My website was stolen by a hacker and I got it back (opens in new tab)

I am curious: does anyone here on HN have a registrar to recommend who they know (preferably from experience) would actually be more helpful in this circumstance?

Because from the sound of it, the unwillingness of the registrars (both of them) to take action here without being compelled to by a lawsuit is the root of the problem. The FBI's willingness to be helpful is nice, but doesn't solve the root problem, and as a law enforcement agency they can only really help in cases where they manage to "catch the criminal". And paying off the criminal just isn't an acceptable solution (although stopping the payment immediately is cool and all).

I would be willing to select a registrar on the basis of their policies, not their prices. Policies like this sort of dispute resolution and policies about how they handle DMCA notices or government subpoenas (and non-subpoenas), if only I knew which registrars had the best reputations for these things.

> 1. Have a really, really good password, and change it often. Your password should not contain “real” words (and definitely not more than one real word in immediate proximity, like “whitecat” or “angrybird”), and should contain capital letters, numbers and symbols. The best passwords of all look like total nonsense.

http://xkcd.com/936/

But really, I'm a bit puzzled by her 5 "recommendations". Turn off your devices while you're not using them? I feel like the most important one is missing - don't use HostMonster or Godaddy, their representatives are not paid enough to care about the implications of you losing your domain name.

So apart from the 4 pretty much "how not to happen", try using a host that supports 2FA.

Is there any domain register that offers 2 factor authentication to make changes that are detrimental to a site?

I have Network Solutions, KVC Hosting, and have tried 1and1, but all of them...from a security standpoint...are lackadaisical when it comes to security.

Network solutions WANTS their clients to bundle userid's into 1 account...that makes it easy.

KVC, I emailed them to update my domain contact info, then I transferred one of my domains out with that new email.

I never did any test with 1and1...but then again the 2 above (with kvc and netsol) weren't even tests.

Another security breach involving GoDaddy(1)?

(1): Naoki lost his twitter (https://medium.com/cyber-security/24eb09e026dd)

How was it hacked? I find that info in the article except that they used HostMonster's email confirmation system somehow?

Isn't escrow.com supposed to prevent payments from being stopped after the domain is released? Obviously, in this case it's justified, but for regular customers, you don't want escrow releasing a domain and then the buyer stops payment.

This has a lot of good information in it and I put a lot of time into it, but I do realize it is hard to read since Hacker News doesn't start things on new lines. If someone can tell me how to do that if it is possible that would be great. If not here it is on Pastebin - http://pastebin.com/MspKq8sz.

Here is what I recommend for website security (this is a lot of advice and is not perfect - if you want me to write this up in a detailed blog post and cover more things let me know)... I also provided my contact information at the bottom if you have any questions or need any help settings this up.

Domain Registrar:

1. Melbourne IT - https://www.melbourneit.com.au/ 2. Namecheap - https://www.namecheap.com/ 3. Gandi - https://www.gandi.net/

- Enable WHOIS protection - Enable domain locking - if you want more details on how to set this up let me know - Enable email notifications and make sure you keep your account information up to date - Log in from a computer using a VPN (I use and recommend proXPN - https://proxpn.com/) which encrypts your connection

DNS

1. Any of the domain registrars mentioned above 2. CloudFlare - https://www.cloudflare.com/ (offers performance benefits as well) Their DDOS protection, DNS, and performance benefits are why I use and recommend them. They are not very good in terms of their WAF or website security and that is why I use and recommend Sucuri as well. 3. DNS Made Easy - http://www.dnsmadeeasy.com/

- Follow advice from passwords section - Delete unnecessary DNS records - Enable DNSSEC if possible

Email Hosting

1. I recommend that you use Google Apps for Business - https://www.google.com/enterprise/apps/business/.

- Follow advice from passwords section - Take advantage of the security Google offers

Passwords

1. Create strong passwords using a password generator. I use GRC's Password Generator by Steve Gibson. - https://www.grc.com/passwords.htm 2. Store your passwords in a password manager such as LastPass. - https://lastpass.com/ 3. With LastPass use a strong master password, limit login attempts to your country and the ones you travel to frequently, use two factor authentication, don't use a password reminder, don't write down your master password - only memorize it and don't ever share it, change your master password at least slightly every 3 months, and disable logins from the TOR network. 4. Use the same password only once (Don't use the same password on multiple sites). 5. Don't store your passwords in the browser or save them, so you are automatically logged in. 6. Make sure your password is at least 15+ characters (I use 50+ characters) and it contains lowercase letters, uppercase letters, numbers, and special characters. 7. If a site requires a secret question, make sure the answer to that question no one else would know or make it a password or phrase that you would remember. 8. Use the browser add-on HTTPS Everywhere and use Mozilla Firefox or Google Chrome as your browser. 9. Try to not share your passwords - I would like to say never share your passwords, but I know that is not possible :). If you have to share your passwords, do so using LastPass, change the password after they are done, make sure they haven't done anything that looks malicious, have a clear plan of what they need to do, and ask them how long it will take them.

Website Security

1. Backup your site - I recommend and use Sucuri Backups - http://sucuri.net/services/website-backups (it is $5 a month per website) 2. Use monitoring, alerting, and a removal service - I recommend and use Sucuri - http://sucuri.net/signup

It is $89.99 per year for one website. The service includes 3 main areas which are monitoring (http://sucuri.net/services/website-scan-malware-detection), alerting (http://sucuri.net/services/alerting), and removal (http://sucuri.net/services/malware-removal). You can use any of those links for further details.

3. Use a WAF - I recommend and use Sucuri CloudProxy - http://cloudproxy.sucuri.net/signup ($9.99 a month for the most basic plan - the two other plans are $19.98 and $69.93 per month)

4. There could be a lot more in this area, but that should do a pretty good job for you. If you are using a CMS such as WordPress, Joomla, or Drupal you have quite a bit more you can do in this area.

Hosting

1. It honestly depends on your needs, so I am not going to recommend anyone specifically. If you want help with this or anything you can find my contact information at the bottom.

Network Security

1. Use WPA2 for the encryption protocol 2. Make your network name random 3. Make your password to connect to your network very strong 4. Change the default login credentials to login to your network to a secure username and password. 5. Disable Wi-Fi Protected Setup (WPS) 6. Configure OpenDNS at the router level - http://www.opendns.com/ 7. Follow the passwords section for your passwords

Computer Security

1. Use a antivirus program (Antivirus for Mac by Sophos for MAC computers and Microsoft Security Essentials or Avast for Windows) 2. Use an anti-malware program (Malwarebytes Antimalware and Malwarebytes Anti-Exploit for Windows) 3. Use a firewall (Windows Firewall or TinyWall for Windows) 4. Keep your operating system updated 5. Keep your programs updated (Secunia PSI or FileHippo Update Checker for Windows and AppFresh for MAC) 6. Remove Java and Quicktime if you don't need them 7. Replace Adobe Reader with Foxit Reader or Sumatra PDF 8. Make sure you keep Adobe Flash Player up to date 9. Uninstall programs that you don't need or don't use 10. Only download things from trusted sources (the browser extension Web of Trust would help with this) 11. For your browser make sure you are using Google Chrome or Mozilla Firefox. For Google Chrome and Mozilla Firefox, I recommend that you use Adblock Plus, Disconnect, and HTTPS Everywhere). If you want to be very secure and are somewhat technical, I recommend that you also use NoScript for Mozilla Firefox and NotScripts for Google Chrome.

If you have any questions you can email me at [redacted].

I'm unsure why this is relevant to a site like HN. People are compromised all the time. It's not news. It's not even helpful for avoiding the same mistake: the author does not tell the details of the attack and gives some pretty bad advice for avoiding "cyber hackers" (such as turning off your computer to prevent your email getting hacked).

I feel for her but I do need to point out that some of the suggestions she makes for making it easier to get her stolen domain back would also make it easier for bad actors to cause mischief in the first place. But GoDaddy sucks. True dat.

I don't see how much she paid to get it back. A civil suit filing with a demand for a temporary restraining order and preliminary injunction could be filed in a few hours and since godaddy and hostmonster are US companies, they would have had to comply. She'd have her domain back in a matter of hours for maybe a couple grand.

The most unfortunate part of this story is that the site owner had to use underhanded tactics of her own to regain control of her site. She didn't get her site back by going through formal legal channels, she got it back by using tactics similar to those used by the criminal she was dealing with. Different intent and legal standing, but same methods.

It would be interesting to know what would have happened if she had instead waited for the legal methods to play out. Instead, it's a story of one trick undoing another trick.

The author did not mention that you can pay extra money to lock down a domain.

If it is locked down, it can not be transferred without, iirc, a picture of your driver's license or something like that. There may also be time delays. For my valuable sites, I pay for this service.

I'm curious as to how the FBI helped, because it doesn't really say in the article

Simple way to secure your passwords:

* 1) Use 1Password to generate and store them

* 2) Use DropBox or similar to share your encrypted vault between your devices

* 3) Secure your shard vault with a strong computer-generated password, and keep it written down somewhere

I wonder why strong password management isn't built into operating systems, thus educating everybody and making them ubiquitous. What am I missing? Where is MacPass? WinPass?

The advice on the blog and this comment thread isn't any good, but there's really no good advice besides use a password manager.

I can't understand why people still use GoDaddy. They lose domains to hackers every week, you can just call them and they are more than happy to change contact information or email address for you. Freakin' amazing.

I wonder if her or her husband ever accessed any of their accounts using their cell phones. I've seen tons of stories lately about Samsung Galaxy phones being compromised so at this point I just assume that if top of the line phones are pwned, then all cell phones are.

I'm kind of shocked that there have been no class action lawsuits on phone manufacturers. Especially from banks.. just imagine the liability of millions of customers getting keylogged no matter what the bank uses to secure its site (even two factor authentication). It's almost unfathomable.

Someone really should make a one time pad login that doesn't work a second time even if you look over the user's shoulder. For example their password could be their favorite song and the site would ask them to enter the 2nd, 3rd and 4th letters of the 5th, 6th and 7th word respectively or something. Or how about a custom grid of letters printed on the back of the phone they’d look up positions on so it would have to at least be in someone's physical possession. Or how about a dongle in the headphone jack that's hardcoded and can't be hacked, that the user would type rolling codes through. There has to be a better way of doing this!

I never trust shared hosts provided by a registrar. I have my own blog software running on AWS and I am the programmer and only user. The fewer people involved is better security but that's not generally possible for the average person. At least I can't lose both the domain and the content.

It is not reassuring to see the level of compromise, the cost of disclosure, and the abuse of antiquated protocols rising faster than the institutions that depend on them can respond. In particular there was a lot of resistance early on to using credit cards on the Internet, now it is nearly compulsory, and yet many of the fears that banks and others raised in the early days of e-commerce are coming to pass.

I have to believe there are some seriously rich criminals out there. What do they expect to do with their ill gotten gains?

I am absolutely shocked at how simple it is for this sort of fraud to take place. If someone calls GoDaddy, for instance, and says "Hi, I'd like to transfer a domain name. Here's all of my proof that I am who I say that I am." I understand that GoDaddy, ever dutifully obliged to their customers, will transfer the domain with haste. However, should there not be some sort of probationary period? 45 days or so where both GoDaddy and the new "owner" of the domain both have full, master control? It seems to me that an account manager in GoDaddy could handle this task easily enough. Simply coordinate with the new owner, notify that there's a dispute, and lock everything down until a resolution has been completed. Am I missing something here or are these companies simply lazy and unmotivated?

Here are 3 simple changes that can prevent this:

* use 2 factor authentication (if your registrar doesn't find one that does or better yet, have ICANN rule that all registrars must have it)

* ICANN rule that says if a domain has been recently moved it can be frozen by previous owner until the matter is cleared up

* whois privacy will not only hide who the owner of the site is but also who the registrar is (if you don't know who the registar is among the hundreds out there, you can't target the right one with social engineering!)

-Your password should not contain “real” words (and definitely not more than one real word in immediate proximity, like “whitecat” or “angrybird”), and should contain capital letters, numbers and symbols. The best passwords of all look like total nonsense

I think this is a bad advice. You only need long password that are not feasible for a brute force attack and not trivial (personal data). If you have a password you can't remember you are going to write it somewhere and that can be a security issue

> 2. If possible, use a separate computer (an old one or a cheap one purchased for this purpose) for things like banking; if your family computer is the same one that you use for bank transactions you risk having your kids click on a bad link that results in a hacking.

Or don't let your kids use your work computer when you have very important privileges at stake? I would definitely keep all of this in a very encrypted environment that isn't accessible by my kids or anyone else.

Welcome to 1999. This reminds me of when sex.com was stolen with fake stationary. I see the "unauthorized transfer" in the blog post but I wonder if she forgot to renew the domain? Happens to good people all the time. I'm not a lawyer, but in that case, unless she's incorporated as "ramshackleglam" there's no cybersquatting argument. That's why it's helpful to use your real name--then a thief has no leg to stand on.

>cyber hacking

For when just 'cyber' and just misuse of the word hacking aren't enough.

Edit: >assuming that... my husband had accidentally logged into my account instead of his own

I think this shows her attitude to security could at best be described as lax.

>3. Turn off your computer and personal devices when they’re not in use.

I... this is... wow, what.

Don't the companies have the lawsuit issue backwards? By not helping aren't they opening themselves up to being sued whereas if they immediately fixed the problem the person would have almost no reason to initiate a law suit.

I'm partial to the "t33nz 1o1 \o/" cipher.

    input: correcthorsebatterystaple
    output: ~~krct^hrs333bttstpl$$:)

    input: password
    output: lulz!isma:PASSWORD#sorrynotsorry

This is why corporations with 12 million users need to establish personal relationships with every client. If that was the case, they'd have just known she was the real owner.