Someone's Namecheap account was handed over to a stranger, despite warning

[NotATether]

Lots of people here are using Namecheap for their domain registration, so I hope this incident wakes them up and makes them move their domains to somewhere safer!

A Namecheap customer of 13 years is appealing to the community after they changed his email and password at an unauthorized party's request.

The customer told them that this transfer request was unauthorized, but Namecheap performed it anyway.

The transfer request was apparently made over phone call.

This all could've been prevented by strong multi-factor authentication, so this wouleve definitely stopped the take over as long as the unauthorized party doesn't have access to the security keys.

The original topic: https://news.ycombinator.com/item?id=49028037

[rat03gopoh]

This all could've been prevented by strong multi-factor authentication,

In a subsequent comment, the OP even admitted he had enabled 2fa, but it didn't actually work in that situation. https://news.ycombinator.com/item?id=49028795

There are several other stories from other commenters that I believe are rooted in Namecheap's security system being quite vulnerable.
https://news.ycombinator.com/item?id=49028523
https://news.ycombinator.com/item?id=49028910

[eaLiTy]

~
A Namecheap customer of 13 years is appealing to the community after they changed his email and password at an unauthorized party's request.

The customer told them that this transfer request was unauthorized, but Namecheap performed it anyway.

The transfer request was apparently made over phone call.

It is completely irresponsible of Namecheap to change credentials simply based on a phone call.

A similar incident happened with our forum around 2015. The attacker was able to acquire KVM access and convince the ISP NFOrce to reset the server's root password, giving them complete access to the server. This sort of social engineering hack has been common for over a decade, making this a completely irresponsible move by Namecheap.

You can read the rest of the story about that hack here. : https://bitcointalk.org/index.php?topic=1067985.msg11445725#msg11445725

[Synchronice]

I have a question which I always wanted to ask but for some reasons it was always in my mind but this topic gives me a good chance.

For example, if someone hacks my namecheap account or namecheap gets hacked and hackers gain access to my account, transfer my domain and so on, what happens then? If it wasn't my fault and if it was a Namecheap's data breach for example? Will I be able to reclaim my domain? The reason I have this question is that there are lots of pirate website domains registered and authorities aren't able to shut down those domains by just request, all they can do is to block them locally or seize the website.

[examplens]

I have a question which I always wanted to ask but for some reasons it was always in my mind but this topic gives me a good chance.

For example, if someone hacks my namecheap account or namecheap gets hacked and hackers gain access to my account, transfer my domain and so on, what happens then? If it wasn't my fault and if it was a Namecheap's data breach for example? Will I be able to reclaim my domain? The reason I have this question is that there are lots of pirate website domains registered and authorities aren't able to shut down those domains by just request, all they can do is to block them locally or seize the website.

In the regular process, Namecheap should return the domain to you after submitting proof of previous ownership, paying for the domain renew... would be necessary. In case that doesn't work, ICANN is the next instance (if it is under their authority).
Unfortunately, this process can take some time

[JeromeTash]

I have no experience with domain registration or having a Namecheap account in this case, but I guess the account is supposed to be one of those most secure accounts around to avoid any attacks, and Namecheap should be ensuring that the accounts are completely secure before anyone even thinks of using them.

I like how you can't just change your email address and 2FA on certain centralised exchanges until they are more than certain that it's actually you who wants to change the details through KYC, among other things.

By the way, @NotATether, the link doesn't seem to work. Could the posts have been deleted?

[PX-Z]

I have a question which I always wanted to ask but for some reasons it was always in my mind but this topic gives me a good chance.

For example, if someone hacks my namecheap account or namecheap gets hacked and hackers gain access to my account, transfer my domain and so on, what happens then?

That won't happen especially if the domain is lock for transfer which it is usually is. Also, it means your email was hacked too as an authorization code is needed. And it will take days for the process to complete. Unless you're very busy and havent check your email or havent notice the notification. If it happens, then the above reply is the right track to do, and dispute it, registrars who value their users will eventually solve that problem.

[goldkingcoiner]

Lots of people here are using Namecheap for their domain registration, so I hope this incident wakes them up and makes them move their domains to somewhere safer!

A Namecheap customer of 13 years is appealing to the community after they changed his email and password at an unauthorized party's request.

The customer told them that this transfer request was unauthorized, but Namecheap performed it anyway.

The transfer request was apparently made over phone call.

This all could've been prevented by strong multi-factor authentication, so this wouleve definitely stopped the take over as long as the unauthorized party doesn't have access to the security keys.

The original topic: https://news.ycombinator.com/item?id=49028037

Yeah multi-factor authentication is important (it can be a total pain if you lose it though). And a serious business enforces it on users.

Namecheap is possibly at fault here and should compensate any damages.

Going forward, I would avoid Namecheap. There are better alternatives which do not perform unauthorized requests.

[robelneo]

Lots of people here are using Namecheap for their domain registration, so I hope this incident wakes them up and makes them move their domains to somewhere safer!

As someone who has a number of domains under Namecheap, I find this alarming; they're an industry giant. This thing should not happen to any of their client. I would have to ask support personally about this issue because if your domain can be transferred by a simple phone call, what would stop scammers from stealing your domain?

This all could've been prevented by strong multi-factor authentication, so this wouleve definitely stopped the take over as long as the unauthorized party doesn't have access to the security keys.

They have a strict transfer protocol that takes days to complete; I believe the protocol was not followed, and Namecheap could be responsible for this.

Shortly after order submission, the transfer gets initiated at the Registry, and the domain acquires 'pendingTransfer' status. Transfers that have reached this stage are automatically confirmed within 5 days. Finally, it may take additional 24-48 hours for the Registry to complete the transfer.

How to Transfer a Domain

[The Cryptovator]

A Namecheap customer of 13 years is appealing to the community after they changed his email and password at an unauthorized party's request.

The customer told them that this transfer request was unauthorized, but Namecheap performed it anyway.

The transfer request was apparently made over phone call.

This all could've been prevented by strong multi-factor authentication, so this wouleve definitely stopped the take over as long as the unauthorized party doesn't have access to the security keys.

I have read the full story, but it's unbelievable. I have been using Namecheap for a domain as well as their hosting. Whenever I want to get support, they ask me my account PIN that I have on the account. How is it possible they changed the email and password without requesting it from the original email? If the story is true, then it's quite dangerous for us those who have been using Namecheap to register their domain and their hosting as well.

I can't even log in without verification if the IP or device has changed; it should be the same for every Namecheap user. But changing account credentials without authorization looks quite unrealistic to me. If it's not smear campaigns, then people may start leaving Namecheap and move to another platform. It was my favorite domain name provider for me due to crypto acceptance. Probably they will lose me if the story becomes true. I will try to take a deep look at that matter.

[Stalker22]

Lots of people here are using Namecheap for their domain registration, so I hope this incident wakes them up and makes them move their domains to somewhere safer!

As someone who has a number of domains under Namecheap, I find this alarming; they're an industry giant. This thing should not happen to any of their client. I would have to ask support personally about this issue because if your domain can be transferred by a simple phone call, what would stop scammers from stealing your domain?

No, I dont think domains can be transferred with a simple phone call.  But you have to think about the other side of the story: what if you actually lose access to your email address and need to change it, but you cant log in to Namecheap anymore?  Thats the nightmare scenario support teams deal with every single day.  They are constantly forced to walk a thin line between locking down security and actually helping legitimate account owners who completely locked themselves out.

If you make recovery impossible without access to your primary email or 2FA, you will inevitably end up permanently bricking thousands of real users businesses.  But if you leave any human backdoor open, like identity verification through support, clever hackers with social engineering skills will eventually find a way to exploit this.

[PX-Z]

... I have been using Namecheap for a domain as well as their hosting. Whenever I want to get support, they ask me my account PIN that I have on the account. How is it possible they changed the email and password without requesting it from the original email? If the story is true, then it's quite dangerous for us those who have been using Namecheap to register their domain and their hosting as well.

Right? It's their standard and many stuff for verification if done on email or live support as per my experience too. But i guess this is an isolated case on the specific support staff who bypass their standard way of verification but who knows. If there will be lots of case like this, then there's no way i will stay there as well. I have at least 5 domains there.

[Synchronice]

I have a question which I always wanted to ask but for some reasons it was always in my mind but this topic gives me a good chance.

For example, if someone hacks my namecheap account or namecheap gets hacked and hackers gain access to my account, transfer my domain and so on, what happens then? If it wasn't my fault and if it was a Namecheap's data breach for example? Will I be able to reclaim my domain? The reason I have this question is that there are lots of pirate website domains registered and authorities aren't able to shut down those domains by just request, all they can do is to block them locally or seize the website.

In the regular process, Namecheap should return the domain to you after submitting proof of previous ownership, paying for the domain renew... would be necessary. In case that doesn't work, ICANN is the next instance (if it is under their authority).
Unfortunately, this process can take some time

Really? I didn't know that. Then why does the FBI and other organizations don't simply shut down the domain of a website they don't like? For example, why didn't they terminate the domain name of megaupload, chips mixer and other websites? It might be a dumb question, I don't know but I really wanna know why they don't simply seize the domain name instead of fighting for catching the criminal for years and then seize the website at that moment.

That won't happen especially if the domain is lock for transfer which it is usually is. Also, it means your email was hacked too as an authorization code is needed. And it will take days for the process to complete. Unless you're very busy and havent check your email or havent notice the notification. If it happens, then the above reply is the right track to do, and dispute it, registrars who value their users will eventually solve that problem.

Actually, I was talking about the moment when 2FA and other authentications are bypassed. Anyways, I know that talking about this will take us a long time and I know about the methods they use for it. Thanks for the answer though, it was interesting because I don't have an experience of transferring a domain. I keep all of my domains on one account for more than a decade and I never had a problem. I take care of the security.