IT.COM

alert Epik Had A Major Breach

Spaceship Spaceship
Watch

Silentptnr

Domains88.comTop Member
Impact
47,110
Last edited:
33
•••
The views expressed on this page by users and staff are their own, not those of NamePros.
Mistakes were made ... humans make mistakes,,, Mistakes can be corrected ... the mistakes are being corrected ... Epik will be much better for it in the end ...

Okay, you are making a number of general statements without any support by facts. How are mistakes being corrected? Where are you getting your info from?
 
Last edited:
5
•••
Mistakes were made ... humans make mistakes,,, Mistakes can be corrected ... the mistakes are being corrected ... Epik will be much better for it in the end ...

Citation please.

Can you go ahead and provide any proof that "the mistakes are being corrected"?

I sure have not seen anything on that front so far from Epik.

I don't know how anyone could trust them with their data after this level of incompetence.

Brad
 
1
•••
They did..I did ... but humans aren't perfect ... we learn from the mistakes we make ... Equifax and Canva learned and came back better ... Epik will do the same IMO

Alright, if you notice my earlier quote of @.X. post, he wrote that "the mistakes are being corrected". He edited his post to remove that statement. So what is it @.X. ? Are mistakes being corrected or not? And where are you getting your info from?
 
0
•••
Citation please.

Can you go ahead and provide any proof that "the mistakes are being corrected"?

I sure have not seen anything on that front so far from Epik.

I don't know how anyone could trust them with their data after this level of incompetence.

Brad

Proof? Is the site still up and running ? is the site doing business ? you want pertinent information that Epik cant share at this time... remember ... Investigations are ongoing ... do you have any reports of the data being used for criminal activity ?? CC use or ect ?? None have been reported that i have seen as of right now
 
0
•••
Alright, if you notice my earlier quote of @.X. post, he wrote that "the mistakes are being corrected". He edited his post to remove that statement. So what is it @.X. ? Are mistakes being corrected or not? And where are you getting your info from?

Check your email if you are a Epik customer ... They said they are working on the exploits
 
0
•••
Proof? Is the site still up and running ? is the site doing business ? you want pertinent information that Epik cant share at this time... remember ... Investigations are ongoing ... do you have any reports of the data being used for criminal activity ?? CC use or ect ?? None have been reported that i have seen as of right now.

So, then the answer is NO.

The site was up and doing business when the data breach occurred. It being up now is absolutely no proof of anything.

Brad
 
2
•••
Is the site still up and running ? is the site doing business ?

The fact that a website continues to run after a hack or data breach means absolutely nothing. Take a look at Wikileaks, for example.
 
4
•••
Check your email if you are a Epik customer ... They said they are working on the exploits

They said a lot of things about security which turned out to be false and/or misleading.

What f@cking VPN stores records that can easily be tracked back to a 3rd party. Epik.

Brad
 
3
•••
So, then the answer is NO.

The site was up and doing business when the data breach occurred. It being up now is absolutely no proof of anything.

Brad

do you think Rob or Epik are just at liberty to tell you what exploits where found.. were they were found and how they are being dealt with ? would that make sense to do ?? NO
 
0
•••
do you think Rob or Epik are just at liberty to tell you what exploits where found.. were they were found and how they are being dealt with ? would that make sense to do ?? NO

https://www.atlassian.com/incident-management/postmortem

"You may also decide to publish takeaways from your incident postmortem with customers or the rest of your organization. This can go a long way in rebuilding confidence in people who may not have been closely involved as the incident was happening. Other teams in your organization, especially leadership, may need to see the details of the problem and what steps were taken to resolve it to head off any second-guessing of your team in the future.

Partners, customers, and end-users may also want to know what happened and what steps you have taken to improve their experience. Making your incident postmortem available on your public-facing website may not be appropriate in all cases, but your marketing or public relations team can help you craft the language so people get the information in a way that is informative and builds trust in your services."
 
Last edited:
4
•••
do you think Rob or Epik are just at liberty to tell you what exploits where found.. were they were found and how they are being dealt with ? would that make sense to do ?? NO

You mean after not being aware to start with, then denying it, then calling it a "nothingburger", then trying to deflect and blame others, then trying to mislead on the level of breach using terms like "small subset". No objective person would consider 38,000 leaked credit cards a "small subset".

They certainly were not at liberty to discuss their shit code before this happened either.

The way Epik stored and secured data is not acceptable. There is no way around it.
It is not debatable.

All this really gives you ultimate confidence they know what they are doing...

Just follow this Twitter account and you will have a far better view of the actual level of the breach.

https://twitter.com/epikfailsnippet/

Brad
 
Last edited:
4
•••
You mean after not being aware to start with, then denying it, then calling it a "nothingburger", then trying to deflect and blame others, then trying to mislead on the level of breach using terms like "small subset". No objective person would consider 38,000 leaked credit cards a "small subset".

They certainly were not at liberty to discuss their shit code before this happened either.

The way Epik stored and secured data is not acceptable. There is no way around it.
It is not debatable.

All this really gives you ultimate confidence they know what they are doing...

Just follow this Twitter account and you will have a far better view of the actual level of the breach.

https://twitter.com/epikfailsnippet/

Brad

All i said was Epik is doing well and under the circumstances Rob is doing great ...and you people come out like a bunch of hungry dogs attacking that ... That speaks loudly IMO
 
0
•••
All i said was Epik is doing well and under the circumstances Rob is doing great ...and you people come out like a bunch of hungry dogs attacking that ... That speaks loudly IMO

And you provided no proof or evidence of anything. So yeah.

I wonder how many domainers will keep using Epik after this breach?

I wonder how many of the extremist websites will keep using Epik, as their connections are being exposed on social media? It seems like security and privacy would be their top concern.

Brad
 
Last edited:
1
•••
You mean after not being aware to start with, then denying it, then calling it a "nothingburger", then trying to deflect and blame others, then trying to mislead on the level of breach using terms like "small subset". No objective person would consider 38,000 leaked credit cards a "small subset".

They certainly were not at liberty to discuss their shit code before this happened either.

The way Epik stored and secured data is not acceptable. There is no way around it.
It is not debatable.

All this really gives you ultimate confidence they know what they are doing...

Just follow this Twitter account and you will have a far better view of the actual level of the breach.

https://twitter.com/epikfailsnippet/

Brad

Brad ... i am following quite a bunch peeps on Twitter ...and have been ... I am also following a few website -Forums that were anti -Epik prior to the Hack ...
 
0
•••
And you provided no proof or evidence of anything. So yeah.

I wonder how many domainers will keep using Epik after this breach?

I wonder how many of the extremist websites will keep using Epik, as their connections are being exposed on social media? It seems like security and privacy would be their top concern. Epik offered neither.

Brad

I don't need to provide any damn evidence to say that Epik is doing fine and under the circumstances Rob is doing great .... wtf ... Ain't NOBODY going to release any Discovery pertaining to anything ... your kicking a dead horse on trying to get that info
 
0
•••
This story is not going away. It was on the front page of the Sunday print edition of the Washington Post, one of the largest newspapers in the US.

Brad
 
Last edited:
0
•••
I don't need to provide any damn evidence to say that Epik is doing fine and under the circumstances Rob is doing great .... wtf ... Ain't NOBODY going to release any Discovery pertaining to anything ... your kicking a dead horse on trying to get that info

Epik just released the full details of 100,000 people, many of whom are in vulnerable positions, some even life threatening. Several people have already been fired in US. Lord only knows how it is hurting others. Epik/rob has done nothing. When asked why you think Rob is doing good job you couldn't even come up with an example. Go away.
 
3
•••
Epik just released the full details of 100,000 people, many of whom are in vulnerable positions, some even life threatening. Several people have already been fired in US. Lord only knows how it is hurting others. Epik/rob has done nothing. When asked why you think Rob is doing good job you couldn't even come up with an example. Go away.

Maybe i have spoken with Rob ?? BAM ... makes sense right ? Yes .... I guess now you want to know our conversation right ?
 
0
•••
What makes you think i am not participating? Because i dont post endlessly off topic. I have read it all gramps, i have forgotten more than you will ever remember. I will continue reading, and by thanking, liking or disliking, i will be able to participate without endless irrelevant posts. This is out of my control, i am taking care of what i can at this end. Thanks Rob for opening my eyes. May God bless you and all those you love Amen
Why should someone like you who has not been participating in this thread come here and try to dictate to me what I can or can not say.

I can discuss any subject that directly or indirectly has contributed to the current situation and I don't need yours or anyone else's permission to do so.

If my posts are off topic it's up to the mods to say something about it,

But @Paul himself indicated in one of his comments here that having yearly security audits for Registrars and Registries might actually be a good idea and he is a security specialist.

What has happened with Epik is unfortunate, but how do we know that this is not going to happen again in the future if we don't learn any lessons from this experience.

IMO
 
1
•••
Speaking about compliance with ICANN rules, I think this WIPO decision is an interesting read.

https://www.wipo.int/amc/en/domains/search/text.jsp?case=D2021-1050

Date: August 16, 2021

7. Initial Comments on the Registrar’s Role in This Case
This is an unusual case in that the Respondent is the CEO of the Registrar and also is described as the “governor” and “head” of the Registrar’s subsidiary, Anonymize, which was used for a privacy shield. These relationships create an inherent conflict of interest since the Panel relies on the Registrar to provide accurate information in response to the verification request, but the Respondent, who also is the CEO of the Registrar, would have an interest in hiding accurate information about the ownership of the disputed domain name (not to mention other domain names it may acquire) in order to strengthen the Respondent’s arguments with respect to its purported legitimate interest and potential bad faith.

Those prospects of a conflict of interest are problematic in this case. The Registrar, in its verification, inaccurately claimed that Mr. Monster was the owner of the disputed domain name and had been the owner since 2000, long before the Complainant adopted its trademark. In its initial Response, the Respondent provided other information – that the owner of the disputed domain name was Anonymize (not Mr. Monster) and that Anonymize had owned the disputed domain name continuously since September 2020, before Mr. Lindell’s plan in March 2021 to use the disputed domain name for a competing social media service, but significantly after the initial creation date by some two decades. Either way, these inaccurate disclosures were to the Respondent’s benefit. If the Respondent had actually registered the disputed domain name in the year 2000 prior to the Complainant’s trademark rights (registered in 2018 and claiming first use in 2016), the Panel would have found an absence of bad faith registration. See, e.g., WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition (“WIPO Overview 3.0”), section 3.8. Similarly, if the Respondent had registered the disputed domain name prior to the announcement of Mr. Lindell’s venture, and had never transferred the disputed domain name to Mr. Lindell, then the Panel likely would find an absence of bad faith registration since the disputed domain name would have been registered without regard to Mr. Lindell’s arguably infringing plan. See generally id., sections 3.1 and 3.2.

The information provided both by the Registrar and in the Response was materially inaccurate, and it was only after the Panel issued procedural orders seeking clarification that the Respondent corrected the record and admitted that Mr. Monster personally was the registrant but that he only acquired the disputed domain name in March 2021, after the Complainant acquired its trademark and after Mr. Lindell announced and then abandoned his plans. Even still, there remain unexplained inconsistencies in the documentary material submitted by the Respondent: the emails between the Registrar and Mr. Carter indicate that the seller of the disputed domain name on March 9, 2021 was Mr. Monster (not Mr. Vinkhona) and that there was no broker involved, but the internal escrow documentation the Respondent submitted states that Mr. Monster was the broker for Mr. Vinkhona.

This misconduct by the Respondent and by the Registrar is troubling. It is all the more troubling because it appears to have been designed to improve the Respondent’s prospects for success in this proceeding. It raises significant questions as to the propriety of a Registrar being allowed to buy and sell domain names for its own account (or the propriety of a Registrar’s subsidiaries, officers or employees to engage in domain name speculation). This is an issue that the Panel believes should be addressed by ICANN, and the Panel requests that the Center share this decision with ICANN so that ICANN may consider whether to impose restrictions on such behavior by registrars. See, e.g., Registrar Accreditation Agreement, sections 3.7.9 (“Registrar shall abide by any ICANN adopted specifications or policies prohibiting or restricting warehousing of or speculation in domain names by registrars”) and section 1.3.2 (noting that ICANN may establish specifications and policies on “prohibitions on warehousing of or speculation in domain names by registries or registrars”).

The inaccurate disclosures in this case also call into question the certification in the Response, signed by the Respondent’s counsel, Daniel R. Price, “that the information contained in this Response is to the best of the Respondent’s knowledge complete and accurate, that this Response is not being presented for any improper purpose, such as to harass, and that the assertions in this Response are warranted under the Rules and under applicable law, as it now exists or as it may be extended by a good-faith and reasonable argument.” The documentation that the Respondent eventually submitted with its second and third supplemental submissions directly contradicts the representations in the initial Response, which at minimum makes the Panel question Mr. Price’s due diligence in signing the certification.

The Complainant is not wrong to highlight these serious issues. They are not violations of the Federal Rules of Civil Procedure since, as the Complainant acknowledged, those rules apply in United States federal courts, not in a UDRP proceeding. But they do call into question the Respondent’s credibility. That said, the documentation attached to Mr. Monster’s declaration does appear to substantiate his explanation of the facts of this case.

If this proceeding were being held before a United States court, the court would have the inherent power, as a sanction, to rule for the Complainant in light of the Respondent’s serial misrepresentations. The Policy, however, does not give that power to a panel. Rather, the Panel only can rule for the Complainant if the Complainant satisfies the three elements of the Policy. The Panel turns to that analysis in the following three sections.​
 
6
•••
....Epik is doing fine....

Let's say E is doing fine but the company should fix the Fe...Id...ty..com/../../../ & Sub.Fe...Id...ty /../../.. (possible path traversal vulnerability)

Regards
 
Last edited:
1
•••
2
•••
Interesting new development in the Epik hack:

Apparently Epik and Rob have been helping the Feds for several years. Here are a couple leak examples of ones that were under subpoena but apparently there are many more interoffice communications about helping feds with various people. Unfortunately the domain names have been redacted but I working on getting more from some people who actually have the data.

FAO_KUQVkAw973R


FAO_KUPVEAA-sRy
 
1
•••
OK, trying to be fair. As a domainer, I'm now increasing security on my end - including but not limited to changing passwords and replacing leaked email(s) everywhere. While it is something that has or had to be done regardless (periodically - new passwords, leaked email - it was overspammed anyway, so no big loss) - I did it after the epik hack instead of scheduling it to {November.. or December... or next week... so busy everyday...}. A good change? Yes, no doubts. Thanks to Epik, seriously. It may well be that other registrars are also improving their security setup right now - because of Epik hack.

Not an Epik fanboy (0 domains with them, just an old dormant account) - but I would be sorry should Epik close its doors, be deaccredited or disappear. More competition is always better. For the sake of clarity - I'm not U.S. citizen or resident, have no interest in U.S. politics, and hope that Epik (as well as other IT companies) would stop mixing business and politics...
 
2
•••
2
•••
  • The sidebar remains visible by scrolling at a speed relative to the page’s height.
Back