GoDaddy says a multi-year breach hijacked customer websites and accounts

[dang]

GoDaddy: Hackers stole source code, installed malware in multi-year breach - https://news.ycombinator.com/item?id=34838251 - Feb 2023 (74 comments)

[veqq]

Although we all know GoDaddy's subpar, this is massive:

> credentials that gave it access to a “small number” of employee accounts and the hosting accounts of roughly 28,000 customers.

> obtain login credentials for WordPress admin accounts, FTP accounts, and email addresses for 1.2 million current and inactive Managed WordPress customers

I'm curious what they concretely did:

> goal is to infect websites and servers with malware for phishing campaigns, malware distribution

> weight loss websites

but hm. I guess I don't know a lot about malware, phishing and stuff. How would you gain exactly?

[Retr0id]

The short answer is, malware authors will pay you to distribute their malware.

If you phish someone and gain access to something, you can sell that access to someone else.

The "end" of the chain is things like ransomware, identity theft, cc fraud, etc.

[iambateman]

The article reads like a press release more than journalism.

Multiple uses of the word “sophisticated” as if the only way someone could gain access to Godaddy for _multiple years_ was if they are quite sophisticated, and not as a result of massive negligence on the part of Godaddy itself.

No quotes from the company apologizing.

Godaddy is wild…what a mess.

[sergers]

Had a similar sentiment.

Surprised they didn't come out with government state sponsored actors... Ex china, Russia , and North Korea lol(remember that excuse from sony).

[someonenice]

>> a misconfigured domain name system service at GoDaddy allowed hackers to hijack dozens of websites owned by Expedia, Yelp, Mozilla, and others..

Any idea what was the impact on Mozilla ? Did it impact the Firefox and plugin servers ?

[paranoidrobot]

I can't speak for Mozilla, but I wouldn't be surprised to see GoDaddy and others used for non-core stuff.

The registrar for mozilla.org is MarkMonitor. I'd guess that most (if not all) of their big name/public facing domains are done through MarkMonitor.

Domains used for testing or marketing purposes might be done through GoDaddy and others. This is a fairly common pattern.

[jpleger]

Multi year breaches and general incompetence are kind of Godaddy’s MO. I remember doing notifications of suspicious activity to them and they never bothered even trying to fix it.

I would be shocked if they weren’t running afoul of GDPR required notifications by intentionally putting their heads in the sand and pretending no PII was stolen.

[rodgerd]

Well, when you're more interesting in killing endangered animals to own the libs than you are in running your business, I guess this is what you end up with.

[insane_dreamer]

I find it hard to believe that GoDaddy is still in business. Even 15-20 years ago it felt like it operated barely above scam-level and to be avoided.

[hirako2000]

When small businesses adopted the web for their own little site, godaddy grab the opportunity and exploded. It's not like demand is fading, despite social media platform offering decent storefront for even less money and effort. People want $9 monthly turnkey website, they end up paying more but the hook works.

[xmprt]

That and their "sex sells" approach to marketing in the past has put me off using them.

[TedDoesntTalk]

Still more than $4b in annual revenue!

[MonkeyMalarky]

Customer websites being hijacked and going unnoticed for years is incredible levels of incompetent.

[cyanydeez]

Marginally worse than GoDaddy service