better check your namecheap accounts - GoFuckYourself.com - Adult Webmaster Forum

X

thommy

Confirmed User

Join Date: Jun 2003

Posts: 5469
Share

Post
#1

better check your namecheap accounts

07-24-2018, 04:54 AM

today a 2 of my publishers had a similar problem with hacked namecheap accounts.

account owner and password have been changed and all domains transfered.
after that blackmail-mail was send to the original owners pay 5 bitcoins within 24 hours.

namecheap support seems to be not very helpful.
livesupport useless and dumb.

up to now I can not say how it was possible to hack this accounts as they are at 2-factor authentication. but i will post it here as soon I find out.

check your namecheap accounts and try to use every security they offer.

also make a cc forwarding for any emails you might get from namecheap to a second
mailaccount because none of my publisher found a mail from namecheap in their regular mailaccounts. so i assume that the hack starts with a hack on the email-account, than they confirm the change and delete the message after.

Open for handpicked publishers and advertisers:
www.trafficfabrik.com
Tags: None
Bladewire

StraightBro

Join Date: Aug 2003

Posts: 56228
Share

Post
#2

07-24-2018, 05:32 AM

Thanks for the heads up

Skype: CallTomNow
Comment
Brian mike

#Alberta51

Join Date: Oct 2014

Posts: 8735
Share

Post
#3

07-24-2018, 05:35 AM

Thanks for the heads up

Tube - Cam - Escorts - Top List
Menu Tab - Banner - Header Link - Blog Post
DM me
Comment
thommy

Confirmed User

Join Date: Jun 2003

Posts: 5469
Share

Post
#4

07-24-2018, 06:22 AM

Originally posted by MrBottomTooth

Disturbing if 2 factor was enabled.. Hopefully namecheap helps the original owners get their shit back. Hopefully nothing is compromised on namecheaps end.

update:
looks like this was caused by a local trojan with a keylogger (that´s why 2 way authentication wasn´t secure enough).

namecheap for now locked the accounts. hope also that there is nothing else compromised because both publishers are really big ones with a lot of good traffic.
hope that it will end up only in a lot of work to change everything and build better security.

my biggest wish is to have 5 minutes with such a guy in one room.
after this 5 minutes he would never do that again.

Open for handpicked publishers and advertisers:
www.trafficfabrik.com
Comment
Ramp

Confirmed User

Join Date: Nov 2006

Posts: 4464
Share

Post
#5

07-24-2018, 06:22 AM

edited...... missed some info
Comment
Arnox

Confirmed User

Join Date: Sep 2009

Posts: 2169
Share

Post
#6

07-24-2018, 06:27 AM

I'm not sure how a local trojan would have made 2FA not secure enough. Can you reset 2FA on NameCheap and it won't alert the 2FA device?

Need Text? X Copywriters | Adult Writing Service - [email protected]
Comment
blackmonsters

Making PHP work

Join Date: Nov 2002

Posts: 20984
Share

Post
#7

07-24-2018, 06:30 AM

Checking mine now.

Your neighbor will murder you with frogs
Click here
Comment
Google Expert

Webmaster

Join Date: Jun 2004

Posts: 14294
Share

Post
#8

07-24-2018, 06:51 AM

Originally posted by thommy

up to now I can not say how it was possible to hack this accounts as they are at 2-factor authentication. but i will post it here as soon I find out.

Just accept the fact that you're a dumbass who shouldn't be allowed on the interwebs.
Comment
Klen

Join Date: Aug 2006

Posts: 32235
Share

Post
#9

07-24-2018, 07:57 AM

Originally posted by MrBottomTooth

Disturbing if 2 factor was enabled.. Hopefully namecheap helps the original owners get their shit back. Hopefully nothing is compromised on namecheaps end.

Any 2fa can be broken if your ride on session, that was recently discovered.
Comment
Klen

Join Date: Aug 2006

Posts: 32235
Share

Post
#10

07-24-2018, 07:57 AM

Originally posted by Arnox

I'm not sure how a local trojan would have made 2FA not secure enough. Can you reset 2FA on NameCheap and it won't alert the 2FA device?

By riding on session. And here is how it works: let's say i have trojan on your PC, and i have access to your browser cookies. So, you login into system, using the 2FA device, and then i copy your cookie into my browser,and i get instant access. This works only as long cookie is valid, so if you click logout it wont work anymore, but if you leave browser without deleting cookie, it will be compromised.
Comment
thommy

Confirmed User

Join Date: Jun 2003

Posts: 5469
Share

Post
#11

07-24-2018, 03:35 PM

Originally posted by Google Expert

Just accept the fact that you're a dumbass who shouldn't be allowed on the interwebs.

thanks for this comment what shows again what clueless idiot you are.

Open for handpicked publishers and advertisers:
www.trafficfabrik.com
Comment
thommy

Confirmed User

Join Date: Jun 2003

Posts: 5469
Share

Post
#12

07-24-2018, 03:37 PM

Originally posted by KlenTelaris

By riding on session. And here is how it works: let's say i have trojan on your PC, and i have access to your browser cookies. So, you login into system, using the 2FA device, and then i copy your cookie into my browser,and i get instant access. This works only as long cookie is valid, so if you click logout it wont work anymore, but if you leave browser without deleting cookie, it will be compromised.

with a keylogger in the trojan there are also a few other ways.
no matter on what device you receive the pin you have to type it into the website.

Open for handpicked publishers and advertisers:
www.trafficfabrik.com
Comment
Arnox

Confirmed User

Join Date: Sep 2009

Posts: 2169
Share

Post
#13

07-25-2018, 05:24 AM

Originally posted by KlenTelaris

By riding on session. And here is how it works: let's say i have trojan on your PC, and i have access to your browser cookies. So, you login into system, using the 2FA device, and then i copy your cookie into my browser,and i get instant access. This works only as long cookie is valid, so if you click logout it wont work anymore, but if you leave browser without deleting cookie, it will be compromised.

Yeah, that's a whole new level of compromised. It'd be nice if they did what crypto exchanges do with Google Auth: every transaction you need to use your 2FA. Logging in 2FA simply isn't enough.

Need Text? X Copywriters | Adult Writing Service - [email protected]
Comment
beerptrol

Confirmed Asshole

Join Date: Feb 2003

Posts: 12722
Share

Post
#14

07-25-2018, 05:35 AM

Originally posted by Google Expert

Just accept the fact that you're a dumbass who shouldn't be allowed on the interwebs.

Says the biggest dumbass! Stick with what you're good at...sucking dick!!

“If we are to have another contest in the near future of our national existence, I predict that the dividing line will not be Mason and Dixon's but between patriotism and intelligence on the one side, and superstition, ambition and ignorance on the other.”
-- Ulysses S. Grant
Comment
thommy

Confirmed User

Join Date: Jun 2003

Posts: 5469
Share

Post
#15

07-25-2018, 05:46 AM

Originally posted by Arnox

Yeah, that's a whole new level of compromised. It'd be nice if they did what crypto exchanges do with Google Auth: every transaction you need to use your 2FA. Logging in 2FA simply isn't enough.

the point here was that it was the local computer what was infected.
it was a very good made DCMA mail with a link (what is in the original mail also like that).

so be aware of obvious DCMA complaints.

looks like this is a new trick what is targeting adult websites with content because they get this kind of stuff quite often.

Open for handpicked publishers and advertisers:
www.trafficfabrik.com
Comment
Matyko

PsyHead

Join Date: Aug 2005

Posts: 8681
Share

Post
#16

07-25-2018, 05:55 AM

Thanks for the heads up! However I left NC some time ago I still have a few domains there. Turned on Two-Factor Authentication.

-=- Register with our ref link and we help you with the setup! -=-
AdSpyglass.com - Double your profit from brokers
Comment
shake

frc

Join Date: Jul 2003

Posts: 4663
Share

Post
#17

07-25-2018, 06:09 AM

Originally posted by Matyko

Thanks for the heads up! However I left NC some time ago I still have a few domains there. Turned on Two-Factor Authentication.

What are you using these days?

I was mostly using enom, but they just doubled their prices on me

Looking for a new register to use.

Crazy fast VPS for $10 a month. Try with $20 free credit
Comment
OneMillionGirls

Confirmed User

Join Date: Apr 2017

Posts: 949
Share

Post
#18

07-25-2018, 08:22 AM

oh no man

Make Money with OneMillionGirls - Join the New Era of PERFECTION & DirtyTalk
Comment
Arnox

Confirmed User

Join Date: Sep 2009

Posts: 2169
Share

Post
#19

07-25-2018, 08:25 AM

Originally posted by shake

What are you using these days?

I was mostly using enom, but they just doubled their prices on me

Looking for a new register to use.

Google Domains is fantastic. I'm willing to pay slightly more if it's a no-bullshit domain host. They give you just what you need and that's it. Light and clean. It's the 21 Naturals of registrars.

Need Text? X Copywriters | Adult Writing Service - [email protected]
Comment
Google Expert

Webmaster

Join Date: Jun 2004

Posts: 14294
Share

Post
#20

07-25-2018, 08:34 AM

Originally posted by beerptrol

Says the biggest dumbass! Stick with what you're good at...sucking dick!!

You've mistaken me for your boyfriend Bladewire.
Comment

Previous template Next

Working...