WARNING: Google’s GMail security failure leaves my business sabotaged
David Airey | 7:58 am | December 24, 2007 | Domain hijack
What would you do if a criminal stole something very personal, and very valuable from you?
What if they were able to target your business and criple your income?
You wouldn’t be too happy now, would you?
What if you also discovered that this was happening because of a Google security infection that can affect every GMail user on the planet?
That’s what has just happened to me, and here I’m going to tell you my story. I will detail everything I know about the web pirates who are threatening my livelihood, and tell you what you need to know in order to avoid the same thing happening to you.
On November 20th 2007 I left the UK to spend a month’s holiday in India. I’d been planning this break for over a year, and was looking forward to taking my girlfriend away on our first foreign trip together. Prior to leaving, I published a blog post to let my readers know I’d be away for a while, and that my blog would be a quiet place in my absence.
All my clients were informed, bills paid, loose ends tied up, and off I went on a new adventure.
I arrived in Mumbai on November 21st, and on the journey from the airport to the Colaba district, was punched in the face by an Indian youth, but that’s another story.
During the month ahead, I knew I’d be irregularly checking my emails, but only to let my loved ones know everything was fine. This holiday was to be a break from work, and a break from computers.
Indeed everything was fine for a few weeks, until December 15th (five days before I was due to return from holiday). I called into an internet café in Goa, and read some worrying emails from good friends of mine. I was informed that my website had disappeared, and that my domain name (www.davidairey.com) was now redirecting to some random website - bebu.net.
I was confused, and anxious. How could this happen? I hadn’t received any notification of my domain name expiry, and I never divulge any passwords to anyone. The only possible explanation for me was that somehow, the domain name had expired without me receiving any notice, and that some domain poacher had snapped it up before I got a chance to renew.
My website had been pulling in over 2,000 unique daily visits. Not a massive amount by any stretch of the imagination, but for a one-man operation, 700,000+ annual visitors can generate a nice amount of new logo design business.
So I ran a WHOIS check on davidairey.com, hoping to find an email address for the new owner. The search yielded this email address: DAVIDAIREY.COM@domainsbyproxy.com and here’s the email I sent:
Hello,
Please can I purchase my old domain name from you. It seems it expired without my knowledge.
www.davidairey.com
Kind regards,
David
I found it hard to believe that I’d let my domain name expire, but thought it a good idea to send an email nonetheless.
On the very same day, I received a reply. It came from one supposed Peyam Irvani, telling me the following:
Hello,
Please send me your high offer !
Regards
By this stage, I’d already had some back and forth email discussions with close friends, wondering what exactly could have happened. I also contacted my web host company, ICDSoft, asking them to help. They were the ones who sold me the domain name after all. Shouldn’t they have informed me?
This is when I found a disturbing support ticket, posted in my web host support panel. It was supposedly from me, addressed to ICDSoft’s support team, and was created on November 20th, the exact date of my departure from the UK. It read the following:
Subject: Davidairey.com Transfer
Hello,
I want to transfer davidairey.com to another registrar please unlock it and send me the EPP transfer code.
Kind regards,
David
Within just one minute (ICDSoft’s support team are very fast) the following response had been supplied:
Hello,
We unlocked your domain name as requested. Here is its EPP code:
Domain name: davidairey.com
Auth/EPP key: 6835892AE0087D66Best Regards,
Support
I immediately typed a reply to this ticket, asking for help, and wanting to know what I could do to resolve the situation. Here’s what I was told by the support team:
Unfortunately, the domain name has been transferred successfully, and it cannot be reverted. The current registrar may be able to give you more information.
The original ticket message was sent from this IP address: 207.36.162.100
The person who posted it must have had access to your email, too, because transfers have to be approved by the administrative contact in order to be successful.
What? Not only did the hacker gain access to my web host control panel, but they also squirmed their way into my email account? This is when I began to get very worried. I kept a lot of personal emails behind my username and password, and this was a real invasion of privacy. For a few minutes I sat in the net café, my girlfriend beside me, and I didn’t know what to think.
I sent an email to GoDaddy, where my domain had been illegally transferred to, and asked them to prevent any further transfers. I wanted the domain in one place whilst I investigated. Here’s what GoDaddy said:
Unfortunately if a transfer request is made and completed we will not be able to prevent this unless we receive the notice from a court or arbitration forum… I apologize for any inconvenience this may cause.
Okay, so GoDaddy can’t help until the matter is taken to court.
This whole process ran over a few days of my holiday, as GoDaddy took over 48 hours to respond. At this point, and on December 19th (four days after my first email to the web pirate, ‘Peyam’), I thought I’d send a reply, and here’s what I said:
Hello Peyam,
Well, congrats on your hack. I’d love to know how you did it.
Before this moves through the courts, in order to settle the dispute, I don’t suppose you’d be so kind to give me my domain back? It’d really save me a lot of hassle, but if that’s what it takes, so be it.
I saw no point in being aggressive, wishing to keep them ‘on-side’ as much as possible.
Again, that same day, I received a response:
:))
Im sorry to say but its not possible to have it or it take about 1 month if you try hard to have it again :)) and you lose your visitor ….hahaha
You can purchase it for 650 $ And we will use escrow sevices ;) that will done in less than 2 days !
Now my domain name was being held to ransom, and the hacker was taunting me. What I had spent more than a year building into a sound marketing plan had been severed at the knees.
I’m not the type of person who will hand any money over to a criminal, so I didn’t reply, instead focusing on stopping this hacker from stealing any more of my property.
How was I being hacked?
After a little research, I found this exposé into Google’s GMail defficiences: Google GMail E-mail Hijack Technique
It details the exact GMail hijack that I have just found applied to my account (right whilst writing this blog post).
Here’s an excerpt:
The victim visits a page while being logged into GMail. Upon execution, the page performs a multipart/form-data POST to one of the GMail interfaces and injects a filter into the victim’s filter list. In the example above, the attacker writes a filter, which simply looks for emails with attachments and forwards them to an email of their choice. This filter will automatically transfer all emails matching the rule. Keep in mind that future emails will be forwarded as well. The attack will remain present for as long as the victim has the filter within their filter list, even if the initial vulnerability, which was the cause of the injection, is fixed by Google.
And here’s a three step illustration of just how this threat works (click each image for a larger version):
Images courtesy of GNUCITIZEN
I took a look at the ‘Filter’ option in my own GMail settings, and it turns out that you can easily set incoming emails containing specific words to be forwarded automatically. For example, if you want any emails containing the word password to be sent to another address, no problem. It also appears that the Filter can delete the email from your GMail inbox as soon as it has been forwarded, so you’d be none the wiser if a hacker was playing havoc with your incoming mail.
IMPORTANT: If you use GMail, it’s absolutely vital that you check your account settings now.
Here’s what to do:
When logged into GMail, click on the ’settings’ tab in the upper right of the screen. Then check both the ‘Filters’ and the ‘Forwarding and POP’ sections. This is what I only just found in my ‘Filters’ tab:
The following filters are applied to all incoming mail:
Matches: transfer-approval.com
Do this: Forward to ba_marame_pooli@yahoo.com, Skip Inbox, Delete itMatches: from:(transfer-approval.com)
Do this: Forward to ba_marame_pooli@yahoo.com, Skip Inbox, Delete it
I have absolutely no idea who’s email address that is, but it seems to me that some of my personal emails were bypassing my inbox entirely, instead being forwarded to the yahoo.com address.
It appears that the GMail security issue is fixed, but that won’t remove any previously installed Filters from your GMail account.
What do I know about the hacker stealing my property?
I have a GMail address, pay.irv@gmail.com, and what’s possibly some fictitious name, Peyam Irvani.
There’s also the Yahoo email address, ba_marame_pooli@yahoo.com, where my emails were being forwarded to through the malicious Filter.
ICDSoft provided me with the IP address from where the fraudulent support ticket originated (207.36.162.100), and it’s possible to search for it’s physical location using a free online IP address locator. I’d never used one before, but gave it a shot…
According to IP Global Positioning, the IP is in the United States. Fort Lauderdale, Florida, to be more precise, and the Internet Service Provider is known as Cybergate INC (based in Mississippi, USA).
I’m not entirely sure just how much this information can help me, if at all, but I thought it might be useful.
A little unexpectedly, I received a third email from ‘Peyam’ on December 21st, saying:
Helli David,
We can use escrow and you can have your domain name again :)
Only for 250 $ !
Do you want it ?!
Its special christmas offer ! haha
I like to see you have that domain name again :)
I don’t care if it costs $0.02. I won’t give my money to a criminal.
You might be wondering what I did to ressurect my website from oblivion. You’re reading this post after all. Before the theft, I had both davidairey.com and davidairey.co.uk, with the .co.uk permanently redirecting to the .com (I felt it would make more business sense to use the .com as my main address due to its ease of memorability.
I’m now using www.davidairey.co.uk domain as my main address. What does this mean? It means that all my organic search results are reset to zero. Whereas once I was on the first page of search results for logo designer, I’m now nowhere to be found.
It also means that my business cards are now incorrect, and my email addresses too. Quite an expense, but I’d rather fight in the courts than give one penny to the person who did this.
During the site move, I found to my detriment that I was linking to my blog images entirely the wrong way. I had been uploading my picture files to a subdomain (blog.davidairey.com/images) then placing them inside my blog posts from there. This meant that whenever the domain name changed to davidairey.co.uk, so did that subdomain. It now became blog.davidairey.co.uk/images. Therefore, my site was missing every single image I’d ever added.
In order to fix this, I moved all the picture files to a new folder, in the root directory at davidairey.co.uk/images. Now, when I insert an image into a blog post, I don’t use the full URI, but cut the address to it’s bare minimum, like so: img src=”/images/example_filename.jpg”
This means that should I ever re-change my domain name, back to the .com for instance, the images will automatically pull whatever domain name I’m using, without the need for a change.
I’m now also using this technique for internal hyperlinks. Rather than linking to my contact page like so: “http://www.davidairey.co.uk/contact”, I’ll simply use “/contact”.
Much better, and uses less code too.
Where can I get help with domain name disputes?
This is the stage I’m at now, weighing up my options before it comes to paying legal fees. This is also where I’m calling on your valued help. I know that many of you are much more clued up on this than I am, and if you can spare some advice in the comments here I’d be very appreciative.
In my email communications with GoDaddy (the company where my .com domain name is now registered), a representative had this to say:
Should we receive notice of a pending dispute from a court or arbitration forum, we will lock the domain name so it cannot be transferred or have the registrant information modified. Likewise, when we receive a decision from the legal body, we will update the domain name accordingly.
They then directed me to the WIPO (World Intellectual Property Organization, domain.disputes@wipo.int).
So I looked into this organisation’s website, and in particular, the section on domain name dispute resolution resources.
There’s a FAQ section which provides information on a number of items, including the following:
To cut a long story short, it seems I have to pay a minimum of $1500 for the pleasure of initiating a court case. All fees are listed here.
As for how long the process lasts, this information isn’t very obvious on the WIPO website, so at present I’m unsure.
What should I do?
From what I understand, the only option is to proceed with legal action (again, I’m not paying the thief one penny).
- Do you know any different?
- Do I have a good case to proceed with?
- Is there any other information available online about the pirate who is blackmailing me?
If you can provide any of these answers, it would mean a lot.
UPDATE December 28th: You left over 400 comments on my original post (now located on my .com domain). My domain name has been returned, and you can read how it happened in this blog article.
Thank you
Thank you so much to those of you who kindly emailed me at the start of this situation: Vivien, Ben, Tammy, Armen, Dawud, Ed and Jamie. I know that more of you tried, but that I didn’t receive your emails because my accounts no longer existed.
Thank you also, to everyone who is lending their support in the comments of my previous blog post, David Airey.com hacked. Many of you have also published my news on your own blogs, and this really lifts my spirits, showing just how great the people in the blog world are:
Here’s a sampling of your kind help:
- David Airey Hacked
- Links Important Enough To Write About On A Saturday
- Your Help Needed: David Airey.com hacked
- If you link to David Airey please read this
- What Happened To David Airey?
- Where-oh-wherey is David Airey?
- David Airey - Designer, Blogger, Information Sharer
- davidairey.com hacked and hijacked!
- Fellow Blogger David Airey Gets Hacked
- Hackers
- David Airey’s Domain Hacked!
- David Airey is Back (but has a new domain)
- David Airey’s Graphic Design Site Has Been Hacked
- Great graphic design stuff and theiving bastards
- Warning: Your Blog Could Be Hacked
- David Airey Hacked?
- davidairey.co.uk
- Don’t tell someone about vacation
- Pedere un dominio troppo facile
It truly is fantastic that you’d go to this effort, and if there’s anything I can do in return, do let me know.
My other blogs
I author two more weblogs, both graphic design related, and you can view them by clicking on the banners below.
My other weblogs
74 Comments »
Comment by Markus Diersbock | December 28, 2007 | 10:04 am
You should have just paid the $650 to get it back.
I know crime shouldn’t pay, but $650 is nothing and the main
thing is to get your business back online, and chock up the
bad experience.
Comment by Ron Enderland | December 28, 2007 | 12:46 pm
Stick to your guns. I’m pulling for you. The slimy bastard who did this probably supports alkida too (deliberately misspelled)
Comment by Joshua Gonzalez | December 28, 2007 | 1:20 pm
It is sad that this may happen to someone, but this is reality. I would not want to send the person money, but if I did do this I can probably have a lead on the cyber-thug. This is information may become useful for legalities and finding the culprit.
I would logon to the FBI site and and fill out a complaint with them also since the servers originate in the US.
~Hope this works out for you. Happy New Year!!!
Joshua G.
Comment by Gary Lambert | December 28, 2007 | 4:07 pm
As the battle of web good vs. evil goes on, each side becomes more sophisticated. It will become necessary to create web communities with specialty knowledge and resources to wage battle on the side of good. Since there are only a few bad apples, the side of good can take a major step forward in this way. It is just too costly and time-consuming for an individual to do battle alone.
Comment by alank | December 28, 2007 | 4:15 pm
I’m thinking the date the attack took place is a significant piece of information. It was precisely the date you would leave your web site unattended for a period of one month. You reported that you’d contacted a number of people about your plans. My guess is that within that circle you might find the culprit, — or abetter, at the very least.
It’s not easy to pinpoint physical locations attackers. The physical location in Iran may just be the location of a zombie server.
It’s a strange tale, to be sure.
Comment by Richard Miller | December 28, 2007 | 5:00 pm
I go into a rage when I read about viruses, and web stealing, and cannot think rationally. These warped computer weenies who do this are vermin, and what they do is akin to rape. They have no life better than to hurt honest people.
I would pay a tax/insurance to a non-government entity to insure and prosecute this vermin. With the emphasis on prosecute. The lowest penalty would be in kind, to create a way that the criminal cannot get on a computer for at least 20 years. That should isolate their brilliance, and warped minds. It is impossible for a working or non-working person to pay the kinds of legal fees needed to clean up this mess. The vermin should be squashed financially and intellectually (IT).
Google has far more problems than just security, and they are degrading daily. While their geniuses are “enhancing” the mail, they are making it less user friendly, and responsive. Every time they add a goody, they seem to degrade two benefits that worked well.
A rant from a computer challenged user. I must go check my google settings. Thanks for taking the time to publish this information. It needs higher visibility.
Comment by alank | December 28, 2007 | 5:02 pm
P.S., One other thing worth noting is that domain name registrars are highly automated. The transfer process is totally automated. No human intervention is involved. It’s not a happy arrangement for those who expect certain authentication of a request.
Comment by Jasper | December 28, 2007 | 7:51 pm
I’d never give money to a crook, I rather spend the 650 on a trip to the home town of the thief and show him some fist in his face.
It’s really a lousy thing the thief did, and I feel sorry for you. Good luck with this, and have a great 2008 after all!
Comment by Allan W. | December 29, 2007 | 2:36 am
I might have paid the ransom… then hired a PI to hunt the mofo down.
Comment by Mouse | December 29, 2007 | 8:13 am
if only there was something like www.419eater.com for this
Comment by kazounet | December 29, 2007 | 9:06 am
This would never have happened to Chuck Norris.
Hope you’ll get back your domain name soon.
Comment by Michael Czajka | December 29, 2007 | 7:55 pm
Hi,
You’ve just hit on one reason why you should use a redirection service for your e-mail and not depend on an e-mail linked to your web site. Both Aliencamel and PO Box are good e-mail redirection services which protect you from ever losing your e-mail.
You can direct your e-mail to two different places to avoid ever losing ANY e-mail ie. one local (on your home computer) and one to gmail. Splitting of e-mail like this is permitted by most services.
This strategy solves your e-mail problem.
:-)
Comment by Michael Czajka | December 29, 2007 | 8:32 pm
The registrar of your domain name should be able to identify who paid for what and confirm that with the hosting company. The hosting company should then be able to confirm that the account has been hijacked by contacting the person who registered the account and verifying the details on file with the registrar (which the hijacker won’t have).
If they are not willing to change the address over the registrar should be able to return your URL to you once they have gathered enough info to assure themselves you are who you claim to be. This should be at no cost.
It’s my understanding that the legal process people are advising you to engage in is for cybersquatting (registering a name and then selling it to the business at a profit eg. KFC)… rather than out and out theft.
As this is a criminal offence you can also get the authorities involved… this costs nothing and will result in the hijacker being charged with a criminal offence. Once the police get involved the hosting company should return your URL… as they will probably also be asked to provide the details of the guy who they are dealing with.
There is no guarantee that paying the thief a fee will result in the return of your URL… although a escrow service is meant to assure this. However there are a number of bogus escrow services… and the thief may now be trying to get your credit card details… so if you do pay… make sure it’s only to an escrow site you know or is well known. You can also notify the escrow site that the account is being used to extort money and they may co-operate with you to pretend to pay the thief.
Forwarding the correspondence to the new hosting company will allow them to follow the dispute. Publicising it as you have will allow other people to help.
You are now engaged in a paper war… if you do the hard work you should get your URL back.
Don’t take the hosting companies word for anything… they won’t know the law in this area well and will mislead you. The various licensing agencies likewise often know the laws poorly. A solicitor specialising in either IT or contract law is much more likely to give you good advice… but may not be necessary if you’re willing to do a bit of hard yakka yourself: it usually takes just as long for you to do it as for you to hire someone else to do it… plus you usually get it done faster. You will feel better about all this if you do it all yourself… as lawyers charge like wounded bulls… and many of them know nothing about IT (you’ll be paying them to learn about it).
An invalid transfer of a URL is both a matter for criminal law (theft) and contract law (civil matter): the transfer of a contract is invalidated if no consideration has passed, if there was no intention to contract, etc… If you establish these things… then they have to give you your URL back… and no special forums or court proceedings should be required.
If the hosting company does not co-operate they can become liable for damages (loss of earnings) which makes it in their best interests to help you.
It is also remotely possible that the hosting company is colluding with the thief… in which case you can also have them charged.
Contacting as many law enforcement agencies as possible over this is a cheap and simple way to put a lot of pressure on the hosting company over what is for them a minor transaction that is now creating a lot of headaches (not worth it).
Of course identifying the location of the thief as precisely as possible is necessary to get things happening as fast as possible.
Get the hosting company to do a few other checks eg. If they were paid by the thief get them to check it was not a stolen credit card. If it was they won’t have been paid… and they won’t want to host the account. If the thief paid using his own money then you’ll know who the police need to ask to get details of the thief… and the thief has just put himself in the firing line.
To get more details about the thief you could ask how he wants to be paid and then contact the escrow site and ask them to help.
Hope that’s been useful?
:-)
Michael
B Bus Acc (major in contract law)
Grad Dip Bus Comp
Comment by Dan Spring | December 30, 2007 | 4:40 pm
I’m so sorry to read about this, David. I wish you all the luck with rebuilding your search marketing and getting your .com back.
I can’t help feel the hosting company could of/should of done more. I mean they emailed this guy/girl back in one minute…?
Good luck, mate!
Comment by Richard | December 30, 2007 | 10:38 pm
What happened to Peyam Irvani in the end? Did you get him?
Comment by Bando | January 1, 2008 | 1:15 pm
One more reason folks should never use IE.
Use Firefox with NoScript and this hack never would have been possible.
Best of luck to you. Live and Learn.
Comment by jesie | January 2, 2008 | 8:21 am
When my Gmail account was temporarily disabled I thought it was bad enough. When I read your blog was hijacked, I know it is a big blow. Good thing that all worked out for good. You got your domain back and more visitors are flooding to visit you.
Comment by mark | January 2, 2008 | 1:29 pm
I would have hired a private investigator (PI) specializing in Internet crime. Get your civil or criminal law attorney to recommend an investigator for this. At that point, I would pay the $250 to get your domain back through your credit card account. Then let your credit card company and your PI follow the money trail, which can be used in civil (or criminal) court. In effect, you’re setting up a sting operation.
Since malice is involved, you can seek punitive damages, but even so, I would agree this is going to cost you more than you recover from the cyber crook because the crook isn’t worth that much. But at least you have the satisfaction of catching and prosecuting him yourself.
Comment by Naveen | January 3, 2008 | 7:53 am
Hey David,
Congrats on getting your domain back and kudos for the determination you showed in not giving that bugger a penny. I’m sure not many people would be willing to take the risk. However, I found your story more interesting because a ditto - i mean 100% similar - to the R - incident happened with 2 very close friends of mine in the month of October, where the modus operandi of the hacker was the same. Using Gmail filters to hijack mails and then steal their domains. Worse, both their sites were in Alexa top 10000 and 15000 respectively, earning a hell lot of money, and they were asked to pay $2000 each to get back their domains. A whois of their domains showed that the guy was based in Iran, and they even negotiated him over telephone which was in Iran! Eventually they had to cough up the money via paypal, since a) The site was their only source of income , b) There could be no legal remedies with they being here in India, the cracker in Iran, and the domains hosted in the USA, and c) they couldn’t afford to lose on the SEO part which they had built over the years.
However, during my little investigation to help them track how it was done, I found out that the same Gmail filter hack was used by the cracker, but the same had been detected by Google within a week of the incident and Gmail was reportedly FIXED to prevent such attacks. I can’t find the link where I read those, now, but I can post later. So I’m a bit curious as to when did the cracker actually injected the filters in your Gmail account. My bet would be before the hole was fixed, and all this while (around 2-3 months), he was just monitoring the activities in your email account.
Anyways, yours was an exceptional case, leaving me wondering how many victims can afford to have common friends with Bob Parsons!!
Cheers!
Naveen
Comment by Kate Andrews | January 3, 2008 | 7:54 am
Having had my Gmail hacked this past week/month (who knows)… this was a really interesting read David - your story is a concerning one. I am glad you managed to sort his problems out, but without such technical knowledge I am not sure if I would have so much success, very concerning.
Comment by Naveen | January 3, 2008 | 7:56 am
BTW, how did ya like our country, India, apart from the sorry episode which you had to witness while you were here. Its a shame that this cut down your fun out here.
Comment by David Airey | January 3, 2008 | 8:02 am
Without your support, and the publicity my case generated, I’m sure things would have been a lot slower getting resolved.
Sorry I’m not currently able to respond to you all individually, as time isn’t on my side at present, but I want you to know that I had a fantastic time in India, and the theft of my domain didn’t spoil what was a great trip.
I hope you all have a fantastic 2008!
Comment by Matthew | January 3, 2008 | 9:43 am
Word of advice: Don’t use a free, web-based email service for very sensitive information. Thinking that they will always be secure is the first mistake.
Comment by Jimmy Smutek | January 3, 2008 | 3:23 pm
Hi, first of all I wanted to say I am really sorry about what has happened to you.
While reading through your story I thought of this company that sells recovery software for stolen macbooks/macbook pro’s. Basically, as soon as the thief puts the machine on line the machine begins transmitting it’s location back to the monitor company. The monitoring company then contacts law enforcement and ISP to recover the stolen computer and arrest the thief.
Read more about it here: http://www.orbicule.com/undercover/
Short excerpt:
“Undercover transmits network information of the stolen Mac. This information includes both internal and external IP addresses and the router address, enabling our recovery center to accurately trace the Mac’s physical location, in collaboration with the ISP and the police.”
My thoughts are, if this company, orbicule, is able to work with law enforcement and isp’s to pin down the physical location of a thief based on network transmissions then it seems logical, and realistic that you would be able to do the same, provided you have the IP address used by the hacker to email you, and provided you had people in the appropriate positions actually willing to help you.
Hope that makes sense - I thought it atleast worth mentioning.
Best wishes for a good outcome.
Comment by Jimmy Smutek | January 3, 2008 | 3:26 pm
ps. — just wanted to add that you are already a step ahead because you said you do have the IP. Also, if this is something you are going to pursue then you may want to consider not publishing my comments, you wouldn’t want to spook your thief if there is a realistic chance of catching him.
Most likely he/she is following your blog.
Again, best wishes
Comment by David Airey | January 3, 2008 | 3:31 pm
Many thanks for taking the time to comment.
If you read to the end of my article, you’d notice an update published at the end of December. Thankfully, and with help from many different sources, I have my domain name back. Great news.
Comment by Tudy | January 3, 2008 | 7:02 pm
Did you ever consider that this could have been way more simple than this? Seeing that you were away, you’re saying you went to internet cafes to check your emails and such… The first thing one should know about internet cafes is that there might be keyloggers installed on the machines (I actually know of a few).
Keeping note of the fact that all this happened while you were away, and checking your email from public locations, keyloggers might be a faster way to gain access into your gmail account.
Just a thought. :)
Comment by Jen Montgomery | January 4, 2008 | 2:25 am
What a nightmare! Thank you for sharing all phases of this dilemma. That sucks.
Comment by David Airey | January 4, 2008 | 3:13 am
My article above reads the following:
Jen,
You’re very welcome. All’s well that ends well.
Comment by Jakub 'Kurak Slaby | January 4, 2008 | 3:47 am
I’ve read the story and I’m shocked. I thought all the time that stuff like stealing domain’s should be easy to solve out and even if you have all needed evidence of that guy stealing your domain and willing to sell it back, and still you can’t get it bak than something is really rong with the system of the domain service.
First, I think that google should help you (cause you’ve had a mailbox on their service and you’ve trusted them), did you try to send an mail to them?
Second thing is that I really like your way of dealing with this. Don’t give that bastard even a broken peny, he diserves to go to jail!
I hope you win that case!
Comment by suber | January 4, 2008 | 7:05 am
thats an other example of “never save important and personal data by a big global-company”!!!
use gmail for fun… for all serious stuff, run your own privat email-account!
BIG BROTHER GOOGLE IS WATCHING YOU
Comment by naveen_dalal | January 6, 2008 | 3:16 am
Hi david ,
i felt sorry to read all this and like to wish u a good luck for ur fight against these web pirates .
but i do think that instead of going to court u should settel the issue by just paying $ 250 to that criminal and be cautious for the future .
Comment by Bruce Patterson | January 6, 2008 | 10:58 am
Dear sir:
Having just complained to the Federal Trade Commission about Best Buy advertising cheap laptops just to get people in thier store to purchase more sxpensive ones, I was informed of the following. It seems that the FTC does not investigate single complaints but will investigate when a trend of complaints happen. If you have a large group of followers they could all lauch thier own complaints, could maybe get an investigation started. This would be completely free of charge and the FTC has teeth if they are invoked. I would join in if you were to initiate such action. I am sure many others would too. I also happen to know that the FBI is swamped with cybercrime cases and that they are years behind.
Sorry to hear about your story. Good people should band together for the sake of justice. Good luck to you sir.
Comment by Jared Stenzel | January 7, 2008 | 12:08 am
Hey man I know it sucks to have it hacked, but really are you that desperate to avoid paying somebody for the domain? You could be risking $1500+ on this and end up with nothing to show for it. I’m no wizard, but what if he was using a proxy? You don’t even know if you could find the guy if you wanted too. I would say offer him $100 I mean really? What else is there to do? Anyways good luck, I gave you a thumbs up on stumbleupon to help your case.
Comment by smugmacuser | January 7, 2008 | 8:30 am
Looks like the problem was the “backdoor” and not so much gmail. This is awful, but it goes to show that using Windows is unsafe at any speed.
–
Smug Mac User
Comment by Eric S. | January 7, 2008 | 9:06 am
Wow glad your problems got sorted out. This flaw of Google email will hopefully get sorted out soon, but it shows how vulnerable are the simple users like us.
The arrogance of the cracker is unbelievable, taunting you and showing off his attacks. These kinds of people should be punished severely, whatever country they are from.
Comment by leo | January 9, 2008 | 2:04 am
What about asking Google. If they assumed the issue, maybe they would pay $1500 to recover your domain. =D
(pro: you have nothing to loose but time)
Comment by Brandon | January 9, 2008 | 3:38 pm
My account was hacked about a year ago, but it was done with another exploit. The hacker got into my account, but didn’t know my password, so he asked my buddies on gmail chat.
The next day he sent me an email (then changed my password)
“me: tell to your buddy to make a list with stuff that can offer me…and email it:D”
very funny…. gmail recovered my account AFTER 2 WEEKS ON INACTIVITY! The guy kept logging on, so I had to wait almost a month to use gmail again,
Comment by Felix | January 11, 2008 | 11:05 am
http://ghh.sourceforge.net/userfaq.php
for future use.. just so you dont get caught again… ;]
hope it helps
Comment by Blends | January 12, 2008 | 8:10 pm
This scared.. How they hack it? I think they sent virus to you track all your user and password. Don’t ever click something you don’t know on email.
Comment by Siraj | January 13, 2008 | 6:22 am
I had my three accounts blocked when I went for 10 days vacation. I wrote so many mails and even called Yahoo for help. They says ” you need to give your secret question and asnwers” which I dont had coz of the simple reason I dont remember what secret question and answere was given 10 years back. I wonder things which suppose to make our life easier some time will make so complicated and gives so much stress.
Comment by Andres | January 13, 2008 | 4:27 pm
This is the main reason you should NOT use only one email address. It is very important to diversify you Internet presence in many domains and emails so if hackers break into one account or several, they don’t get all the picture.
This is how I manage my email without receiving any single spam.
SafeComputer.org/email-solution
I hate spam so much that I developed this system through the years with success.
Comment by hack hater | January 17, 2008 | 2:13 am
hackers are amongst the most cowardly people in the world as they hide behind their screens and are afraid to confront their victims.
Comment by Daniel | January 18, 2008 | 8:29 pm
Hi David..
I’m a gmail user. I have more than 1 account there. After read your story, I think I must be careful and always check the setting.
Thank you for sharing..
Good Luck :)
Comment by David | January 20, 2008 | 12:20 am
Wow, man, this really sucks. You were right to not give him any money. I would have done it then sued him for as many things as you could get away with (no one should be allowed to get away with destroying peoples’ work, and the only way to change them is for them to feel the pain, right?)
Comment by priscilla grim | January 22, 2008 | 1:31 pm
I am astonished– my case isn’t as bad as yours– but I got hacked two days ago and I am biting my fingertips waiting for google to finally respond to my emails and recover my account– this is the last free account I will ever use, from now on if this every happens again I want to be able to call someone to shut down the service immediately. I feel like such a fool to think that google would protect the users of their monstrous resources.
argh.
Comment by NRG Lab | January 23, 2008 | 11:39 pm
I once faced a similar dispute, and was told to contact my local police office (California). Supposedly, they would set everything straight (but it wasn’t necessary for me to take such actions).
I’m happy with http://www.hz-ug.com now as is - and if this were to ever happen to me, I would go to the police first thing. It looks like you got your domain back anyway…and you’re on the first page of Google’s logo designer again.
Comment by pj villarta | January 24, 2008 | 11:07 am
hi. thank you for sharing your experience. makes one a little more cautious. sorry that you had to go through all the trouble. i’m glad that you managed to get it back.
Comment by Patricia | January 24, 2008 | 6:49 pm
Hi, my e mail accoun was hacked/hijacked on 21st. Locked out of my account and can’t get any satisfaction from goole. Everyone in my address book got begging letters from ME!! Saying I was stranded in Nigeria and needed money to get home. I am NOT computer saavy, just a mid 50’s housewife and Have no idea what to do next. Glad You got sorted Davy. You are wonderful to do what you did!
Patricia in Ireland.
Comment by afreakinninja | January 30, 2008 | 12:56 pm
naveen_dalal = the guy who stole it.
Comment by joey | January 30, 2008 | 2:31 pm
you should’ve paid intitial amount just so that you could find out his bank info and address…. apply your own leverage thereafter.
Comment by Jc | January 31, 2008 | 9:11 pm
This is what happens when “the internets” get filled up with idiots with no true “puter” skillz.
Sh*t Happens. The point is be prepared. That being said, I feel bad for your situations, but it really is your fault.
Using gmail? Lets go for security instead of cost next time.
Using one email address for both your business and personal choices? Lets think organization.
Finally, mixing business time and personal time(which you did by using the same email address for both) major no no.
Finally, don’t you use firefox? Check your plugins and version, it most likely would’ve protected you from this. Adblock Plus, for example, would’ve most likely helped in this situation.
You have my empathy, but no sympathy. But, oh well, add it to stumbleupon and your numbers will do just fine.
Oh, and BTW, you just won the International Lottery of Istanbul, please forward $4,589.54 to me via Western Union to cover taxes and I’ll give you 1.5 Million US Dollars(Sorry, but the same guy that does that, is probably doing this domain name thing. Can we say Nigeria?)
Comment by mobspice | February 7, 2008 | 11:04 pm
Its very unfortunate incident. its the time to revamp our web and mail security. hope that google can take a step further, because it will affect their millions of valid customers.
Comment by Sathees Navaratnam | February 8, 2008 | 2:19 am
What was the Google’s comment? As usual they can’t be held responsible?
I think it is a case for Google. They have the resources to conquer that evil guy.
Sathees Navaratnam
Comment by John | February 10, 2008 | 10:23 pm
If your located in the U.K. and he is in the U.S. you should have filed an international complaint with the C.I.A. It wouldn’t be a top priority for them but they would be able to find the guy in seconds with with their technology.
Comment by sanjuro | February 11, 2008 | 3:43 pm
You did damn well not to pay, bravo ! This is quite a terrible incident, but in a way, you’ve been very lucky. Thanks to your resourcefulness and because your blog seemingly gets a steady number of visitors, you received media attention and the help of well-acquainted people. Without that, maybe the outcome wouldn’t have been so smooth, maybe someone like Bob Parsons wouldn’t have come to your help. That must be a lot worse when you’re inexperienced, when you have no one to turn to, no tech-savvy friends or helpful readers.
Comment by another gmail user | February 12, 2008 | 1:18 pm
Another of the gmail users that thought Google to be a responsible company. but alas I was wrong. Your story is truly heart wrenching. But in your blog you forget to mention the ultimate result. Were they able to catch the culprits?
Comment by Ni9htRider | February 22, 2008 | 4:06 pm
You’re very lucky. If that happened to nrglab I would be very sad lol. You got your domain back (the lucky part).
Comment by T. Barriere | February 28, 2008 | 5:58 pm
Wow. I just read your blog about having your website hijacked. What a terrible mess that guy created. I know it ran you a lot more money to get your site back than it would have if you paid the guy, but in the end it was the right thing. Congrats to you for both getting it back and fighting against that cretin. The one thing this blog entry did not say was what kind of punishment the guy received…
Comment by Reza Ghatok | March 4, 2008 | 9:19 am
My gmail password is permanently remember in this computer.But I should ignore it.Only when I sign in then i should provide my password.What should I do now?
Comment by sher@mail2sky.com | March 7, 2008 | 10:36 pm
I just want to say that although you got your domain back, you should look into questioning the people who have left comments along the lines of advising you that you should have paid the scammer. To me that would have been the most ridiculous thing you could have done, and I’m so glad you didn’t, but have you noticed that the person that hacked your domain had a foreign name and the people who’s advise was that you should have paid him also have foreign names…..Mmmm I wonder!
Comment by Karen | March 13, 2008 | 7:49 am
Hi David,
I have just found that my Adsense account and all associated accounts have been hijacked. The email address that is the primary address I do not recognize and I cannot change it. I have a very small adsense balance. I do not know how to rectify this situation. I was wondering whether I should close the accounts, but apparently if I close the adsense account, I cannot re-open it again. I am green about the internet - I googled for help and found this page. How do I contact Google and why can’t I change the default email address?? I am sorry, but I recognize that you have problems of your own, but you have done all the research, so you may possibly have the answers.
Best of Luck in resolving your website issues.
Karen
Comment by David Airey | March 13, 2008 | 8:44 am
Karen,
Sorry to learn of your AdSense account issue.
I’m not familiar with changing the default address, and can’t advise on contacting Google either. It took a couple of months before one of Google’s employees responded to me.
I hope you get it sorted out ASAP.
Comment by Sejanus | March 19, 2008 | 7:24 am
My workmate gave me a link to this blog in response to my offer to use GoogleDoc’s as a kind of a temprorary CVS for a not-so-valuable files while we get a proper one. Well, what can I say. I’m glad you got your domain back. I hope Google covered at least some of your loss, didn’t it?
Comment by Kelly Taylor | March 21, 2008 | 8:49 pm
My Google mail secret code needs to be changed. Can you please help me?
Comment by cosmin | March 23, 2008 | 9:57 am
My gmail don’t send email with attach file: Oops… the system was unable to perform your operation (error code 613).
Please try again in a few seconds. Help please
Comment by Chris | March 26, 2008 | 8:23 am
Don’t know if anyone has hit on this.. One thing I remember from back several years is that it is possible to take back whats yours in court. I say this because I remember a time when the same thing Happened to Yahoo.com (yes, yahoo before they were as big as they are now). As well as a few other big sites.. someone hijacked the domain ransoming it off for several hundred thousand dollars. It lasted for about a day and a half, where they URL for yahoo redirected somewhere else. But they and others have gotten theres back, unfortunately it definitely falls in the category of the more money you have the faster the process, but as long as you can provide prove that this was a legitimate domain, and source of income etc.. you have a standing chance be it a registered business or not (better if it was cause then this criminal falls into copyright and trademark issues and all else.) Unfortunately what you lost visitor wise will be lost, you can get back up though. One other thing I feel worth mentioning is, look into the legitimacy of the information in the whois on godaddy. If you can find it to be 100% positively false. Then godaddy will have no choice but to release the domain within x ammount of time, as it is a Violation of there TOS, as Well as a big Violation of ICANN Regulations both state you must have an real world information linked to your domains, otherwise they resever the right to cancel the domain. That also said, Its 80$ US, but it may be worth it to you to set up an account with godaddy and get yourself a domain monitor and backorder to watch your .com so if it does release for any reason youll most likely snag it quick. I know I kind of went a few diffrent directions at once here in this comment but if you wanna talk more about it email me, be happy to talk
Comment by txq | March 29, 2008 | 3:41 pm
Hi all.
It is a very unfortunate tale. Glad to read it though, it’s wise to post the details here so that black hats will not get the upper step on these matters.
Identity theft is pretty serious fact. But the penalties might not do much harm, though. Sending a teen to 20 years in jail or something like that doesn’t probably consern the real masterminds behind hijacks like this. They are probably using soldiers of fortune, like teens in need of money etc. The real crackers behind these kind of things are currently probably next to impossible to track. They could be anywhere, the digital world is tricky.
txq
Comment by harmonius | April 2, 2008 | 5:31 pm
GMail is still Beta. So I don’t recommend to use GMail until release.
Comment by Mike | April 11, 2008 | 1:27 am
It seems to me that we can stop commenting because I just went to davidairey.com, and he has his website back.
Comment by David Airey | April 11, 2008 | 2:21 am
Mike points out that my domain name has been returned, which is also mentioned in my blog article as an update, entered on 28 December 2007.
Comment by Ray of Hope | April 18, 2008 | 6:10 pm
Well, thank you for this …… I was trying to figure out something that happened to someone and here it is in black and white ….. now I can do a further investigation into more of what happened.
Also, you may want to watch something else that is done illegally …. disgruntled employess of companies …. changing your mailing info just before renewals of your domains etc …. everyone keep on your toes about your renewal dates etc …… just when you least expect …… your name …. email etc can be changed just during the transfer time ….. and poof your website is gone … then it is changed back looking like you yourself did it ?
Hope that makes sense to everyone
Hope to talk to you Dave in the future …. all the best
Comment by Ray of Hope | April 18, 2008 | 6:21 pm
One last comment ….. another thing that is going on ……. people getting your biz accounts in gmail, yahoo, or any free site and sending out emails to your clients ….. watch out for this as we had this happen last year
The person opened a gmail with our biz name and because more and more biz people are using gmail as an extention of thier business’ … no one is wiser
and then there goes your biz traffic
see your ratings drop …. recently check to see if your company name is gone in the free world of emails …….. I wish gmail and others would verify and not just give out instant emails to just anyone ….. nothing is more messy than spam to potential clients
Hope this was a ray of hope for all
Comment by camu | April 26, 2008 | 9:28 pm
Hello there, I’m so sorry for what happened. In order to spread the word, I’m translating this article in Italian, and republishing it on my blog. Here you can find the “second episode” (it’s too long to fit into my blog eh eh)
http://www.duechiacchiere.it/810
Comments RSS.
Leave a comment