GoDaddy Wants Your Root Password 236
Johnny Fusion writes "The writer of the Securi Security Blog had an alarming awakening when a honeypot on port 22 on a GoDaddy-hosted VPS recorded login attempts using his GoDaddy username and password and even an attempt to login as root. It turns out the attempt was actually from within GoDaddy's network. Before he could 'alert' GoDaddy about the security breach, he got an email from GoDaddy Demanding his root login credentials.
There is an update where GoDaddy explains itself and says they will change policy."
Re:Feature, not a bug. (Score:3, Informative)
If you give them a non-root user with all of the privileges of root, there's no way for them to know if you've really given them root.
sudo su
Re:Feature, not a bug. (Score:5, Informative)
Why not just create an alternate account with sudo for them? Why give them root?
Give them sudo and they can grab root whenever they want:
sudo -i
passwd
[input new password twice]
exit
Re:Feature, not a bug. (Score:3, Informative)
sudo su -
The question is if GoDaddy is trustworthy. (Score:5, Informative)
Judge for yourself. Here are some stories about GoDaddy on Slashdot, in order by date:
Go Daddy Usurps Network Solutions [slashdot.org] (2005-05-04)
GoDaddy Serves Blank Pages to Safari & Opera [slashdot.org] (2005-12-08)
GoDaddy.com Dumps Linux for Microsoft [slashdot.org] (2006-03-23)
GoDaddy Holds Domains Hostage [slashdot.org] (2006-06-17)
GoDaddy Caves To Irish Legal Threat [slashdot.org] (2006-09-16)
MySpace and GoDaddy Shut Down Security Site [slashdot.org] (2007-01-26) That incident prompted this web site:
Exposing the Many Reasons Not to Trust GoDaddy with Your Domain Names [nodaddy.com].
Alternative Registrars to GoDaddy? [slashdot.org] (2007-02-03)
GoDaddy Bobbles DST Changeover? [slashdot.org] (2007-03-11)
850K RegisterFly Domains Moved To GoDaddy [slashdot.org] (2007-05-29)
According to this March 11, 2008 story in Wired, GoDaddy shut down an entire web site of 250,000 pages because of one archived mailing list comment: GoDaddy Silences Police-Watchdog Site RateMyCop.com [wired.com]. See below for Slashdot's story about RateMyCop.com.
GoDaddy Silences RateMyCop.com [slashdot.org] (2008-03-12)
ICANN Moves Against GoDaddy Domain Lockdowns [slashdot.org] (2008-04-08)
GoDaddy VP Caught Bidding Against Customers [slashdot.org] (2008-06-29)
Those are just the stories until July of 2008.
GoDaddy's reputation is not just one of extremely negative stories. In my opinion, GoDaddy tries to confuse non-technical people by offering services they don't need and presenting them as valuable.
Here are some of the opinions of Bob Parsons, the owner of GoDaddy. He is pro-violence: Close Gitmo? No way!! [archive.org]
He uses women's bodies to advertise: Bob Parson's Video Blog [bobparsons.tv].
Re:M$ pwnage (Score:1, Informative)
Another story, partly about GoDaddy. Chilling. (Score:5, Informative)
Another quote from that Slashdot story: "GoDaddy (and their reseller arm, Wild West Domains) have a different problem: They still block transfers for 60 days after a registrant's contact update, even after the ICANN update specifically prohibited doing so."
Re:Christian morality (Score:3, Informative)
Re:The question is if GoDaddy is trustworthy. (Score:5, Informative)
"GoDaddy's reputation is not just one of extremely negative stories. In my opinion, GoDaddy tries to confuse non-technical people by offering services they don't need and presenting them as valuable. "
This is quite an understatement. I do occasional web development on the side, and I recently had my first client in a while. I told her to go ahead and sign up for the domain with GoDaddy, but she said she couldn't figure out what to do. So I helped her out in person and I couldn't *believe* the amount of crap they try to push on you. Pages full of options and "upgrades" and packages on every step ... even after you finish your purchase! It's a tremendously confusing experience for someone who doesn't know how to filter out the signal from the noise.
Re:Feature, not a bug. (Score:3, Informative)
Don't you mean "sudo -i". That will launch a root login shell. Using "sudo su -" just makes it look like you never read the sudo manpage.
Re:No Surprises Here (Score:5, Informative)
This was back in 2005, but lucky for me gmail archives everything. ;)
When I refused both those options (since I had paid for a years worth of registration and didn't feel like paying any penalties, they told me they would change my dns info without my permission).
Re:They physically own the box (Score:1, Informative)
Two things:
First, your boss is right - it *should* be a big deal each time an external party wants access to your system.
Second, your boss wasn't wasting *your* time. As you were being paid by him, it was his time you were wasting.
Re:Feature, not a bug. (Score:5, Informative)
I was just about to write the same thing. This was something that was already brought up weeks ago in an Ask Slashdot. People who who don't have much exposure to the web hosting business (and that includes most Slashdotters) don't understand that web hosting falls into two major categories:
1) Unmanaged
2) Managed
Unmanaged hosting means you have full control over all of the software on your machine. (And by "machine" I mean both a real machine and a VPS or cloud node.) Nobody touches your configuration in the slightest once control has been handed over to you. If something goes wrong, including hardware failure, it's the customer's responsibility to notice it and either fix it or get it fixed. Any technical support beyond typical datacenter stuff usually incurs an hourly fee. Unmanaged hosting is ideal for people who want to admin their setup 100% on their own.
Managed hosting means the web hosting provider monitors the machine which can include external probes (checking for a response on various TCP ports) and internal metrics like system load and disk utilization. When a red flag pops up, a technician logs into the machine and tries to fix whatever is happening. You can call them up with all manner of ridiculous requests ("install WordPress for me and apply this theme") and they have to do it because, well, that's what the customers expect with a managed hosting account. Managed hosting is awesome for people who want a web server but don't have the expertise or will to actually configure and maintain it.
What the submitter ran into is that he though he had unmanaged hosting but actually has managed hosting. I don't completely blame him, because a lot of hosting providers don't explicitly state which style they provide. Sometimes it's even hard to tell after you've purchased the product. But its something you have to figure out or else you're going to be deeply dissatisfied with the company's technical support, as the submitter was.
Re:Feature, not a bug. (Score:3, Informative)
Re:Another story, partly about GoDaddy. Chilling. (Score:2, Informative)
Another quote from that Slashdot story: "GoDaddy (and their reseller arm, Wild West Domains) have a different problem: They still block transfers for 60 days after a registrant's contact update, even after the ICANN update specifically prohibited doing so."
It gets worse. GoDaddy forces an update of 'invalid' contact details (which may have been inherited from a previous transfer) when trying to change an admin address (to transfer the domain out). GoDaddy then forces you to agree to a 60 day transfer hold via a checkbox because the said details were changed. Online support refuses to change just the admin email. This isn't just against the ICANN rules, this is thuggery.
Re:They physically own the box (Score:5, Informative)
You should get familiar with your rights, then. Landlords have to give 24 hour notice before entering your apartment. Failure to do this constitutes breaking and entering and I have taught one of my landlords this lesson the hard way.
As trustworthy as a Bernie Madoff (Score:5, Informative)
You pick the name, give them a credit card, press the button and get on with your life. They won't hijack it, hold it hostage, try to sell you anything (except DDNS if you want it). You pay, they register. As it should be.
I now have three (count'em 3) clients that have lost their domains to GoDaddy. However, for only $400 or so, GoDaddy will sell you back your own domain.
I wouldn't use GoDaddy if my ass was on fire and they had free water.
Re:Feature, not a bug. (Score:2, Informative)
The truth is both funny and sad, a story of fakery (Score:5, Informative)
Another comment from someone who didn't bother to read the article or understand the issue.
Here's a quote from the Microsoft press release [microsoft.com]: "Upon completion of the migration, Go Daddy® will have moved all its parked domains from Linux to the Windows platform."
A "parked domain" is one with no real content, but just one small static web page that says something like "coming soon". The implication is that Microsoft Windows servers are fully capable of serving parked domains.
At the time, March 21, 2006, the story was that the Microsoft marketing department got GoDaddy to make the change by offering a lucrative deal. Why would Microsoft do that? This April 7, 2006 story explains: Microsoft Server gains 4.7% market share of hosted domains. [webmasterworld.com]
A parked domain, even though it is never visited except by accident, is a "hosted domain". Now it was possible for Microsoft sales people to talk about how Microsoft Windows server software was rapidly gaining market share. That would be entirely misleading, however.
Note that the press release misspelled GoDaddy as "Go Daddy", even though it was spelled correctly a few words earlier. That gives a picture of the level of competence involved at Microsoft's P.R. agency, Waggener Edstrom.
You may find it interesting that Pam Edstrom's daughter Jennifer and a former Microsoft manager wrote the book, Barbarians Led by Bill Gates. [amazon.com] (August 15, 1998, eight years earlier) The Amazon.com review says the book "... presents a harsher and messier history, sharply questioning Microsoft's ethics and corporate wisdom..." The book seems authoritative; the authors certainly had inside access to the facts. It's certainly unusual that the daughter of one of the heads of Microsoft's P.R. agency would write a book discussing Microsoft's abusiveness in detail.