The internet's largest registrar, GoDaddy, is in a state of emergency after handing over control of a domain name in exchange for a fake ID (okay, and a little bit of audacity).
Although he did not know the credit card details, the account pin, and did not have access to an existing e-mail account, the largest domain registrar and web hosting service gave him the login details of another person, also providing the ability to change the original details or move ownership outside of the company's systems to another registrar.
The penetration test conducted in response to a challenge from journalist Steve Ragan by VinnyTroia, CEO of security firm Night Lion Security, revealed that GoDaddy, despite multiple security measures, remains vulnerable to social engineering.
Troia managed to bypass the pin request by simply posing as the confused user and saying he had forgotten his password. When asked for the last 4 digits of the credit card, he claimed that the field had been entered by his assistant and that he did not know it .
And as for the e-mail addresses, he claimed that "there are many office policies that he would not like to mention"!
It didn't take much effort on his part, he created a fake social media account, a Gmail to lend credibility, and finally Photoshopped an Indiana driver's license, thus completing his fake identity.
After numerous emails and phone calls over four days, including the weekend, Troia was finally able to gain access to Ragan with nothing more than a few plausible excuses.
The popular registrar finally sent an email to the registered address when it was already too late, namely nine hours after the domain name was granted.
Although it took some skill and knowledge, it remains disturbing that the largest registrar, with at least 60 million domains and at least 13 million customers, can be so easily scammed with methods that take us back to 1995.
While Troia might not have fared as well on an account with a larger number of domains, it did expose a fundamental weakness at the heart of his system.
GoDaddy.
The popular domain registrar appears set to move forward with its long-delayed IPO, as it recently filed a Securities and Exchange Commission (SEC) filing, valuing itself at between $2.6bn and $2.9bn and proposing a starting price of $17-19 per share on the New York Stock Exchange. The IPO was first announced in 2006 but was repeatedly delayed when Google announced its entry into domain sales. Now, it appears GoDaddy executives are going one step further in their attempt to downplay Google ’s moves .
