GoDaddy joins the dots and realizes he’s been under attack for three years • The Register

In short Web hosting and domain name company GoDaddy has disclosed a new attack on its infrastructure and concluded it was one of a series of related incidents dating back to 2020.

The company took the unusual step of detailing the attacks in its Form 10-K – the official annual report that listed entities are required to file in the United States.

The filing details a March 2020 attack that “compromised the hosting login credentials of approximately 28,000 hosting customers to their hosting accounts as well as the login credentials of a small number of our staff” and a November 2021 breach of its hosted WordPress service.

The latest attack took place in December 2022, when boffins detected “an unauthorized third party accessed and installed malware on our cPanel hosting servers,” the filing said. “The malware intermittently redirected random customer websites to malicious sites.”

GoDaddy is unsure of the root cause of the incident, but believes it may be the result of a “multi-year campaign by a sophisticated group of actors who, among other things, installed malware on our systems and obtained pieces of code related to certain services within GoDaddy.”

“To date, these incidents and other cyber threats and attacks have not resulted in any material adverse impact on our business or operations,” the filing said – showing enormous empathy for customers whose sites were redirected during the most recent attack, or hit. by previous incidents.

In a brief statement on the incident, GoDaddy speculated that the goal of the December 2022 attacks “is to infect websites and servers with malware for phishing campaigns, malware distribution and other malicious activities”.

–Simon Sharwood

Moscow plans to legalize piracy – but only for the glory of Mother Russia

The Russian government is working on changes to its penal code that would legalize piracy in the Federation – provided it is done in the service of Russian interests, of course.

According to the Russian news service TASS, Alexander Khinshtein, head of the State Duma’s committee on information policy, wants exemptions from liability for hackers, but other than throwing the idea at journalists, he doesn’t. had no details to add.

Yet, Khinshtein said, “I firmly believe that it is necessary to use all resources to fight the enemy effectively”, adding that Russia must be able to respond adequately to any threat – and who better to help than a well-established army. of pirates?

Hacking groups linked to Russia are notorious for the damage caused – or attempted – by groups like Killnet, Cozy Bear, Vice Society or any of the myriad others linked to attacks on its enemies – both in Ukraine and elsewhere.

These groups may operate with some impunity in Russia, but the law is still not on their side, as TASS has pointed out. Russian cybercrime laws are strict – if not always enforced – and exceptions are said to be non-existent.

Two sets of laws relate to piracy activities: Articles 272 and 273 of the Criminal Code of the Russian Federation, which respectively cover illegal access and the creation, distribution and use of malicious computer software.

Illegal access and/or use of malware, if it results in “serious consequences or (the creation of) a threat”, can get a Russian up to seven years in prison, with lesser penalties possible for less damage or acting independently of a group.

Adding exceptions for what TASS has described as “white hat” operations in the interests of the Russian government would give considerable leeway to state-sponsored hackers who are already doing so.

More alarming, however, is the encouragement it would give to green hats more likely to break a system than break into it, script kiddies for the lulz, and turnkey dark web scammers. There is no indication that such a law is about to be passed – Khinshtein said it still needs to be discussed “in more detail” – but it could be a good idea to strengthen this security posture. Especially if you are in a critical industry.

Emergency declared in Oakland, California after ransomware attack

Oakland, Calif., declared a state of emergency on Valentine’s Day — and not because there was too much love in the air. A week of work did little to eliminate a ransomware attack that hit the city on February 8.

As we reported in last week’s Security Roundup, the attack did not take down 911 services, disrupt finances or worsen emergency response times, but the precaution of taking much of the city’s network offline to stop the attack led to a slow recovery. and some inaccessible non-emergency systems.

“The network outage impacted many non-emergency systems, including our ability to collect payments, process reports, and issue permits and licenses,” the city said in a 15 update. February, adding that residents should call before coming to a city office. in case it is closed.

The Oakland government said police and fire departments are still responding to emergency calls as usual, but non-emergency requests should be made online or reported by calling the local non-emergency 311 line.

By declaring a state of emergency, Oakland accelerated its ability to procure equipment and materials to respond to the ransomware attack, as well as activate rescuers and facilitate the issuance of orders by the leaders.

The Oakland city government said the investigation into the attack is ongoing and law enforcement is investigating. The city did not say how the attack happened, who was behind it, or what sort of ransom demand was made. ®