Name.com Resets All Passwords Following Security Breach 35
An anonymous reader writes "Internet registrar Name.com on Wednesday revealed it was hit by a security breach. The company sent an email to its customers informing them that their usernames, email addresses, passwords, and credit card account information "may have been accessed by unauthorized individuals.""
Re: (Score:1)
I believe this is the linode incident.
I'm a name.com (and linode) customer and haven't received jack from them.
Re: (Score:2)
I'm a name.com (and linode) customer and haven't received jack from them.
They're being a bit slow about it. Just received my email.
Re: (Score:2)
got mine about ten hours ago
I am a name.com customer (Score:1)
And I did not receive any emails from them today.
Re: (Score:1)
i did. check your spam folder
My Password Wasn't Reset (Score:5, Interesting)
Re: (Score:3)
My first thought was that it was a phishing attempt, but after inspecting the email I decided to go directlt to name.com amd do a password reset through the "I forgot my password" thing. Used my trusty KeePassX and generated a new 32 character password.
Nothing new ... (Score:5, Interesting)
Re: (Score:2)
Re: (Score:1)
Re: (Score:3)
"This is NOT news. Name.com has had an annual security breach for a minimum of 5 years. This is not news at all. Reply to This Share"
Almost beside the point. Who in their right minds stores credit card information on their web servers these days? To say that's against Best Practices is a bit of an understatement.
Re: (Score:2)
Who in their right minds stores credit card information on their web servers these days? To say that's against Best Practices is a bit of an understatement.
I don't see why not. If someone were to breach my account and steal my credit card info, the damage would be limited to an hour it takes for me to replace my auto-paying accounts. And perhaps the waiting for the replacement card to arrive.
Best practices or not, my credit card account gets unauthorized charges every 2-3 years at least. It's not like I am ever responsible for that.
I'd be more worried about my cell phone number (or even email) going into the wilderness than I would about someone stealing my
Re: (Score:2)
"I don't see why not."
Well, you may not care, but I can assure you that a great many people do.
But the point is: unless you are making recurring payments via your own system (itself not really best practice... you should have an outside merchant service that automatically does recurring payments), then as a programmer you are taught -- and rightly so -- that NO credit or debit card gets stored by your application. None. Sites I worked on before had it arranged that the main site app never even saw the credit card information,
Re: (Score:2)
You really don't want to know how many, because, well, it's a lot! I have at least three former clients that do this (ignoring my suggestions).
Re: (Score:2)
Also affects domainsite.com customers (Score:5, Informative)
Domainsite.com (owned by name.com) were also affected and notified their customers accordingly this morning.
Making your way in the world today (Score:3, Funny)
takes everything you've got.
Finding a site with decent security, sure would help a lot.
Wouldn't you like some SSH?
Sometimes you want to go
Where everybody knows your name,
and the Chinese are always there to blame.
You wanna be where you can see,
our passwords are all the same
You wanna be where everybody knows
Your name.
Take some additional steps to protect your account (Score:5, Interesting)
This all stemmed from a hacking group trying to get access to Linode through Name.com. You can read more about it here, but keep in mind that Name.com is a very small part of the overall story: https://news.ycombinator.com/item?id=5667027
For those that don't understand, even changing your password won't protect you at this point. The breach hasn't been filled, if that makes sense, as they used a zero day exploit on Name.com (and a few other registrars). Basically, they can still access your account if they want to, whether you change the password or not. I could be entirely wrong about that, but they make no mention of the technical fix, nor has the hacker group said anything about NOT having access any longer.
It is correct that these hackers do not have access to your credit card number, but they can still make charges with your Payment Profile setup in the account. I'd suggest removing any payment profiles to be on the safe side. Also, they can still access your EPP codes because they are able to get into your account. Sure, the codes aren't stored at Name.com (same with the CC info) but they have access to your account. All the hackers need to do is log in to the account, click on a domain, and look at the EPP code being displayed, very simple.
This email they sent out isn't very descriptive of what happened and what could happen. Even users with the NameSafe feature aren't protected, as having admin access bypasses that system. There is a good reason why there wasn't a response for over 24 hours by Name.com and why there still (as of the time I'm writing this) no blog post. Even if a blog post DOES get made, it won't be much more descriptive than the email that went out.
Wonder if Demand Media is regretting that purchase now?
Re: (Score:2)
Why would they? They can just "Due to the unfortunate circumstances of a continuing bad economy, we have had to shutdown name.com. Sorry for the inconvenience, lol." and done. Their hands are wiped clean, the low-level IT workers are Romney'd [go.com] in one fell swoop, the fat cats still get cash from their bulk-writing SEO scheme [wikipedia.org], and they can just buy up whoever else decides to take over whatever domain( name)?s they managed.
As easy as 1-2-3 (Score:2)
.
(2) Tell the world that something bad happened
(3) Profit
Re: (Score:2)
this
Related to the Linode hack (Score:4, Informative)
https://news.ycombinator.com/item?id=5667391 [ycombinator.com]
In the above HN comment, basically it explains the linode hack, saying they got access to linodes registrar and were going to use it to steal passwords from linode customers. But they ended up finding the Coldfusion hole made it possible to break directly into linode, so they used that instead.
The email from name.com (Score:2)
Found this, seems legit:
http://pastebin.com/We3xgT4J [pastebin.com]
Re: (Score:2)
hehehe, that's what I get for not RTFing entire A, I didn't see they'd inlined the entire thing in it. Derp!
How can passwords get leaked? (Score:2)
Eggg. I had a domain transfer request yesterday.. (Score:2)