Why Did I Get Hacked?

I didn't get hacked, I was just posing that as a hypothetical.

Most of you are familiar with the story behind David Airey's domain/site hijacking. To recap, some enterprising individual hacked his way into David's Gmail account through some exploit and proceeded to transfer away his domain and then hold it hostage. Thanks to the intervention of Bob Parsons, CEO of GoDaddy, David was able to get his domain back from the offending party.

With that groundwork laid, what are you to do to protect your domain? Making sure your little piece of the web is safe is something that most of us take for granted. I know I sure do. Even as I sit here and look at this list of things to do, I am realizing that I am doing a few things that you are NOT supposed to be doing.

James Koole over at the TuCows blog has a list of things that you may want to pay attention to.

1. "Use WHOIS Privacy. It can protect you to a certain extent from this kind of theft. If the administrative email address that is listed with the domain name under WHOIS is exposed, then a potential domain thief has two pieces of information he needs – the domain name, and the email address used to manage it. The thief can then gain control of the email address, and then use that email address to gain control of the domain by having passwords emailed to himself. WHOIS Privacy offers some protection because it prevents the domain thief from finding out what the administrative email address is for the domain name.

2. If you can avoid it, don’t use free, web-based email addresses for your administrative contact. In this case, a security flaw in GMail allowed the hacker to gain control of the email account of the domain holder. Likewise, having your entire domain portfolio under a single administrative email account is another mistake. Never mind having one domain name stolen, if a thief gains control of your email account, he could steal your entire portfolio of names.

3. Your domain name is worth more to you than you might think. It may only cost you $10 a year to register the domain, but take a moment to imagine what the cost would be if you had to change domain names tomorrow. It could be as easy as reprinting business cards, or as difficult as re-branding your entire company.

4. Chose your Registrar wisely. Look for a Registrar with a solid Compliance team and a good record within the industry. They’ll have policy and procedures in place to protect you against domain name theft, and in the event your domain is taken from you fraudulently, you stand a better chance of getting it back with a solid registrar. Our CEO, Elliot Noss, has talked about this in the past. You can read his “Ten questions to ask before you pick your domain name Registrar” post for more information on how to make an informed choice."

I guess I have some work to do after reading this. It really doesn't matter what you do or how secure you think you are, there is always someone that is going to find a way into your stuff. But question is, what makes certain people a target? Traffic? Perceived worth? Did they anger someone? Or is it the thrill of randomly picking someone and hacking them just to see if you can do it? AND exactly how many licks DOES it take to get to the center of a Tootsie Roll brand Tootsie Pop? The world may never know.