Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Namecheap live chat social engineering leads to loss of 2 VPS

postphp.com

Post reply on HN
Print view View original

91–100 of 426 posts

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#91

Post by rev_null »

brianwawok wrote: post #77
r1ch wrote: post #50

I had my 2FA at Singlehop bypassed by social engineering attack. They helpfully changed the entire account contact info without any notice to me, presumably from a phone call. The attacker didn't even have any information to go off other than the IP address. I only found out when I saw the server rebooting into rescue mode and luckily I still had an active management portal cookie (changing the password doesn't log y…

It's tricky because a lot of customers really DO lock themselves out of a service, and forget their password reset code. Fun story time. I use to play MTGO, the online Magic the Gathering game. Played it from beta for a few years say 2002-2004. Wanted to check it out in 2014 to see how it changed. Failed password reset online, had to call in to support. The support guy was like chortle what was your security passcode…

I once tried to log into a site only to discover that the security question I left for myself was "What is blue?". I never figured it out.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#92

Post by matthewdrussell »

tyingq wrote: post #86
matthewdrussell wrote: post #35

Earlier quoted context omitted.

We offer full backups with all managed servers/services Self-managed a customer is responsible for their own backups. Just like with DO and that full server loss a couple of months back.

The key part of what he said there was "managed". It's a $30 to $75 a month upcharge on top of the base VPS price. I don't think the OP was paying for a managed VPS. Edit: Apparently, only the $75/month package includes backups. The $30/month package does not. ( http://i.imgur.com/Iy7iacH.png )

This was a self-managed/unmanaged VPS, correct.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#93

Post by matthewdrussell »

joenathan wrote: post #43
matthewdrussell wrote: post #35

Earlier quoted context omitted.

We offer full backups with all managed servers/services Self-managed a customer is responsible for their own backups. Just like with DO and that full server loss a couple of months back.

We who?

I work for Namecheap

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#94

Post by matthewdrussell »

willyyr wrote: post #57

So he is using 2FA for all the important accounts but for the most important one (the email which he used to register an account at all these services) he's using a weak pw and no 2FA? Am i missing something here? Yes they did not follow protocol but why would one not use 2FA for such an important email addy?

Correct.

I'm surprised no one else has mentioned no 2FA for the email. The email being compromised opened the door to this happening.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#95

Post by tamar »

moviuro wrote: post #90

https://twitter.com/NameCheapCEO/with_replies "This was an isolated case and procedure was not followed. I can assure you we have addressed it so it won't happen again."

matthewdrussell is also commenting in this HN thread @movluro - he's Namecheap's CIO. I, too, represent Namecheap.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#96

Post by matthewdrussell »

castis wrote: post #6
tshtf wrote: post #2

The most significant security problem with Namecheap is really this: It only takes a 4 digit PIN to perform any action on an account through live chat (which seems to be outsorced to Eastern Europe), even if the account is protected with a 2FA... All you need is the PIN, and an attacker can do anything to the account. Sometimes you get what you pay for.

If I wanted more security on my account, is there a different service I should be using?

Use 2FA on your Email Accounts

Use 2FA on your Namecheap account

Maintain a sensible backup policy

Store your passwords in something secure like KeePass

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#97

Post by nxzero »

brianwawok wrote: post #80
nxzero wrote: post #61

Earlier quoted context omitted.

Even better, have the option to disable tech support and get an alert if a reset is requested with the metadata related to the party making the request.

Fairly common for enterprise type apps to have a list of preapproved contact points, not on the list they won't even talk to you. Maybe other places could take this up... not foolproof, but at least adds another layer to the challenge.

I've personally gotten past lists like that a number of times simply by stating that person is not on staff any more, I'm their replacement; legitimately did replace the old point of contact.

Getting people to do stuff on the phone is easy a huge amount of the time.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#98

Post by matthewdrussell »

danielweber wrote: post #83

I'm leaning more and more towards treating the email address that you use to register for business-critical services as secret. It's a level of security-through-obscurity, yes, but that doesn't mean it's wrong. It means you can keep that address monitored well. You could make any activity on it send a page, for example.

+ Better email security with 2FA on your email address.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#99

Post by moviuro »

tamar wrote: post #95
moviuro wrote: post #90

https://twitter.com/NameCheapCEO/with_replies "This was an isolated case and procedure was not followed. I can assure you we have addressed it so it won't happen again."

matthewdrussell is also commenting in this HN thread @movluro - he's Namecheap's CIO. I, too, represent Namecheap.

Sorry I missed that. I have catch-up to do, now

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#100

Post by stephenr »

devereaux wrote: post #5

That's bad, really bad. No 2auth can save you from humans who do support. I also had one of my VPS attacked recently, and I feel for you. But the name namecheap says "cheap". Maybe they are indeed cheap? I'm not sure the same would have happened with say HE. You pay, but you know what you pay for and get in return. Personally, I am thinking about moving from a "manually setup" distribution to a "no ssh but deploy", s…

> Any suggestion for tools to do that with Debian distort?

If you write apps, package them as Debs. If you need to configure other Debs, make config packages with config-package-dev [1] from the DebAthena project.

Create a metapackage that depends on your software + config packages, and your setup process just needs to be "add private apt repo, apt update, apt install ".

[1] https://packages.debian.org/jessie/config-package-dev

Post reply on HN