I'm not a computer security expert, but it's been part of my work for many years, in different forms. A very long time ago, a friend hired me to write up a primer for internet security, and ever since then it's been a theme that's sat in the background and pops up every now and then.
But lately, it's started to feel like more than a theme, and but indeed a passion. You may consider computer and internet security to be a dry subject, or maybe you imagine feelings of smugness or righteousness, but "passion" is the right word for what I'm feeling. Here's google's definition:
- Passion:
- 1. a strong and barely controllable emotion.
- 2. the suffering and death of Jesus.
Okay, let's just go with number 1. for now.
If you followed my link above to other posts about security, you'll notice one from eight years ago where I mused on the possibility of the discovery of a flaw in how https works. Weirdly enough, a flaw in https was discovered shortly afterwards, though not the one I was musing about. But that's not what I'm feeling passionate about. It's not smugness.
My passion this week was triggered by reading this: GoDaddy Breached - Plaintext Passwords - 1.2M Affected
And perhaps it never went away after I posted this angry screed about Pegasus spyware.
And I think my feelings are getting amplified by the approach of Christmas and the consequent increase in fraud attempts, I'm getting multiple automated and in-person phone call fraud attempts every day it seems. And that ties in nicely to the second definition of passion above.
So allow me to point out that the GoDaddy breach linked above is exactly what I was talking about in my long and rambling post about "managed services". Specifically, GoDaddy claims they are providing a "managed Wordpress service", but instead of doing it in a secure way, they compromised a key security principle ("don't store passwords as plaintext") for the purposes of "useability" (so that wordpress site managers could see a copy of their password if they forgot it). Or rather, they did it to reduce their customer service costs. And now there are 1.2 million sites that are potentially useable for nefarious purposes (malware hosting, blackmail, cryptomining, spam, etc.).
But wait, it's worse. The data breach went unnoticed for two months. That means, whoever got a hold of those passwords had two months to use as many of those sites as it wanted for those nefarious purposes. And if they were smart (in an evil kind of way), they probably installed some software "backdoors" on those sites, so that even now that the breach has been discovered, changing those passwords will not prevent the nefarious use. The only way to be certain to stop such abuse would be to reset those sites to scratch and rebuild them. And guess how many of those sites are going to want to do that, in the month before Christmas?
Oh yes, and GoDaddy described the security event as a "vulnerability", which suggests that there is a potential for a hack, but that it is not certain to have been actually used. Which is about as bald-faced a corporate lie as you can get.
Wait, and it's worse because GoDaddy bought up a bunch of other hosts that are using their system, so even if you're not using GoDaddy, you might be affected.
And that makes me really angry at GoDaddy and anyone who doesn't think large Internet near-monopolies are a dangerous thing. Which is still about most of the world. Tie in to definition number 2!