GoDaddy hack could be “an extinction level event” for businesses
Hot on the heels of the news that Google penalises self-build websites like Wix and GoDaddy in search results, comes this week’s news of a MASSIVE hack of GoDaddy customer data that some analysts believe will be terminal for some of the businesses who rely on them for their websites or domains.
What on Earth happened?
GoDaddy confirmed in an announcement yesterday that at least 1.2 million customers have had passwords, email addresses, SSL keys and database logins stolen, in an infiltration dating back to September 6th.
How is that even possible?
A very good question. Basic security principles state that most of these things should NEVER be stored in a manner that can be read and used, so this type of breach shouldn’t have been possible.
This is a major embarrassment for GoDaddy – not because attempts were made to compromise their security (that’s unfortunately very normal these days) but because their internal systems seem to have been so woefully insecure.
GoDaddy are the world’s largest domain registrar and host millions of sites, but as investor Warren Buffet famously said about security of a different kind, “Only when the tide goes out do you discover who’s been swimming naked”. It certainly appears that GoDaddy have been playing fast and loose with customers’ data.
Demetrius Comes, the CISO of GoDaddy, said yesterday “We are sincerely sorry for this incident and the concern it causes for our customers. We will learn from this incident and are already taking steps to strengthen our provisioning system with additional layers of protection.”
That sounds pretty bad!
Unfortunately, it gets worse.
It seems clear that two-factor authentication (2FA) – when you enter a code from your mobile phone, for example, whenever you want to log in – was not in use for the company accounts from which this data was stolen.
But the impact of the lack of 2FA is not limited to the initial data breach itself. The lack of this basic security tool for the majority of customers’ own accounts means that hackers are now able to take full control of many aspects of businesses registered or hosted with GoDaddy.
Randy Watkins, CEO of Critical Start, said “keys or credentials could be used to gain access or impersonate customer sites. Either of these scenarios could lead to a compromise of those organizations’ [customers’] data as well. While this breach will just be an inconvenience for most, others may have serious brand damage from impersonated sites or an actual breach. ”
And according to Murali Palanisamy, chief solutions officer for AppViewX, compromised SSL private keys and certificates could also allow hackers to hijack a domain name and use it to extort ransom for its return. “They can also redirect users to what appears as an identical website and deploy malware or collect user credentials and credit-card information and much more,” he said via email. “All of these threats are extinction-level events.”
Has this sort of thing happened before?
This is unfortunately just the latest in a string of security miseries for GoDaddy. In 2020 alone they hit the headlines three times for three different, serious, incidents. Customers’ domains were changed by hackers, cybercriminals stole 28,000 customer login details, and GoDaddy handed over control of two cryptocurrency service sites to hackers resulting in the exposure of yet more customer data.
Help! I have a GoDaddy account! What do I do?
As a bare minimum, immediately log in and change all your passwords (email, website, database, FTP) to something new, different and very secure.
Following this, you can (and should) set up two factor authentication in the following way: https://uk.godaddy.com/help/enable-2-step-verification-7502
GoDaddy is also currently working to update the affected SSL certificates, however this will take time so it may be sensible to make your own arrangements and replace your site’s certificate with a new one today.
If you think the time has come to migrate away from GoDaddy, contact us today for advice and a discounted rate on our own, secure, web services.
Are Enterprising IT different?
You betcha we are. All our passwords and sensitive customer data are hash-encrypted so nobody, not even our employees, can read or decrypt them. Our fast, UK-based servers are held in an ISO27001:2013 compliant data centre with 24/7 monitoring, and we have full 2-factor authentication for ALL accounts, both internal and external, as standard. External access for remote users is never available to vital layers like SSL and domain name records; these changes are only ever performed by us at your personal request.
We also have a raft of security features for your site in our MySiteMonitor service (which is free to all Enterprising customers) ensuring that your website security is monitored constantly and upgraded regularly. There are multiple levels of additional security too, from malware scanning to brute force attack protection. We know that the security of your website is vital for your business.
We pride ourselves on bringing the best of Enterprise-level IT to smaller organisations, and security is a key element of that approach. Contact us today to discover the Enterprising IT difference.
