "This is NOT news. Name.com has had an annual security breach for a minimum of 5 years. This is not news at all. Reply to This Share"

      Almost beside the point. Who in their right minds stores credit card information on their web servers these days? To say that's against Best Practices is a bit of an understatement.

      • by Mitreya (579078)

        Who in their right minds stores credit card information on their web servers these days? To say that's against Best Practices is a bit of an understatement.

        I don't see why not. If someone were to breach my account and steal my credit card info, the damage would be limited to an hour it takes for me to replace my auto-paying accounts. And perhaps the waiting for the replacement card to arrive.

        Best practices or not, my credit card account gets unauthorized charges every 2-3 years at least. It's not like I am ever responsible for that.

        I'd be more worried about my cell phone number (or even email) going into the wilderness than I would about someone stealing my

        • "I don't see why not."

          Well, you may not care, but I can assure you that a great many people do.

          But the point is: unless you are making recurring payments via your own system (itself not really best practice... you should have an outside merchant service that automatically does recurring payments), then as a programmer you are taught -- and rightly so -- that NO credit or debit card gets stored by your application. None. Sites I worked on before had it arranged that the main site app never even saw the credit card information,

      • by pspahn (1175617)

        You really don't want to know how many, because, well, it's a lot! I have at least three former clients that do this (ignoring my suggestions).

    • Good grief if their security is that bad why the **** are their customers letting them store CC details?
  • by pfraser (651313) on Wednesday May 08, 2013 @07:40PM (#43670507) Homepage

    Domainsite.com (owned by name.com) were also affected and notified their customers accordingly this morning.

  • by Anonymous Coward on Wednesday May 08, 2013 @07:51PM (#43670603)

    takes everything you've got.
    Finding a site with decent security, sure would help a lot.

    Wouldn't you like some SSH?

    Sometimes you want to go

    Where everybody knows your name,
    and the Chinese are always there to blame.
    You wanna be where you can see,
    our passwords are all the same
    You wanna be where everybody knows
    Your name.

     

  • by Anonymous Coward on Wednesday May 08, 2013 @08:07PM (#43670741)

    This all stemmed from a hacking group trying to get access to Linode through Name.com. You can read more about it here, but keep in mind that Name.com is a very small part of the overall story: https://news.ycombinator.com/item?id=5667027

    For those that don't understand, even changing your password won't protect you at this point. The breach hasn't been filled, if that makes sense, as they used a zero day exploit on Name.com (and a few other registrars). Basically, they can still access your account if they want to, whether you change the password or not. I could be entirely wrong about that, but they make no mention of the technical fix, nor has the hacker group said anything about NOT having access any longer.

    It is correct that these hackers do not have access to your credit card number, but they can still make charges with your Payment Profile setup in the account. I'd suggest removing any payment profiles to be on the safe side. Also, they can still access your EPP codes because they are able to get into your account. Sure, the codes aren't stored at Name.com (same with the CC info) but they have access to your account. All the hackers need to do is log in to the account, click on a domain, and look at the EPP code being displayed, very simple.

    This email they sent out isn't very descriptive of what happened and what could happen. Even users with the NameSafe feature aren't protected, as having admin access bypasses that system. There is a good reason why there wasn't a response for over 24 hours by Name.com and why there still (as of the time I'm writing this) no blog post. Even if a blog post DOES get made, it won't be much more descriptive than the email that went out.

    Wonder if Demand Media is regretting that purchase now?

    • by game kid (805301)

      Wonder if Demand Media is regretting that purchase now?

      Why would they? They can just "Due to the unfortunate circumstances of a continuing bad economy, we have had to shutdown name.com. Sorry for the inconvenience, lol." and done. Their hands are wiped clean, the low-level IT workers are Romney'd [go.com] in one fell swoop, the fat cats still get cash from their bulk-writing SEO scheme [wikipedia.org], and they can just buy up whoever else decides to take over whatever domain( name)?s they managed.

  • (1) Turn over all passwords to the NSA
    .

    (2) Tell the world that something bad happened

    (3) Profit

  • by Necroman (61604) on Wednesday May 08, 2013 @08:10PM (#43670767)

    https://news.ycombinator.com/item?id=5667391 [ycombinator.com]

    In the above HN comment, basically it explains the linode hack, saying they got access to linodes registrar and were going to use it to steal passwords from linode customers. But they ended up finding the Coldfusion hole made it possible to break directly into linode, so they used that instead.

  • Found this, seems legit:

    http://pastebin.com/We3xgT4J [pastebin.com]

  • How on earth is it possible at all that an IT related company stores passwords in a form that the information can get leaked?
  • That I didn't order.. I went in a change my password anyway... Wondering how close my domain was to getting stolen?

Luck, that's when preparation and opportunity meet. -- P.E. Trudeau

Working...