Hackers Hijack Many New Company Accounts With Domain Names On Squarespace



Introduction

More than one dozen firms with domain names found across Squarespace witnessed their websites get hijacked recently. This incident highlights a critical flaw in domain security that needs immediate attention. Domain security is paramount as it protects the online identity and assets of businesses.

Background

In June of last year, Squarespace acquired assets belonging to Google Domains, encompassing nearly 10 million domain names. The acquisition aimed to streamline services and provide a unified platform for domain management. However, the migration process left several vulnerabilities exposed.

The Hijacking Incident

The domain hijacking incident lasted from July 9th to 12th, primarily targeting crypto-themed entities such as Celer Network and Pendle Finance. During this period, malicious hackers took advantage of the migration process's loopholes, leading to significant security breaches.

How the Hijacking Occurred

Hackers exploited a flaw in the migration process that allowed them to supply email IDs linked to a domain that was still under registration. Without proper email validation, attackers could easily create accounts linked to these domains, bypassing the need for passwords initially set by legitimate users.

Impact on Crypto-Themed Entities

The hijacking primarily affected crypto-themed entities, which are lucrative targets due to the substantial funds involved. Companies like Celer Network and Pendle Finance faced potential financial losses as their domain names were compromised, putting their users at risk.

Redirecting to Phishing Sites

Once the attackers gained control of the domains, they redirected them to phishing sites designed to steal crypto funds from visitors. This method is particularly dangerous as it exploits the trust users place in these platforms, leading to significant financial losses.

Squarespace's Response

In the wake of the incident, Squarespace opted to remain silent initially, offering no comments or statements regarding the attack. However, the company has since taken steps to address the vulnerabilities and prevent future incidents.

Expert Analysis

Cybersecurity experts have analyzed the incident, highlighting the flaws in Squarespace's migration process. The assumption that users would opt for 'Continue with Apple or Google' over 'Continue with email' proved to be a critical oversight.

Metamask's Insight

The head of Metamask explained how Squarespace never anticipated threat actors signing up for accounts linked to newly migrated domains before the legitimate email holders did. This oversight allowed attackers to exploit the system and hijack the domains.

Lack of Domain Activity Insights

One major concern is the absence of activity insights or audit logs for domains managed by Squarespace. Without these logs, it's challenging to detect and respond to unauthorized actions, making domains vulnerable to hijacking without any alerts being sent.

Further Exploitation Risks

The lack of robust security measures means that future exploitation risks remain high. It's crucial for Squarespace and other domain management platforms to implement stricter security protocols to safeguard their users' assets.

Steps for Affected Users

For users affected by the hijacking, immediate actions include enabling two-factor authentication, reviewing and removing unnecessary contributor accounts, and reverting unauthorized changes. Long-term security practices should involve regular monitoring of domain activity and employing strong, unique passwords.

Preventing Future Attacks

To prevent future attacks, Squarespace must improve its security measures, including mandatory email validation and comprehensive audit logs. Users should also be vigilant and proactive in securing their domains, using robust security tools and practices.

Conclusion

The recent domain hijacking incident at Squarespace serves as a stark reminder of the importance of domain security. By addressing the vulnerabilities and implementing stronger security measures, both Squarespace and its users can better protect their online assets and identities.

FAQs

How did the hackers exploit the flaw?

Hackers exploited a flaw in the migration process by supplying email IDs linked to domains that were still under registration, allowing them to create accounts without proper validation.

Which companies were most affected?

Crypto-themed entities like Celer Network and Pendle Finance were among the most affected, facing potential financial losses due to the hijacking.

What steps should users take now?

Affected users should enable two-factor authentication, review and remove unnecessary contributor accounts, revert unauthorized changes, and regularly monitor their domain activity.

How can future domain hijackings be prevented?

Future hijackings can be prevented by implementing stricter security measures, such as mandatory email validation, comprehensive audit logs, and robust monitoring tools.

What changes has Squarespace implemented post-attack?

Squarespace has started disallowing the creation of new accounts using only an email address and is likely working on further security enhancements to prevent similar incidents in the future.

Tags: Hackers Hijack Company Accounts, Squarespace Domain Hijacking, Cybersecurity Incident, Crypto-Themed Entities, Domain Security Flaws, Google Domains Acquisition, Phishing Attacks, Domain Migration Vulnerabilities, Email Validation Issues, Cybersecurity Measures, Two-Factor Authentication, Domain Management Security, Squarespace Response, Protecting Online Assets, Cybersecurity Best Practices

Read more : https://www.hostingbyalitech.com/blog

Alitech Blog

Posted in Uncategorized on Jul 19, 2024



[SOLVED / FIXED] LinkedIn Company Page Creation error : An error has occurred, please try again later. Learn more.

Posted on Jun 09, 2021

[FIXED] : LinkedIn Company Page Creation error : An error has occurred, please try again later. Learn more. [SOLUTION]: In order to create a Company Page in LinkedIn you will need to meet all the requirements below.



WordPress Hosting & Management

Posted on Nov 04, 2024

Choosing the right WordPress hosting service is one of the most critical decisions you’ll make when building a website. The hosting provider you select can impact your site’s speed, security, and reliability. With so many options available, understanding the different types of WordPress hosting can help you make an informed choice. This guide will delve into the various aspects of WordPress hosting and management, providing insights that can empower you to create a successful online presence.



ACME now uses ZeroSSL, here is what you need to do for your CyberPanel

Posted in Technical Solutions on Jul 02, 2021

ACME now uses ZeroSSL, here is what you need to do for your CyberPanel.



[SOLVED / FIXED] Python Django - TypeError: can't multiply sequence by non-int of type 'float'

Posted in Technical Solutions on Apr 02, 2022

[SOLVED / FIXED] Python Django - TypeError: can't multiply sequence by non-int of type 'float' Error: Language : Python Django TypeError: can't multiply sequence by non-int of type 'float'<strong>SOLUTION / FIX



[SOLVED / FIXED ] ModuleNotFoundError: No module named 'setuptools_rust'

Posted in Technical Solutions on Apr 09, 2022

[SOLVED / FIXED ] ModuleNotFoundError: No module named 'setuptools_rust' Error: While installing docker-compose the following error can come up: ModuleNotFoundError: No module named 'setuptools_rust'



Litespeed performance comparison

Posted in News on Sep 08, 2022

Our server supports Lite Speed webserver: With the power of LiteSpeed server your websites will have outclass performance see the difference. The benchmark shows the difference of Magneto performance on LiteSpeed server, Nginx & Apache.



OpenAI Just Announced New AI Features: Key Takeaways from DevDay

Posted in News on Oct 02, 2024

OpenAI has once again made headlines with a series of groundbreaking announcements at its recent developer event, DevDay. These updates promise to change the way developers and entrepreneurs build AI-powered products. Whether you're working on a new voice assistant or simply trying to optimize API usage, these new features will play a pivotal role in enhancing the performance and accessibility of AI technologies. In this article, we’ll break down everything you need to know about the new tools and capabilities OpenAI announced. From AI voice assistants to cutting-edge API updates, these innovations are setting the stage for the future of AI.



Qualcomm's Snapdragon 8 Elite: A Game Changer in Mobile Processing

Posted in News on Oct 22, 2024

Qualcomm has unveiled its Snapdragon 8 Elite chip, marking a significant advancement in mobile technology. This new chip features the custom-designed Oryon CPU, built on a 3nm process node, which provides a 45% increase in performance compared to its predecessor, the Snapdragon 8 Gen 3, while consuming 27% less power. For gamers, the Snapdragon 8 Elite promises a 40% boost in gaming performance, enabling smoother graphics and faster response times. Enhanced AI capabilities mean improved photography and smarter app interactions, making low-light shots and real-time image processing much more effective. With new smartphones from brands like Samsung and OnePlus set to launch soon, the Snapdragon 8 Elite is set to redefine the mobile experience, offering users unprecedented power and efficiency.



California Governor Vetoes Major AI Safety Bill: What It Means for AI Regulation

Posted in News on Sep 30, 2024

California Governor Gavin Newsom has vetoed SB 1047, a major AI safety bill aimed at regulating advanced AI systems. The bill would have mandated safety measures like testing and a “kill switch” for high-risk AI models. Newsom argued that the legislation could hinder innovation and impose excessive regulations on AI companies. Tech giants such as Google and OpenAI supported the veto, fearing it would slow AI development. The decision has reignited the debate on finding the right balance between innovation and public safety in the rapidly evolving field of artificial intelligence.



Google Search Impact - Congrats on reaching 900 clicks in 28 days!

Posted in News on Mar 05, 2022

Google Search Impact - Congrats 900 clicks 28 days! - Awesome



Cheap Web Hosting in Pakistan: Your Ultimate Guide

Posted in Hosting Promotions on Jun 07, 2024

Looking for affordable web hosting solutions in Pakistan? Dive into our comprehensive guide to find the best options for your website without breaking the bank.



AI-Generated Captions Come to Max via Google

Posted on Sep 25, 2024

Warner Bros. Discovery has partnered with Google to launch "Caption AI," an innovative tool that uses AI technology to automatically generate captions for unscripted programming on the Max streaming service. Built on Google’s Vertex AI platform, this collaboration aims to cut captioning costs by up to 50% and reduce production time by 80%. As the media industry increasingly embraces AI, this partnership highlights the potential of technology to streamline processes while maintaining quality and accuracy in content accessibility.



Automated Backup to GoogleDrive - CyberPanel - HostingbyAliTech

Posted in About Hosting by AliTech, Technical Solutions on Jul 18, 2021

Automated Backup to GoogleDrive - CyberPanel All the Hosting by AliTech customers have access to GoogleDrive Backups, here is what you need..



Comprehensive Guide to Choosing the Right Domain and Hosting Services for Startups

Posted in Uncategorized on Jul 01, 2024

In today’s digital landscape, choosing the right domain name and hosting services is crucial for startups aiming to establish a strong online presence. This comprehensive guide explores the importance of domain selection, optimal hosting solutions, and popular CMS platforms like WordPress, WooCommerce, Joomla, and more. Whether you're deploying NodeJS, Django, Ruby on Rails, React, or other frameworks, understanding these elements is essential for scalable growth and seamless user experiences.



The Pros and Cons of Using a Free Web Hosting Service

Posted in Uncategorized on Jul 26, 2024

Choosing the right web hosting service is crucial for your online presence. Free web hosting might seem appealing, especially for startups and personal projects, but it's important to weigh its benefits and drawbacks. While cost-effective and user-friendly, free web hosting often comes with limitations in resources, performance, and security. Understanding these pros and cons can help you decide if free web hosting is the right choice for your website.



The Ultimate Guide to WordPress Hosting 2024

Posted in Uncategorized on Jul 05, 2024

Unlock the full potential of your WordPress website with the ultimate guide to WordPress hosting! Discover the importance of choosing the right hosting, explore the different types of hosting options, and learn how to migrate and set up your WordPress site for success. Get the inside scoop on top hosting providers, advanced features, and troubleshooting tips. Whether you're a beginner or a seasoned pro, this guide has got you covered. Read now and take your website to the next level



Experience Unmatched Performance with LiteSpeed: A Comparison

Posted in News on Jun 07, 2024

Discover how LiteSpeed outperforms Nginx and Apache in delivering superior website performance, enhancing user experience for platforms like Magento and WordPress.



How to Choose the Best Domain Name for Your Website

Posted in Uncategorized on Jul 09, 2024

Choosing a domain name is more than just picking a web address; it’s about creating your online identity. Your domain is the gateway to your website and plays a crucial role in how people perceive and remember your brand. It should be concise, relevant to your business, and easy to remember. In this guide, we’ll explore the key factors to consider when selecting a domain name, tips for making it memorable, and tools to help you find the perfect fit. Whether you’re starting a new venture or rebranding an existing one, choosing the right domain name is a pivotal step towards online success.




Other Blogs


WordPress Hosting & Management

Posted on Nov 04, 2024 and updated on Nov 04, 2024

Litespeed performance comparison

Posted in News on Sep 08, 2022 and updated on Sep 07, 2022

OpenAI Just Announced New AI Features: Key Takeaways from DevDay

Posted in News on Oct 02, 2024 and updated on Oct 02, 2024

Qualcomm's Snapdragon 8 Elite: A Game Changer in Mobile Processing

Posted in News on Oct 22, 2024 and updated on Oct 22, 2024

California Governor Vetoes Major AI Safety Bill: What It Means for AI Regulation

Posted in News on Sep 30, 2024 and updated on Sep 30, 2024

Google Search Impact - Congrats on reaching 900 clicks in 28 days!

Posted in News on Mar 05, 2022 and updated on Mar 18, 2022

Cheap Web Hosting in Pakistan: Your Ultimate Guide

Posted in Hosting Promotions on Jun 07, 2024 and updated on Jun 07, 2024

AI-Generated Captions Come to Max via Google

Posted on Sep 25, 2024 and updated on Sep 25, 2024

The Pros and Cons of Using a Free Web Hosting Service

Posted in Uncategorized on Jul 26, 2024 and updated on Jul 26, 2024

The Ultimate Guide to WordPress Hosting 2024

Posted in Uncategorized on Jul 05, 2024 and updated on Jul 05, 2024

Experience Unmatched Performance with LiteSpeed: A Comparison

Posted in News on Jun 07, 2024 and updated on Jun 07, 2024

How to Choose the Best Domain Name for Your Website

Posted in Uncategorized on Jul 09, 2024 and updated on Jul 09, 2024

WordPress Hosting & Management

Posted on Nov 04, 2024

Litespeed performance comparison

Posted in News on Sep 08, 2022

WordPress Hosting & Management

Posted on Nov 04, 2024

Litespeed performance comparison

Posted in News on Sep 08, 2022







Comments

Please sign in to comment!






Subscribe To Our Newsletter

Stay in touch with us to get latest news and discount coupons