How secure is your domain name?

A websites worth is tied to it’s domain name. When you build traffic to a website you are building traffic for that domain name, when you develop back links to the site you are developing links for that domain name. If you lose your domain name you effectively lose your business and everything you have spent working towards.

This is why it’s important to lock your domain, why you should always make sure your domain is auto renewed and most importantly, make sure your domain name isn’t stolen. Unfortunately, there have been more reports of domain name hijacking in the last few months.

Hijack of DavidAirey.com

The first person I personally knew who had his domain name hijacked was David Airey, the designer who created the BloggingTips logo. About a year ago David went on holiday in India and told his readers he would be away for a few weeks. A criminal took advantage of this and used a google mail security flaw to hijack his domain name. Once the scumbag had Davids email he simply put in a domain transfer request from ICDSoft and transferred the domain name to GoDaddy.

David contacted the guy, named Peyam, and got this response :

:))
Im sorry to say but its not possible to have it or it take about 1 month if you try hard to have it again :)) and you lose your visitor ….hahaha
You can purchase it for 650 $ And we will use escrow sevices that will done in less than 2 days !

With the help from many of his readers David managed to get his domain name back but I can only imagine the stress and frustration which was caused by the whole ordeal.

Hijack of MakeUseOf.com

Earlier this month I read how Aibek Esengulov, owner of MakeUseOf.com, lost his domain name to a domain hijacker. The domain was registered at GoDaddy so the criminal (or should I say scumbag, douchebag, a’hole!) called up and impersonated Aibek and demanded the domain name be transferred to an account at NameCheap. Apparently, this was all done within an hour.

In response Aibek setup a temporary blog on blogspot to get more coverage about the hijcack. Many blogs including Daily Blog Tips, Digital Inspiration, Performancing, The Inquistr, The Next Web, TechyShit and LinkMoney gave their full support and spread the word about the hijack.
In this instance the hijacker asked for $2,000 to get the domain name back and quite rightly, Aibek refused to pay.

Aibek then went through the same procedure David Airey did and after sending some documents to GoDaddy they spoke with Enom (NameCheap is an enom reseller) and got the domain name back.

How secure is your domain name?

There are two things about these stories that worry me. Firstly, I think that domain registration companies should be doing more to prevent domain hijacking in the first place. Surely they can add a few more security steps along the way or at least provide an option for that. Some domain name companies let you password protect each domain individually so perhaps more options like that should be added.

For example, you need to provide your mothers maiden name or secret password in order to transfer the domain and if you do not have that information you need to send them evidence of who you are. I know this would be a real pain in the ass but if it stops domains from being hijacked so easily it’s surely worth the extra hassle. I need to give credit to Godaddy and Enoms support teams though as in both instances they did get the domain back to it’s rightful owner after just a few days.

Secondly, it concerns me that GMail can still be hacked so easily. Indyan posted in the forums yesterda that Aibek has confirmed that the hijacker hacked his GMail account in order to get the domain name. It’s scary to think that a domain hijacker can use the same technique which was causing havoc last year.

Aibek also confirmed that the guy who stole his domain has also stole YuMP3.org and Cucirca.com and is maybe the same guy behind 788 other stolen domain names.

How to protect your GMail Account

The technique which was used to hack David Aireys GMail account was explained by GNUCitizen around 14 months ago :

The victim visits a page while being logged into GMail. Upon execution, the page performs a multipart/form-data POST to one of the GMail interfaces and injects a filter into the victim’s filter list. In the example above, the attacker writes a filter, which simply looks for emails with attachments and forward them to an email of their choice.

This filter will automatically transfer all emails matching the rule. Keep in mind that future emails will be forwarded as well. The attack will remain present for as long as the victim has the filter within their filter list, even if the initial vulnerability, which was the cause of the injection, is fixed by Google.

I’m not sure if hackers are using the exact same technique but it wouldn’t surprise me.

If you use GMail then you should be concerned about this. Aibek posted some great tips on how you can protect your GMail account and your domain name. This is what he suggests :

1. Well, my very first advice would be to check your email settings and make sure your email is not compromised. Check fowarding options and filters. Also make sure to disable IMAP if you don’t use it. This also applies to Google Apps accounts.
2. Change contact email in your sensitive web accounts (paypal, domain registrar etc.) from your primary Gmail account to something else. If you own the website then change the contact email for your host and registrar accounts to some other email. Preferably to something that you aren’t logged in to when browsing web.
3. Make sure to upgrade your domain to private registration so that your contact details don’t show up on WhoIS searches. If you’re on GoDaddy I’d recommend going with Protected Registration.
4. Don’t open links in your email if you don’t know the person they are coming from. And if you decide to open the link make sure to log out first.

Overview

Having your domain name stolen is frustrating, stressful and potentially costly so be proactive and make sure your domain name is secure as it can be. I recommend paying extra to have your domain whois information protected and hidden from the general public and password protecting your domains if you have the option too.

Scarier than losing your domain name is having your Gmail account hacked. If you have emails with passwords in your gmail account then the hacker could cause mayhem and get access to your paypal, bank accounts or whatever.

If you have any tips or advice on protecting your domain name or Gmail account please leave a comment.

Thanks,
Kevin

* Kudos to Aibek of MakeUseOf.com for helping other webmasters who have had their domain stolen and for doing his best to warn others of this potential nightmare