Forest Global Training Partners

Cyber Risks · Krebs on Security

Crooks Continue to Exploit GoDaddy Hole

Summary: KrebsOnSecurity reported that GoDaddy fixed an authentication weakness on January 23 that let anyone add a dormant domain to a GoDaddy account without proving ownership, and that the fix did not stop a GandCrab ransomware spam campaign around February 1 that used domains with altered DNS records. GoDaddy spokesperson Dan Race said the GandCrab domains were modified before the mitigation but missed in the initial sweep, and that the company's DNS servers were not compromised.

What you should know: The spam worked because the sending domains were old and reputable, some registered more than 10 years, so the messages cleared filters that a new domain never would. A.S. Price Mechanical, a small South Carolina metal fabrication business, had a hard drive encrypted by GandCrab and saw its $2,000 bitcoin demand doubled to $4,000 while it deliberated.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related