My website was stolen by a hacker and I got it back • Hacker News Board

Re: My website was stolen by a hacker and I got it back

#61

Post by arh68 » Tue, Apr 01, 2014, 7:01 PM UTC

euphemize wrote: post #60

> 1. Have a really, really good password, and change it often. Your password should not contain “real” words (and definitely not more than one real word in immediate proximity, like “whitecat” or “angrybird”), and should contain capital letters, numbers and symbols. The best passwords of all look like total nonsense. http://xkcd.com/936/ But really, I'm a bit puzzled by her 5 "recommendations". Turn off your devices…

Use PwdHash, it only improves the situation. [1] Even a bad password like "123456" turns into "rY9RHtJZ" (for HN). Turning computers off seems weird, but if that computer's got your ssh keys or your cached passwords, off is safest.

[1] https://www.pwdhash.com/

> don't use HostMonster or Godaddy

http://internetshitlist.org is free for the taking :)

Re: My website was stolen by a hacker and I got it back

#62

Post by akcreek » Tue, Apr 01, 2014, 7:24 PM UTC

graedus wrote: post #40

quackerhacker wrote: post #33

Earlier quoted context omitted.

I agree with you with the "bad advice," opinion. There's no glamour or valor with how she got her domain back. In reality...it appears from her article that she really just paid to get it back. So I guess her suggestion is to have $30k stashed to make up for lack of security. From what I read...she's still out money, even though she did get her domain back.

She retained the money. And then I called the wire transfer company and placed a stop on the payment. It's unclear to me how this works. At first, it seems as though she and Anthony pursued this action independently, which would seem quite risky: risk of the apparently-fraudulent stop payment not being processed in time, or at all, resulting in the loss of 30k; risk of legal action from the seller, however seemingly…

I (Anthony from the story) negotiated the price with the seller to $3,500. I had Jordan wire that to escrow.com while we waited for the domain, db and files to be transferred. We made this decision because nobody was helping (hosts/law enforcement) and with this action the worst case scenario became paying $3,500 for the site (assuming the seller didn't back out). After this the FBI took the case and they were involved in stopping the funds from transferring.

I'm positive she would have gotten it back eventually even if it did sell to someone else and they took control, but it could have been a more lengthy process and her entire living is derived from the website and the business associated with it. Having it out of her control for any amount of time could have been very damaging.

I had a Flippa account with history and no visible connection to her so the seller did not know that I was working with the actual site owner and she was working with the FBI.

The investigation is still ongoing and I've had some interesting conversations with the seller (thief is more accurate) since the money was frozen.

Re: My website was stolen by a hacker and I got it back

#63

Post by ColdHawaiian » Tue, Apr 01, 2014, 7:27 PM UTC

kevinchen wrote: post #31

I'm unsure why this is relevant to a site like HN. People are compromised all the time. It's not news. It's not even helpful for avoiding the same mistake: the author does not tell the details of the attack and gives some pretty bad advice for avoiding "cyber hackers" (such as turning off your computer to prevent your email getting hacked).

From the Hacker News Guidelines[1]:

> Please don't submit comments complaining that a submission is inappropriate for the site. If you think something is spam or offtopic, flag it by going to its page and clicking on the "flag" link. (Not all users will see this; there is a karma threshold.) If you flag something, please don't also comment that you did.

[1]: http://ycombinator.com/newsguidelines.html

Re: My website was stolen by a hacker and I got it back

#64

Post by lelandbatey » Tue, Apr 01, 2014, 7:27 PM UTC

euphemize wrote: post #60

> 1. Have a really, really good password, and change it often. Your password should not contain “real” words (and definitely not more than one real word in immediate proximity, like “whitecat” or “angrybird”), and should contain capital letters, numbers and symbols. The best passwords of all look like total nonsense. http://xkcd.com/936/ But really, I'm a bit puzzled by her 5 "recommendations". Turn off your devices…

To follow up, I will say that my favorite way to create a password is to use sayings from two or more of your favorite books or other sources.

So, if you like Harry Potter and Enders Game, what are the phrases that come to mind?

    Harry Potter - expelliarmus
    Enders Game - win all the future fights

Now you have a great password: "winallthefuturefightsexpelliarmus" Nice and long (33 chars), with some made up stuff. Maybe tack some numbers on the end.

Re: My website was stolen by a hacker and I got it back

#65

Post by akcreek » Tue, Apr 01, 2014, 7:33 PM UTC

whileonebegin wrote: post #49

Isn't escrow.com supposed to prevent payments from being stopped after the domain is released? Obviously, in this case it's justified, but for regular customers, you don't want escrow releasing a domain and then the buyer stops payment.

The buyer can't stop the payment as the wire is already complete and money in escrow.com's account. Escrow.com had to stop the payment and in this case they did so because there was a request from law enforcement.

Re: My website was stolen by a hacker and I got it back

#66

Post by quackerhacker » Tue, Apr 01, 2014, 7:59 PM UTC

akcreek wrote: post #62

graedus wrote: post #40

Earlier quoted context omitted.

She retained the money. And then I called the wire transfer company and placed a stop on the payment. It's unclear to me how this works. At first, it seems as though she and Anthony pursued this action independently, which would seem quite risky: risk of the apparently-fraudulent stop payment not being processed in time, or at all, resulting in the loss of 30k; risk of legal action from the seller, however seemingly…

I (Anthony from the story) negotiated the price with the seller to $3,500. I had Jordan wire that to escrow.com while we waited for the domain, db and files to be transferred. We made this decision because nobody was helping (hosts/law enforcement) and with this action the worst case scenario became paying $3,500 for the site (assuming the seller didn't back out). After this the FBI took the case and they were involv…

Glad it was $3,500 as opposed to $30k....hope she gets it back! Would love to hear some back and forth between you and douche, I hope you post a blog!

Re: My website was stolen by a hacker and I got it back

#67

Post by frigg » Tue, Apr 01, 2014, 8:09 PM UTC

mcherm wrote: post #2

I am curious: does anyone here on HN have a registrar to recommend who they know (preferably from experience) would actually be more helpful in this circumstance? Because from the sound of it, the unwillingness of the registrars (both of them) to take action here without being compelled to by a lawsuit is the root of the problem. The FBI's willingness to be helpful is nice, but doesn't solve the root problem, and as…

>I would be willing to select a registrar on the basis of their policies, not their prices.

Yes, absolutely this. I've searched through forums and read various reviews of various registrars and some say gandi is good, some name.com, some others, but at the end of the day nobody said "I've had this problem where my domain was stolen and this company was willing to help".

I'm also willing to pay more for good support when serious problems arise.

Re: My website was stolen by a hacker and I got it back

#68

Post by resistor3672 » Tue, Apr 01, 2014, 8:18 PM UTC

tombrossman wrote: post #47

quackerhacker wrote: post #30

Is there any domain register that offers 2 factor authentication to make changes that are detrimental to a site? I have Network Solutions, KVC Hosting, and have tried 1and1, but all of them...from a security standpoint...are lackadaisical when it comes to security. Network solutions WANTS their clients to bundle userid's into 1 account...that makes it easy. KVC, I emailed them to update my domain contact info, then I…

Gandi, mentioned several other times in this thread, also supports 2FA. https://wiki.gandi.net/en/contacts/login/2-factor-activation You can also create a second account there and delegate limited rights to it for making changes. The odds of losing both accounts are remote.

Gandi also does IP restriction: http://wiki.gandi.net/en/contacts/login/ip-restriction

Re: My website was stolen by a hacker and I got it back

#69

Post by jellicle » Tue, Apr 01, 2014, 8:27 PM UTC

soulshake wrote: post #55

jellicle wrote: post #45

Earlier quoted context omitted.

I lost a domain because Gandi refused to do anything about it; although I was well within the renewal period and tried to contact them many times Gandi refused to process any sort of renewal until it expired and was deleted by their system. Gandi ONLY accepts support requests through their web form (no email, no phone), and generally ignores those or provides nonsense answers several days later. As long as you never…

@jellicle, that doesn't sound like us. Can I look into your case further? If we messed up, we'll make it right.

This was several years ago; what's done is done. I moved all my domains to another provider shortly afterwards. I'm not giving you another chance to screw me.

Re: My website was stolen by a hacker and I got it back

#70

Post by shiftpgdn » Tue, Apr 01, 2014, 8:27 PM UTC

chomp wrote: post #56

shiftpgdn wrote: post #14

Earlier quoted context omitted.

Actually many of their support staff are outsourced through GlowTouch which is an Indian based support firm. It's in the EIGI S1 filing here: http://secfilings.nasdaq.com/filingFrameset.asp?FileName=000...

Yeah, they are in charge of Hostgator India. They have no reach into the US based brands. Source: I work at one of the aforementioned brands.

Unless you're in Burlington you probably aren't familiar with the brands you don't work at. Most of them have support provided through GlowTouch. Even HostGator USA has GlowTouch Indians doing transfers and helping in ticket queues.