Forest Global Training Partners

Cyber Risks · Krebs on Security

Phish of GoDaddy Employee Jeopardized Escrow.com, Among Others

Summary: A spear-phishing attack on a GoDaddy customer service employee gave an attacker the ability to view and modify key customer records, and that access was used to change DNS settings for a half-dozen GoDaddy customers, including Escrow.com. For about two hours starting around 5 p.m. PT Monday, Escrow.com's homepage was replaced with a profanity-laced plain-text message after its DNS records were pointed to an address in Malaysia, 111.90.149[.]49, and the attacker also obtained free encryption certificates for escrow.com from Let's Encrypt.

Why it matters: GoDaddy acknowledged the March 30 incident and said five other customer accounts were potentially affected, which means a single phished support employee can redirect traffic for domains the registrar's customers rely on. The attacker read internal GoDaddy account notes and called a phone number meant for verbal authorization, reaching Escrow.com's general manager instead, who kept him talking for more than an hour.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related