Anonymous Claims GoDaddy Hack, GoDaddy Claims Internal Network Problem

Yesterday morning, I got a message from my son, asking me what I thought of the GoDaddy hack. I was surprised that I didn’t find the news in my normal security or technology outlets. Everything I saw was mainstream media sites — Time, CNN, Fox and the like.

GoDaddy going offline is a big deal since millions of small business owners rely on the site for its inexpensive Web hosting and DNS. (Disclaimer: I’m also a GoDaddy customer). A hack of GoDaddy is a major coup, and to no one’s surprise Anonymous immediately took responsibility for the outage, which CNN reported:

A person affiliated with the hacking collective Anonymous — named @AnonymousOwn3r on Twitter — claimed responsibility for the outage. ‘I’m taking godaddy down bacause (sic) well i’d like to test how the cyber security is safe and for more reasons that i can not talk now.’

Even if Anonymous didn’t step up and take responsibility, it would have been easy to blame the hacker group for the problem. As The Huffington Post pointed out:

GoDaddy has been under fire before for supporting the Stop Online Piracy Act (SOPA), a bill that would have extremely limited internet freedom and introduced unprecedented censorship.

A bill that Anonymous has vehemently opposed. So it is all making sense, right?

But soon after I found the stories about Anonymous hacking GoDaddy, GoDaddy officials put out a statement that said the outage was caused not by a hack but by an internal network problem. This in itself is a cause for concern, as Sam Erdheim, director of network security strategy, AlgoSec, told me in an email:

It is easy to get caught up in the latest attack vector, data breach or cult of the celebrity hacker; however, what often gets overlooked is that poor security management plays an even larger role in terms of ensuring the security of your systems and information. As this GoDaddy outage reveals, misconfigured network devices and improper changes can be just as dangerous to the stability of our networks as the latest attacks. Organizations should take a step back to ensure its processes are in order and its devices are securely configured to avoid these situations in the future.

Good advice. I don’t think this story has ended with this GoDaddy statement. I want to know why Anonymous took responsibility for something it didn’t do. There are too many parts of this story that don’t feel right to me.