Use A GMail Account? Watch Your Domain

After reading numerous accounts (27 and counting) of people's domains being stolen I decided to investigate the situation more closely. What follows is my personal investigation.

Without jumping to any conclusions as to how all of these domains were hijacked, I gathered the facts and sat back to see where the common denominators were.
All of the domains had GMail accounts listed in whois.

Many of the domains were hosted with GoDaddy

Many of them had Alexa rankings of less than 10,000

While the GoDaddy connection was interesting, the fact that all of the hijacked domains had GMail accounts stood out as the real common thread.

It's still not clear how the hijacker was able to obtain access to the GMail accounts it is clear that using a GMail account for your domain registrations may not be a wise decision. We have seen infectious code on websites designed to either steal cookies or check to see if the visitor also has GMail opened in another window.

A few cases involved visiting a webpage while GMail was opened and the webpage doing a POST to a GMail interface and injecting an email filter into the visitor's GMail settings.

Typically the injection would include filters that would automatically skip the inbox and forward emails from register.com, godaddy.com and dreamhost.com to another GMail email account.

Then with forwarding set and knowledge of the registered email address, the hijacker would have use GoDaddy's website to obtain the customer number, which requires a verification email. Armed with that information, the hijacker would go back to GoDaddy and have an Authorization Code for password reset, sent to the registered email address.

The password would be sent to the email address, which would be forwarded to the hijacker and then they could move the domain to another registrar, change the website and benefit from the traffic to that website.

Or in some of these recent cases, the hijacker asked for $2,000 in order to "give" the domain back.

How did this happen?

Creating a filter in your GMail account sends a request to the GMail server farm. The request is an obfuscated URL with each section identifying the filter, the account, etc.

Many of the parameters passed in the URL can be generated accurately but one parameter needs the cookie from the account holder's computer. They can obtain this quite easily with any general cookie stealing technique (there are many).

What can you do?
For starters, this isn't the first exploit of GMail accounts. I would switch all of my domains to be registered to a different email address.

Secondly, I would pay the extra money to have your domain information listed as Private. This way your contact information will not show up on whois searches. GoDaddy offers Protected Registration if you're already listed with them.

Third, if you do use GMail, check your filters often. And check your deleted items as well. You never know what you might find in there.

Anyone here have any stories to share about domains hijacked?