Brandable domain names

On Tuesday 23/05/2016 Brandroot a well know Brandable domain marketplace witnessed another hacking attempts and this time it affected majority of their users. It was reported on namepros forum that members received numerous series of emails which exposed some of their personal information.  It has become apparent that Brandroot did experience a serious security breach which shouldn’t be taken lightly. Brandroot representative tried to conceal the situation by making this statement: “Looks like our email system had a bit of breakdown”  in my mind I am like ooh really?

 

In a serious matter a brandable marketplace as Brandroot that charges users 30% commission for any sales and another $10 for listing fees for each domain should strive to protect their users as they are the fundamental structure of the marketplace or in better words users are precious asset any business can have. As of writing this post Brandroot has not publicly announced their security breach but only to a few members on namepros forum

Here was Brandroot response when their were further questioned

Yes, it is very disconcerting. We have had many recent hack attempts, which all have been blocked but it seems some of our code may have been affected in some way. We are doing everything we can to restore accounts and prevent this from happening again. We have also integrated CloudFlair to help prevent future hacks. This problem is obviously something we failed to catch.

We take the security of your information very seriously and have taken every step possible to protect the site, including encrypting every page with HTTPS, utilizing CloudFlare, and implementing very strict form validation. Please be patient with us while we resolve this problem. Again, I’m very sorry that we allowed your data to be compromised. The information was only sent out to existing Brandroot sellers and possibly a few Brandroot seller applicants. My hope is in the integrity of this industry. Please delete any emails that were sent to you by mistake.

Now as a technologist I feel it’s important  I comment on some of the remedies that Brandroot thought were suitable.

Cloudflare: I don’t understand how they are planning to utilise Cloudflare to prevent future attacks, from my understanding Cloudflare are great for super charging the speed of website using caching technologies which involves using  the closest data centre to distribute content. Another fact is Cloudflare are known as the champions for preventing DDos attacks.

HTTPS: Brandroot were already using HTTPS prior the incident. HTTPS are simply protocol for secure communication over a computer network which is widely used on the Internet. You can read more about it here.  Again I don’t understand how this will clean up the compromised system and code.

Implementing very strict form validation: Sounds a bit firmer but the question is what type of validation?  How would you know what to validate and secure if time is not spent to understand how a system was compromised? Another thing worth noting is that Brandroot uses Joomla as their Content Management System. WordPress is the most popular CMS followed by Joomla.

The purpose of this content was to share some lights on why protecting user personal data should be taken seriously whilst operating any business.