top | item 32638028

Namecheap CEO offers $10k bounty for changing someone else's domain via helpdesk

87 points| deletescape | 3 years ago |twitter.com | reply

93 comments

order
[+] gkoberger|3 years ago|reply
How else is the CEO supposed to respond? He's in the tough position where he can't prove a negative; the burden of proof is on the original tweeter. So the CEO needs the "hacker" to either prove it or admit they were mistaken, and bug bounties are exactly how companies do this.

(Also, I feel like it's implied that "an account that isn't yours" doesn't mean "mess with any of our customers you want." He's clarifying that because with white-hat(ish) hackers, you'd be shocked how many people try to claim bug bounties from us because they "hacked" their own account using their own credentials.)

[+] NamecheapCEO|3 years ago|reply
Thanks for your comment and you are correct with your latter point and assumption. It's hard to word things properly when you're limited with the amount of allowed characters on twitter.
[+] muhehe|3 years ago|reply
> you'd be shocked how many people try to claim bug bounties from us because they "hacked" their own account using their own credentials.

Wait ...what? Like, seriously?

[+] LeifCarrotson|3 years ago|reply
> Also, I'll put my money where my mouth is. If you can make any changes to a domain that is not yours or a friend's via our help desk, I will send you 10k USD, no questions asked.

> and to clarify, said account must be protected by 2fa to begin with.

I appreciate what he's trying to say... but perhaps he should instead recommend white-hats instead create a test account and try to access it without using the 2FA mechanism.

[+] NamecheapCEO|3 years ago|reply
I think that's reasonable. I was thinking in terms of cutting out the gaming aspect when I made that statement. I probably should have been more specific. The premise of the entire conversation was based on someone making an unjustified accusation without even following it through and testing it to begin with.
[+] jonny_eh|3 years ago|reply
Or qualify with "harmless changes", like inserting a TXT entry with your name.
[+] nebukadnet|3 years ago|reply
Isn't this standard procedure for big companies? If you point out flaws in their security they will give you a reward.

https://www.techtimes.com/articles/271004/20220125/apple-rew...

https://www.pcgamer.com/security-researchers-aka-hackers-mak...

[+] zdragnar|3 years ago|reply
Not really, they don't often advertise that you should attack their customers directly. The closest I can remember was the LifeLock guy putting his social security number up publicly.

Otherwise, they prefer you hit test or personal accounts rather than paying customers...

[+] CodesInChaos|3 years ago|reply
Hacking accounts without consent of the victim is probably illegal. So normally you'd use an account you own (or your friend/colleague owns), but the challenge is excluding those. The company setting up special test accounts can be a good option as well, but needs to be done in good faith and is problematic when the attack is social engineering based.

So the challenge is either giving attackers permission to hack accounts of strangers, or requires the attacker to engage in potentially illegal behaviour. Neither of which is acceptable.

I assume this is just badly phrased, and what was actually intended was a requirement that the victim doesn't collude with or help the attacker.

[+] sp332|3 years ago|reply
You're not supposed to cause actual substantive changes to actual customers. In addition to being questionably ethical, that would usually disqualify a researcher from any possible bug bounties and forfeit legal protections offered by the program.
[+] AlwaysRock|3 years ago|reply
Well the CEO said they didnt think it was a problem because there is additional security (also a pin code required) to access the account. That is pretty standard for big companies. Saying that actually isnt a problem and either not fixing it or fixing it and not paying a bounty on it.
[+] DethNinja|3 years ago|reply
No, this is illegal and can put namespace into huge trouble.

Responsible Disclosure Programme needs to explicitly state that access to other users data is illegal and test/self owned accounts need to be used for security testing.

This is why legal departments exist, you cannot just say this as a CEO without consulting to your advisors.

[+] politelemon|3 years ago|reply
Maybe you could put your actions where your mouth is and just add a 2fa step to the support portals login process? As a namecheap user I don't want to be randomly targeted to prove a point in some face saving contest.
[+] renewiltord|3 years ago|reply
LOL the hand wringing over this is dumb. If he hadn't made this tweet and his service was hackable you think people wouldn't?

The gain is quite a bit higher than $10k for the right domain. Give me a break.

[+] jjjjjjjjjjjjjjj|3 years ago|reply
Coincidentally I just received an email request to reset my password on Namecheap (not issued by me), anyone else? On top of that, my account has been locked for 24 hours for three consecutive failed password or username entry attempts.
[+] prvit|3 years ago|reply
Perhaps someone just got confused with the amount of j's in their username?
[+] treesknees|3 years ago|reply
You should watch your domains and look out for any friends who suddenly have a new car or a new nice watch :-).

My strategy for things is to use a unique username and email address (and password..) for critical services, that way any hacks/leaks of other sites don't reveal my entire web presence. It may be that your email was found in another dump, or from a domain whois lookup.

[+] teeceetime2|3 years ago|reply
I'm way less upset by this than a large number of people in that twitter brawl. I can agree that this probably isn't the best way to go about things, but in the end, all I see is a CEO taking a firm stance of confidence behind his products - let's just hope this doesn't turn into a real bad situation for namecheap customers. Ballsy? Yeah. But pitchfork and torch worthy? Not really.
[+] tonmoy|3 years ago|reply
Off topic- is there a way to see info on twitter without creating an account? I used to look at tweets from my local meteorologist on twitter but now I can’t seem to be able to view info on twitter without a modal blocking the window and asking me to sign uo
[+] vorvac|3 years ago|reply
Replace twitter.com with nitter.net, that's worked for me
[+] cgb223|3 years ago|reply
If the result of this tweet is that one of my domains is altered, and that I lose income, users, or other useful metrics to measure the value of my site, this seems like a great piece of evidence to be litigious towards Namecheap
[+] s_dev|3 years ago|reply
How is this different from any other bug bounty program as an incentive to compromise live functionality/user data always exists?
[+] deletescape|3 years ago|reply
completely violating your users trust is an interesting way to react to a disclosure of a potential security vulnerability
[+] eknkc|3 years ago|reply
"Nefarious actors are attempting these things 24/7 regardless. As a registrar for millions of domains names, we are constantly under attack so this isn't anything new." - https://twitter.com/NamecheapCEO/status/1564077063480418307

I guess this makes sense. On the other hand such actions might have had legal implications before. I mean until the CEO actively allowed / awarded them.

[+] debacle|3 years ago|reply
Namecheap is good. They are my registrar, even though Amazon would be easier, because their support + personability makes me feel like I'm dealing with human beings.

They are the Linode of the domain space.

[+] EricE|3 years ago|reply
Yikes - never taunt happy fun ball (The Internet)
[+] prvit|3 years ago|reply
What a weird thing to get excited about.
[+] rvz|3 years ago|reply
Hardly surprising if one admits to being a "23 years old", "mentally ill, "anarchist kitten".

So many deranged folks on Twitter these days.

[+] lmilano|3 years ago|reply
> no questions asked

He doesn't even want to know how you did it.

[+] kingofkyiv|3 years ago|reply

[deleted]

[+] sva_|3 years ago|reply
> kingofkyiv.com

> buyagf.com

What the hell am I looking at?

[+] gnomesteel|3 years ago|reply
Guess I should move elsewhere. What is everyone using for domains and DNS these days?
[+] that_guy_iain|3 years ago|reply
Time to move somewhere else because the CEO is so confident they can't be hacked he publically offers money to anyone who can do it? You want to be with one that thinks it is insecure?
[+] nibbleshifter|3 years ago|reply
"Go commit a crime against a third party who didn't consent and I'll give you 10k$" is what this amounts to, given he excludes friends domains from the targets.