alert Epik Had A Major Breach

[Silentptnr]

Just read this. Looks like Epik may have been hacked and sensitive data compromised...

Read here:
https://domainnamewire.com/2021/09/14/hackers-claim-significant-epik-breach/

Thought I would share this.

 

[oldtimer]

I am not trying to bully you in any way and I am certainly not trying to silence you, as Rob has done to this entire thread. I simply asked if you have spoken with him or anyone at Epik recently and your response was very vague and now you give very suspect caveat of, "related to the ongoing problems". I think it is safe to assume that you have spoken with them and I find such a coordinated spin very dishonest.

Now you are beginning to sound paranoid about everyone.

Haven't you read my posts,

What makes you think that I am automatically taking Rob's side.

All along I have been trying to encourage everyone to do the right thing,

And doing the right thing as far as Rob and Epik are concerned means that they should own up to their responsibilities towards their customers for what has already taken place and coming up with a better kind of mindset, strategy, goal, and platform that doesn't lead to having more and more breaches in the future.

IMO

 

[Kirtaner]

Talking about other recent hacks and fear-mongering about how "cybercrime is an immense problem" is not going to make your massive security problems go away, it is Cybersecurity Awareness Month, after all. Can you give specific details on what things your company is doing to improve security practices, reduce the amount of sensitive data collected to mitigate the damage of a potential future hack, and otherwise prevent something like this from happening again? It feels like you're trying to deflect from the issue of poor security at Epik by pinning the blame on cybercriminals, but hackers aren't going away any time soon and it is your responsibility as the company's CEO and acting CTO to make sure that you have a competent security team that can ensure the resiliency of your systems and protect your data.

The more he dodges, the quicker people give him and his company the digital equivalent of a swirlie. There's all sorts of people out there, right now, tearing all of their software's internals to shreds, and preliminary comments don't sound good.

 

[Kirtaner]

I don't think Rob Monster truly grasps the scope of the situation he is now in.

https://twitter.com/x/status/1446124341926658059

https://twitter.com/x/status/1446140348439334917

 

[Future Sensors]

The more he dodges, the quicker people give him and his company the digital equivalent of a swirlie. There's all sorts of people out there, right now, tearing all of their software's internals to shreds, and preliminary comments don't sound good.

Aside from what has already been advised in this thread regarding informing customers and other stakeholders, what do you think is the best way for Epik to get back on track?

 

[bmugford]

I don't think Rob Monster truly grasps the scope of the situation he is now in.

I agree with that. When you factor in the security being employed to begin with, and the response to the data breach, I am starting to question the competence of Epik and their staff.

This is not just some ignore, deflect, sweep it under the rug type of event. It is not something small contained to just the domaining community.

The scope of this data breach, and all the potential residual damage is massive.

Brad

 

[Kirtaner]

Aside from what has already been advised in this thread regarding informing customers and other stakeholders, what do you think is the best way for Epik to get back on track?

Apologize to their customers, transfer them to a different company, shut down completely, and rebuild. Or just shut down.

There are no other options for them.

That is my professional opinion.

 

[Future Sensors]

Apologize to their customers, transfer them to a different company, shut down completely, and rebuild. Or just shut down.

Perhaps the questionable customers should not transfer to this new company.

 

[Derek Peterson]

Now you are beginning to sound paranoid about everyone.

Haven't you read my posts,

What makes you think that I am automatically taking Rob's side.

All along I have been trying to encourage everyone to do the right thing,

And doing the right thing as far as Rob and Epik are concerned means that they should own up to their responsibilities towards their customers for what has already taken place and coming up with a better kind of mindset, strategy, goal, and platform that doesn't lead to having more and more breaches in the future.

IMO

3 non-answers and a personal attack is a very clear answer. Thank you for playing. Viva la #masterbucks

 

[Evil.dll]

Apologize to their customers, transfer them to a different company, shut down completely, and rebuild. Or just shut down.

There are no other options for them.

That is my professional opinion.

^^^^This^^^^
Kirtaner has provided the best advice anyone in this situation could take. Epik no longer has to assume persistence in their systems, That is just a given. Take a mulligan and learn from facebooks PR nightmare, they realize that moving forward with Facebook horizons probably would not inspire consumer confidence after their “Internal BGP mishap” and damning testimony from a whistleblower.
The one thing Rob got right was that the data is cursed, not by sky dad, but by shitty code assembled under a shitty framework, by dollar store coders(not engineers). Toss a little bit of that 32 million dollar investment into hiring competent engineers and always remember…. Build. Attack. Defend. Just my opinion, you can take it with a grain of salt or you could choose salt free if it suits you.

 

[oldtimer]

^^^^This^^^^
Kirtaner has provided the best advice anyone in this situation could take. Epik no longer has to assume persistence in their systems, That is just a given. Take a mulligan and learn from facebooks PR nightmare, they realize that moving forward with Facebook horizons probably would not inspire consumer confidence after their “Internal BGP mishap” and damning testimony from a whistleblower.
The one thing Rob got right was that the data is cursed, not by sky dad, but by shitty code assembled under a shitty framework, by dollar store coders(not engineers). Toss a little bit of that 32 million dollar investment into hiring competent engineers and always remember…. Build. Attack. Defend. Just my opinion, you can take it with a grain of salt or you could choose salt free if it suits you.

I personally am going to reserve all judgments until I see how Epik handles all its responsibilities and commitments towards its customers and shareholders and what improvements and changes are going to be put in place by Rob to make Epik a better and more secure company going forward.

I don't know how anyone can be more impartial and fair than this.

IMO

 

[jmcc]

The scope of this data breach, and all the potential residual damage is massive.

For Epik and the domain name industry perhaps. But the reality is that Epik is not a Tier 1 registrar operator with tens of millions of domain names under management. That means that the impact of the databreach is far more localised.

Epik will take a short to medium term hit on registrations. The operators of some large porfolios have moved their domain names off Epik's nameservers. The problem is in determining if they also changed registrars. Portfolio shifts are not unusual in the wake of databreaches.

The other complicating factor with Epik is that it is very unlike typical retail registrars. Retail registrars/hosters tend to have a mix of web usage types. Epik's has a high percentage of for-sale domain names on its nameservers. Unless ICANN terminates its registrar accreditation, Epik will probably continue in business as a registrar. At a registrar level, domain names are incredibly sticky. They do not transfer in high volumes each month.

The main vulnerabilities at the moment for Epik are the confidence in its sales platform and the security of its hosted/registered domain names. If Epik can maintain enduser confidence in its sales platform and ensure that no domain names are stolen, then it may stay in business. It certainly has a bumpy road ahead with a possible class action suit but the domain name industry is driven more by money than by politics.

Regards...jmcc

 

[Lox]

What you should really be worrying about: September sees big decline in rebrands and T2 domain name sales. (Regarding E whois db...various media/ppl have reported this-that but there's a huge pile of dead domains/info ...

Regards

 

[frank-germany]

>>>Out of an approach toward maximum caution, we have required Epik users to change their passwords following an unauthorized intrusion into some of our domain-related systems on or before September 13, 2021.<<

unauthorized intrusion..

 

[Derek Peterson]

>>>Out of an approach toward maximum caution, we have required Epik users to change their passwords following an unauthorized intrusion into some of our domain-related systems on or before September 13, 2021.<<

unauthorized intrusion..

Just change your password. Problem solved.

 

[frank-germany]

Just change your password. Problem solved.

no domains at epik
problem solved

 

[JoeyCamp2020]

I appreciate that you are all talking about me. I will not address your lies, fake "evidence" etc.

Have a good life.

Joey Camp

 

[Kirtaner]

As a victim of this Epik breach and one of the individuals who has been heavily targeted as a result I want to jump in to express a few things.

First and important I am terribly concerned that Molly White continues to rag on this forum with lies and propaganda for the purposes of running to Twitter to incite others. Let me address her concerns here, since I have attempted to do so privately and she merely took those private messages to Twitter for more clout chasing. Let me start by very clearly stating that Molly White is a LIAR. She is a deceptive wordsmith who hides close to the line between truth and falsehood. Those who comprehend English understand her propaganda, those who live on Twitter assume that 180 characters and a "screenshot" are evidence of her integrity. She doesn't seem to mind when hackers steal large chucks of data and post them without censorship, but she sure does mind when someone aggregates publicly available and easy to find material when they relate to her. The irony is much too strong since she uses Wikipedia as a weapon to defame and then locks the profiles which she creates.

I want to address some of the claims made by molly Molly. To begin with her claims of a "child in a bathing suit" are erroneous. The child in question is a childhood photo of her, posted publicly by her mother on her mother's facebook page. To avoid confusion I simply removed her image. We did however at the time preserve the image and posting on several archive sites for reference. Next her claim that the site is a "doxxing" site but she doesn't define "doxxing" nor has she pointed to any illegal content or content that isn't found originally with a Google search -much like her beloved Wikipedia. She rambles about being defamed as a "drug addict" however such speech is an opinion of the administrator and she is subject to limited purpose public figure status and thus it is NOT defamation of any type so long as the user who generated the post believed it.

Next, and important, ROB MONSTER DID NOT HIRE ME FOR ANY REASON RELATED TO MOLLY WHITE OR ANY THING RELATED TO RESEARCH OF ANY SPECIFIC PERSON. End of Story. Molly can produce all the photoshopped screenshots, and spoofed emails that she wants, but she her claim is based on a posting on a satirical website. She clearly doesn't understand that satire is meant to be assumed true. More irony considering that Wikipedia policy would never allow such a site to be cited in an article, but molly Molly seems to think that it is credible enough for her in Twitter Court. Molly has had months on end to serve me legal action, use the administrative processes available -including DMCA, Removal Requests, Modification Requests, etc. She has not. She seems more determined to public harass and humiliate than to resolve this issue she is having professionally. That is evident by her taking everything attempt made or done in private and making it public.

With that in mind, I am not bothering to read hundreds of pages in this thread which seems to me to be nothing but celebration of criminal hackers, untruths about Epik, myself, Rob Monster, and others, and fake Twitter Court clout chasers hell bent of personal attacks over resolution and mending. I have no intention of checking back, don't know if this post will go to moderation, don't care about the style, format, or appearance of the post, and don't care about any feedback it might get.

The world I live in is not defined by cyber trolls, Wikipedia thugs, cancel culture specialist and corporate entities that will cave to pressures. News cycles hell bent of getting out anything before checking facts, basement dwellers who have nothing but time, rich white girls like Molly with mommy and daddy money to afford $500k mortgages and nothing better to do with their time than sit on a computer trying to cancel someone.

Nothing on my sites, none of my domains or my conduct is illegal, civilly actionable, but that wont stop molly Molly from engaging in targeted harassment against myself and others in a manner about 100x worse than she accuses me of. It's a real shame to be honest because she has brought disgrace to her grandparents and E.B. White specifically. The talent that produced Charlottes Web did not pass through the generational gene pool to Molly.

Respectfully, I don't care after this.

Have a good life.

Joey Camp

Joey, Joey, Joey..... when will you finally learn?

You stopped replying to my text messages... it's good to see that it is, in fact, possible to be too intimidating for you.

Thank you for bequeathing me with the title "Demon Hacker" though. It rules.

Moderators - I request that Joey's post and my response are left standing. Consider this a one-off foray into a side issue pertaining to the breach. <3

 

[Evil.dll]

I appreciate that you are all talking about me. I will not address your lies, fake "evidence" etc.

Have a good life.

Joey Camp

Nice edit. Thank god for screenshots.

 

[Evil.dll]

Nice edit. Thank god for screenshots.

I appreciate that you are all talking about me. I will not address your lies, fake "evidence" etc.

Have a good life.

Joey Camp

No response to my challenge?

 

[Jona4s]

I've probably spend years staring at the disassembly of my server binary written in C, looking for overflows, heap alloc leaks, racy code, and it stills segfaults when fuzzing.

What makes anyone think Epik with some developers can just write scripts in "Zend aka PHP", or use a "Latest Frameworks (??)" and that will prevent further attacks?

If you are starting from the ground up, it will take years to ship both a server and an IDS, and if not, well, using PHP and Apache only works when you are not targeted by security professionals.

The origin IP is also public on Sonar scans, so you can't really hide.

 

[Kirtaner]

Aww, I think I spooked him off.

 

[DN Playbook]

Aww, I think I spooked him off.

Maybe he got a message to remove it. Clearly we are not getting the truth or facts from the RM/E camp. Doesn't bode well.

 

[Kirtaner]

I've probably spend years staring at the disassembly of my server binary written in C, looking for overflows, heap alloc leaks, racy code, and it stills segfaults when fuzzing.

What makes anyone think Epik with some developers can just write scripts in "Zend aka PHP", or use a "Latest Frameworks (??)" and that will prevent further attacks?

If you are starting from the ground up, it will take years to ship both a server and an IDS, and if not, well, using PHP and Apache only works when you are not targeted by security professionals.

The origin IP is also public on Sonar scans, so you can't really hide.

Look at all the source code repositories available to tear apart. Just look.

 

[Molly White]

Perhaps Joey realized that a giant post exhibiting the exact same type of harassment he has been targeting at me is not the best way to argue that he's not harassing me and that he's really the victim here.

Or maybe his boss called him off.

 

[DomainNature]

I appreciate that you are all talking about me. I will not address your lies, fake "evidence" etc.

Have a good life.

Joey Camp

It's not hard to see her post full of drama, together with this hacker Kirt, I don't think they are in a position to give us advice what Epik should do, I know very good their plan but they will not succeed.
This people come here and pretend to be good and offer solutions hahaha, don't make me laugh, the one who ordered the hack + the hacker offer advices. :D
You should be both in prison, but no wait Kirt is protected by his govt, wonder how much they pay you to hack companies per their orders.