GoDaddy Pledges Improved Cybersecurity in US FTC Settlement

Internet registrar and web host GoDaddy agreed to two decades worth of third-party assessments over its cybersecurity practices in a Wednesday settlement with the U.S. Federal Trade Commission.

See Also: Cyber Insurance Assessment Readiness Checklist

The Arizona company hosts approximately five million websites – sites repeatedly at risk of compromise over the course of yearslong hacking campaign the FTC attributes to lackadaisical security practices. Among the things that GoDaddy didn’t do per the agency: log security events, implement multi-factor authentication, consistently apply patches or have an accurate inventory of its computing assets. At one point, it had 30,000 servers past their support date still hosting websites. Although that number has gone down since its peak in fall 2019, GoDaddy continues to rely on end-of-life servers, the agency said.

The publicly-traded company in February 2023 attributed a run of hacking incidents – the FTC says began in 2019 and ran through 2022 – to a “sophisticated threat actor group.” The hackers’ apparent goal was to “to infect websites and servers with malware for phishing campaigns, malware distribution and other malicious activities,” the company said (see: GoDaddy Fingers Hacking Campaign for 3-Year Run of Breaches).

In an emailed statement, a company spokesperson said the settlement should have a “minimal financial impact” and that GoDaddy has “already implemented a number of the requirements mentioned in the settlement agreement.” The settlement, as is typical of consent orders, does not require GoDaddy to acknowledge fault. The company ended its third quarter with $3.4 billion in revenue over previous nine months, a 7.2% increase from the same period in 2023.

The FTC administrative complaint details hacker compromises of the company’s hosted WordPress environment and cPanel service.

In November 2021, a spike in customer complaints alerted GoDaddy that a threat actor accessed a company-coded API, enabling customer service staff to retrieve information on customers such as private encryption keys and credentials, including the logon info for websites’ backend database and file transfer protocol instances used to upload files to the hosting environment. Hackers used previously compromised credentials to query the API for 1.2 million customer accounts, the FTC said. The apparent goal of that incident was to upload web shells on compromised websites for the purpose of click fraud to artificially boost the search engine rankings of third-party sites.

An outside security firm in April 2020 separately discovered that hackers had penetrated the hosting environment six months earlier, leaving behind malicious versions of cPanel files to record the login information of customers. Hackers were able to compromise the secure shell protocol credentials of roughly 28,000 customers and 199 employees. GoDaddy didn’t enforce multi-factor authentication for accessing SSH shells, so the attackers were able to make administrative changes to the hosting environment.

As detailed in the complaint, once GoDaddy started to eradicate the malicious cPanel files, hackers switched tactics to plant files that scanned server traffic for payment card data, ultimately capturing approximately a thousand card numbers.

Apparently, the same threat actor in December 2022 returned to the GoDaddy hosting environment after discovering that the company hadn’t fully eradicated its malicious cPanel files. Hackers used newly stolen SSH credentials to redirect traffic to some customer websites to pornography or scare sites asserting copyright infringement.

Hackers initially gained access to the hosting environment in October 2019 likely by taking advantage of a vulnerability left unpatched by a customer. The threat actor was able to pivot to the corporate hosting environment through a server that connected the customer and GoDaddy domains. The company maintained 254 such servers, and a third of them contained known security vulnerabilities, showed a later investigation. GoDaddy hired an outside security firm following a possibly related March 2020 incident in which the GoDaddy front page crashed.

The consent agreement is subject to a final round of voting by FTC commissioners, who voted unanimously to accept it. The next round of voting is set to occur after a 30-day public comment period.