alert Epik Had A Major Breach

bmugford said:

This is nothing new. Registrars have been warehousing domains for years whether it is directly allowed or not.

Web.com (Network Solutions) & New Venture Services Corp as an example.

Brad

Click to expand...

I am talking about when the Registrars don't let the domain names go through the expiry cycle for the sole purpose of wanting to keep them for themselves.

IMO

oldtimer said:

I am talking about when the Registrars don't let the domain names go through the expiry cycle for the sole purpose of wanting to keep them for themselves.

IMO

Click to expand...

Yep, so am I. New Venture Services Corp basically just cherry picks the names they want to keep from Web.com portfolio over many years.

Brad

bmugford said:

Yep, so am I. New Venture Services Corp basically just cherry picks the names they want to keep from Web.com portfolio over many years.

Brad

Click to expand...

And that's okay with ICANN

oldtimer said:

And that's okay with ICANN

Click to expand...

Well, they have not done anything about it. There are plenty of rules and regulations registrars seem to ignore with no enforcement from their end.

Brad

bmugford said:

Well, they have not done anything about it. There are plenty of rules and regulations registrars seem to ignore with no enforcement from their end.

Brad

Click to expand...

And we all know why that is,

A lot of the people at ICANN that are responsible for watching after things like these are directly or indirectly involved with the Registrars and Registries for personal gains.

Some do it after they leave ICANN and some do it while they are still there.

IMO

oldtimer said:

And we all know why that is,

A lot of the people at ICANN that are responsible for watching after things like these are directly or indirectly involved with the Registrars and Registries for personal gains.

Some do it after thet leave ICANN and some do it while they are still there.

IMO

Click to expand...

I feel like we are about to circle back to making this about ICANN, and not about Epik.

The only thing Epik can blame for their "shitty code" is Epik. It was their responsibility to properly store and secure their customer's data.

Brad

oldtimer said:

I know that, but what about the Registrars keeping the domains for themselves.

Click to expand...

There have been many discussions and arguments in ICANN circles about registrars doing this. One argument from the registrar side in favour of this was that once a domain name expires and is not renewed, the registrant no longer "owns" the domain name.The whole register/use/renew or delete life cycle of gTLD domain names has been subverted for decades. It started off with registrars doing deals with auction sites like Snapnames and moving their expired inventory to these sites. Then more of them appeared and more deals were done. Warehousing by registrars was an issue in the mid 2000s (before Epik became a registrar) but it was overtaken by ICANN's incompetence in dealing with Domain Tasting. Some registrars were registering and deleting tens of millions of domain names in a single month. Once the retail registrars saw that the taster registrars were not being punished by ICANN, they began to offer Domain Tasting for their customers.

With the launch of .MOBI, the whole registry auctioning domain names kicked off. The amendments that allowed registries to own registrars amplified some of the problem. The registrars are often in a position to cherrypick expiring domain names that they host because they have access to the DNS traffic and redirect traffic for these domain names and can distinguish a high-traffic domain name from one that may only get a few impressions a month. That's the kind of extremely valuable data that has been released in the Epik databreach. It may not be immediately obvious but this Epik dataset is a goldmine for domainers.

Until the gTLD lifecycle is restored, things will continue as they are. The only way to change it is to get involved in ICANN and lobby for change.

Regards...jmcc

jmcc said:

Until the gTLD lifecycle is restored, things will continue as they are. The only way to change it is to get involved in ICANN and lobby for change.

Regards...jmcc

Click to expand...

Thanks for your detailed response,

It's good to know that there is at least one person here who wants to fix the system that has contributed to the many of the problems that we are seeing now.

IMO

Jona4s said:

Also, Epik_Registrar_UploadedFiles_Loader seems to store documents in a directory, rather than a sql file.

Haven't seen those folders.

Click to expand...

The "saveToDb" flag is set to true when that class is initiated, so the data is stored in the database rather than in files.

bmugford said:

I feel like we are about to circle back to making this about ICANN, and not about Epik.
Brad

Click to expand...

How about circling back to the criminals who are *knowingly* spreading PII and destroying years of privacy protection with the help of useful accomplices in this forum.

sonatime said:

How about circling back to the criminals who are *knowingly* spreading PII and destroying years of privacy protection with the help of useful accomplices in this forum.

Click to expand...

I get your point 100%, but there are also people here saying from the start that you don't have to take it seriously, they don't have to change their credit card number because they've been arrested before so come and get 'em, etc.

The only way to fight the disinformation campaigns in this thread is to be like HEY LOOK, HERE IT IS.

There's a fine line for sure and you are principled standing on that side of it.

Also, the speed at which things are progressing, more researchers are joining in, sharing information, etc...by the time things are shared on twitter things are far past that behind the scenes, I'm sure.

Consider it an alarm? I totally get your point.

Beezy said:

I get your point 100%, but there are also people here saying from the start that you don't have to take it seriously, they don't have to change their credit card number because they've been arrested before so come and get 'em, etc.

The only way to fight the disinformation campaigns in this thread is to be like HEY LOOK, HERE IT IS.

There's a fine line for sure and you are principled standing on that side of it.

Also, the speed at which things are progressing, more researchers are joining in, sharing information, etc...by the time things are shared on twitter things are far past that behind the scenes, I'm sure.

Consider it an alarm? I totally get your point.

Click to expand...

I am not changing my CC because if it is used perhaps I can do as the last data breach i was in and catch the person .. that one person brought 17 more .. plus .. I am completely sick of having to change everything for some damn criminals

sonatime said:

How about circling back to the criminals who are *knowingly* spreading PII and destroying years of privacy protection with the help of useful accomplices in this forum.

Click to expand...

How about circling back to the breach itself. I do get your point, however, some data shared is the only way to know and verify to what extend this goes. No word from E. Hardly anything to go by. Their (and my) data is out their in the open and public, and people should know.

That being said, since mods seem to be moderating some stuff, I will respectfully refrain from posting more info on this thread and let people do their own DD.

.X. said:

I am not changing my CC because if it is used perhaps I can do as the last data breach i was in and catch the person .. that one person brought 17 more .. plus .. I am completely sick of having to change everything for some damn criminals

Click to expand...

I am sick of companies failing to take proper steps to secure their customer's data. Breaches happen quite frequently, but it was only able to be this thorough because of how Epik stored and secured the data.

Brad

DirkS said:

How about circling back to the breach itself. I do get your point, however, some data shared is the only way to know and verify to what extend this goes. No word from E. Hardly anything to go by. Their (and my) data is out their in open and public, and people should know.

That being said, since mods seem to be moderating some stuff, I will respectfully refrain from posting more info on this thread and let people do their own DD.

Click to expand...

the Hacker should have picked their victims .. instead of releasing thousands of peoples information to anyone who wants to download it … I still haven’t heard of anyone’s financials being used unauthorized as of right now .. I would think Fed and state law enforcement agencies are following the leaks posted and keeping an eye on where the data is going

bmugford said:

I am sick of companies failing to take proper steps to secure their customer's data. Breaches happen quite frequently, but it was only able to be this thorough because of how Epik stored and secured the data.

Brad

Click to expand...

you don’t have the right to have my financial information right now .. stolen or not .. there is no excuse when someone steals innocent peoples information ..it’s wrong in every way

.X. said:

you do have the right to have my financial information right now .. stolen or not .. there is no excuse when someone steals innocent peoples information .. not Epik .. not Rob ..

Click to expand...

I do have the right? Thanks for letting me know. That is appreciated.

Even though you gave me that right, I won't use it.

EDITED: Changed to don't.

None of this would have been possible without Epik's "shitty code".

Storing sensitive information in a database in plain text, passwords, credit card numbers, CVV codes, and much more...Awesome.

Brad

.X. said:

I still haven’t heard of anyone’s financials being used unauthorized as of right now

Click to expand...

this -

Jona4s said:

Well it's sad to see my CC in a \"txtCC"\ field, with \"txtCVV"\. Sad story ;(

Click to expand...

bmugford said:

I do have the right? Thanks for letting me know. That is appreciated.

Even though you gave me that right, I won't use it.

Brad

Click to expand...

You knew what I meant .. I changed it .. if it gets used .. I will let ya know .. now that you have told me you have it

.X. said:

You knew what I meant .. I changed it .. if it gets used .. I will let ya know .. now that you have told me you have it

Click to expand...

I don't even know your name, how could I have your CC info?

You act like I am some member of Anonymous pouring over the data or something.

Brad

DirkS said:

How about circling back to the breach itself. I do get your point, however, some data shared is the only way to know and verify to what extend this goes. No word from E. Hardly anything to go by. Their (and my) data is out their in the open and public, and people should know.

That being said, since mods seem to be moderating some stuff, I will respectfully refrain from posting more info on this thread and let people do their own DD.

Click to expand...

Anything informative and helpful sounds good to me and will be appreciated by all.

Thanks for sharing.

I am looking forward to an update from Epik

johnn said:

Maybe you feel lonely in your thread?

Click to expand...

Yes, I do feel like I am alone here, so far it looks like I am the only one who seem to want to get to the root causes of the problems here in an impartial and unbiased way.

Everyone else seems to be divided along the side of their usual political affiliations, loyalties, interests, and agendas.

But, if the consensus here is for me to be quite then I guess I'll just go back to hand registering some more new domain names and let you all worry about the next security breaches in the domain Industry.

Just one last word of advice:

Don't forget that our Right to own and develop domain names is our last stance in protecting our Freedom of Speech.

IMO

oldtimer said:

Yes, I do feel like I am alone here, so far it looks like I am the only one who seem to want to get to the root causes of the problems here in an impartial and unbiased way.

Everyone else seems to be divided along the side of their usual political affiliations, loyalties, interests, and agendas.

But, if the consensus here is for me to be quite then I guess I'll just go back to hand registering some more new domain names and let you all worry about the next security breaches in the domain Industry.

Just one last word of advice:

Don't forget that our Right to own and develop domain names is our last stance in protecting our Freedom of Speech.

IMO

Click to expand...

Companies face attempted breaches daily. That is a reality of life.

You mitigate the risk with a good system in place.

1.) You thwart the intrusion.
2.) The intrusion happens, but you are aware of it almost immediately and shut it down.
3.) The intrusion happens, but you are aware of it after the fact.
4.) The intrusion happens, but you are not aware of it after the fact.
5.) The intrusion happens, but you are not aware of it after the fact AND your security protocols suck. You are storing sensitive information in a database in plain text. You are violating PCI compliance by storing CVV info for credit cards, among other security issues.

You see it takes several levels to get to what happened here. There is a reason this level of breach is almost unprecedented. It was only possible because of Epik's security protocols and their handling of data.

Brad

bmugford said:

I don't even know your name, how could I have your CC info?

You act like I am some member of Anonymous pouring over the data or something.

Brad

Click to expand...

you don’t have to be Anonymous to get the data… it’s been fully accessible to download .. no i don’t think you would use my CC .. but i would not be in possession of that Data .. because if things go bad .. and they easily could .. I think everyone who has downloaded it could be a suspect in any criminal investigations .. the Fed and state police agencies most likely know where the data is being downloaded .. so they most likely know by who .. but I don’t think anyone here at NPs would thief on someone’s CC ..

.X. said:

you don’t have to be Anonymous to get the data… it’s been fully accessible to download .. no i don’t think you would use my CC .. but i would not be in possession of that Data .. because if things go bad .. and they easily could .. I think everyone who has downloaded it could be a suspect in any criminal investigations .. the Fed and state police agencies most likely know where the data is being downloaded .. so they most likely know by who .. but I don’t think anyone here at NPs would thief on someone’s CC ..

Click to expand...

I have not downloaded the data. There is no point as there is nothing I would be doing with it.

I think the legal authorities are likely going to be more interested in some of the connections which are unearthed, not the ones to do with domainers.

If someone actually tries to fraudulently use a credit card, they are clearly playing with fire. That is a well defined crime, without any ambiguity.

Brad