Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Namecheap live chat social engineering leads to loss of 2 VPS

postphp.com

Post reply on HN
Print view View original

111–120 of 426 posts

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#111

Post by jontas »

ryanlol wrote: post #28
dorfsmay wrote: post #17

Earlier quoted context omitted.

I once lost my gandi.net password. It took sending copies of 2 photo id, and answering the phone listed in the who is database before they reset it. I just wish that their DNS updates were push through faster.

That's not good verification. It takes a couple of minutes to produce convincing fake ID scans, and they aren't going to have anything to verify them against. And presumably they wanted you to send those photos to them as an unencrypted email attachment, right?

As someone mentioned above, they publish a gpg key for sending this data.

As for fake IDs, yes, it is certainly possible to create them. But when it is so much easier to socially engineer your way into another service like Namecheap, it creates a disincentive for going after Gandi (and other similar hosts).

No security measures can be foolproof, possibly short of sending someone to your home to take a DNS sample, but at least they're trying for a better solution.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#112

Post by tamar »

mpnordland wrote: post #53

Moved my domains off Namecheap because I could find a better deal elsewhere, but man I'm glad I don't have anything there now.

It wouldn't happen to you. As you may see by other comments here (written by @matthewdrussell), this was an isolated incident that occurred specifically to an already-compromised email account. Still, we could always do better, and there have already been many meetings and policy improvements that have resulted from this single incident. We always take these opportunities to improve.

Yes, I work for Namecheap, but that's probably implied by my comment.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#113

Post by Spoom »

ryanlol wrote: post #28
dorfsmay wrote: post #17

Earlier quoted context omitted.

I once lost my gandi.net password. It took sending copies of 2 photo id, and answering the phone listed in the who is database before they reset it. I just wish that their DNS updates were push through faster.

That's not good verification. It takes a couple of minutes to produce convincing fake ID scans, and they aren't going to have anything to verify them against. And presumably they wanted you to send those photos to them as an unencrypted email attachment, right?

Other comments in this thread have indicated that Gandi will take GPG-encrypted emails have have published their public key for this purpose: https://wiki.gandi.net/en/gandi/documents

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#114

Post by kelukelugames »

matthewdrussell wrote: post #102
kelukelugames wrote: post #65

Earlier quoted context omitted.

I love namecheap but 5 sounds like victim blaming. Come on. EDIT: My use of the term is a bit strong. I feel frustrated that company execs cannot explicitly admit a mistake or apologize. I should have worded it differently. EDIT2: just for Tamar. By explicit I mean literally using the words "sorry", "apologize", or "mistake". What we have is the standard corporate nonapology. EDIT3: congrats to Tamar for being promot…

Everyone should practice a good backup routine and take responsibility for backups.

This is not good damage control/PR. You are letting ego get in the way.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#115

Post by tamar »

joering2 wrote: post #75
tamar wrote: post #67

Earlier quoted context omitted.

Namecheap has had two factor authentication and was the first provider to have it. Knowing public whois would not grant someone access to anyone's account at Namecheap. They'd still need to know your Namecheap username, your password, and your PIN, and if you had 2FA, that would need to be provided as well.

... unless their Ukraine-based customer support that sometimes doesn't speak English is intimidated enough.

If you have specific information, you are welcome to contact us with full details. Policies and procedures are in place to ensure no one falls victim to social engineering and as you call it, "intimidation."

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#116

Post by infinite8s »

boredpudding wrote: post #8
castis wrote: post #6

Earlier quoted context omitted.

If I wanted more security on my account, is there a different service I should be using?

Amazon Web Services is great, and as far as I experienced, their support knows more than average.

You can get AWS customer support to reset your password if you know the last 4 digits of the credit card used to pay for the account. This is the same info that's printed on any credit card receipt.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#117

Post by tamar »

kelukelugames wrote: post #65
matthewdrussell wrote: post #21

Disclaimer: I'm CIO @ Namecheap 1. The credentials were resent to an already compromised email account 2. This is an isolated case 3. Established procedure was not followed 4. With thissaid, we've used this as a learning example and additional training has been provided to the individual involved 5. Anyone with any self-managed server with ANY provider should always keep their own multiple backups

I love namecheap but 5 sounds like victim blaming. Come on. EDIT: My use of the term is a bit strong. I feel frustrated that company execs cannot explicitly admit a mistake or apologize. I should have worded it differently. EDIT2: just for Tamar. By explicit I mean literally using the words "sorry", "apologize", or "mistake". What we have is the standard corporate nonapology. EDIT3: congrats to Tamar for being promot…

I don't think it was personal, simply a reminder that it always helps to have good backup procedures in place.

Even my managed services have offsite backups. Better be safe than sorry, I always say.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#118

Post by jaredsohn »

greggman wrote: post #108

So I just was about the enable 2FA on namecheap but at least from the description it only supports SMS I'm traveling constantly. I always have a different country's SIM in my phone meaning I can't receive SMSs to a static number. Is SMS only 2FA acceptable?

A few ideas:

* If they happen to be using authy for 2FA and you have the Authy app on your phone, it will use that instead of sending an SMS. You could also just have it send to Authy's Chrome extension.

* Consider setting up a Google Voice number to receive the SMS.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#119

Post by bhartzer »

jqueryin wrote: post #101

As someone in the domain registrar industry, are there any features beyond 2FA that you would like to see implemented by registrars? More bluntly, what is it that you think your current registrar is lacking? I read a few comments on Gandi and support of GPG keys. I'm guessing this is what you're referring to: https://wiki.gandi.net/en/gandi/documents

I have seen some registrars offer USB devices that must be plugged into a laptop in order to gain access to an account.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#120

Post by brianwawok »

rev_null wrote: post #91
brianwawok wrote: post #77

Earlier quoted context omitted.

It's tricky because a lot of customers really DO lock themselves out of a service, and forget their password reset code. Fun story time. I use to play MTGO, the online Magic the Gathering game. Played it from beta for a few years say 2002-2004. Wanted to check it out in 2014 to see how it changed. Failed password reset online, had to call in to support. The support guy was like chortle what was your security passcode…

I once tried to log into a site only to discover that the security question I left for myself was "What is blue?". I never figured it out.

The sky!!!
Post reply on HN