alert Epik Had A Major Breach

[DaveX]

Just read this. Looks like Epik may have been hacked and sensitive data compromised...

Read here:
https://domainnamewire.com/2021/09/14/hackers-claim-significant-epik-breach/

Thought I would share this.

 

[finitecrystal]

Just heard about all this. Bit mind blowing as I trusted them with high level security, LOL. If a personchanges their password, adds 2FA, and changes to an email that uses 2FA, that would eliminate most risk of unwanted access/transfers? I'm keen to hear others thoughts, as I have a few there. Cheers all, stay safe

I think the risk of unwanted transfers is pretty low at this point, especially if you change your password on Epik's FederatedIdentity platform and enable a 2 factor authentication. FI is based on Red Hat's Keycloak authentication system which is technically a hell of a lot better than Epik's proprietary garbage. If I were you I would start making plans to transfer your high value/security domains to a better registrar.

 

[labrocca]

I don't know what this is supposed to mean, but it's vaguely threatening and I don't appreciate it. I know people like you don't appreciate the work I'm doing and hate me for speaking ill of your nazi-enabling pals at Epik (or other mysterious reasons), but attempting to intimidate me with statements like this is incredibly immature.

Um...no threat at all. I'm not a malicious person, I'm public. Most people know who I am, where I live, and what I do. My username is my last name. You want my address? I'm harmless other than a vocal person online. Also, I don't hate you or anyone really. Just not a thing for me.

I was just saying based on your posting style that I think I know who you are. I think it's odd that you joined under a pseudonym when you already have an account here. You say you feel threatened but your actions are the more aggressive when you join under a secondary account to post about Rob. I don't think that's very nice at all.

I am not trying even 1% to intimidate you. I actually think it's the opposite. You're using a new account to attack Rob.

 

[carob]

You're here to be political and to smear Rob. I doubt you were ever an Epik customer so this has never personally effected you. I question your motives for participating here. I think you're gloating and want to do your best to spread the story and say whatever you can to hurt Rob and Epik because you have an agenda.

This wasn't directed at me, but I'd like to say that attributing motives here is not helping the discussion.

As I said a few pages back, there are two concerns: the service provided by Epik and the privacy/security effects on customers, and the reputational issues - positive or negative - in being associated with Epik.

It's possible to have concerns about Epik, and voice them, without wishing to destroy Epik or responding to political or religious positions taken by Epik under Rob Monster's control. And it is possible to study and understand the data without having any other agenda than understanding it and sharing that knowledge. Most people have neither the time, knowledge or resources to explore the data - they appreciate others doing it for them.

If someone analyses earthquake data and it helps me avoid catastrophe, I wouldn't accuse them of trying to destroy cities or targeting my home.

 

[labrocca]

This wasn't directed at me, but I'd like to say that attributing motives here is not helping the discussion.

As I said a few pages back, there are two concerns: the service provided by Epik and the privacy/security effects on customers, and the reputational issues - positive or negative - in being associated with Epik.

I was told I was being threatening and hateful. I had to respond to that. But I can feel that I should bow out of the discussion now. I think I've said my peace.

Thanks for reading and best of luck to everyone.

 

[Paul]

I was just saying based on your posting style that I think I know who you are. I think it's odd that you joined under a pseudonym when you already have an account here. You say you feel threatened but your actions are the more aggressive when you join under a secondary account to post about Rob. I don't think that's very nice at all.

We're not going to allow vague accusations like that here. I know it's commonplace on Twitter, but it's not appropriate for NamePros. If you suspect a duplicate account, report it--don't comment about it. Each member is only permitted one free account.

We've been seeing this argument with increasing frequency on NamePros: the other side's arguments and points are invalid because they are bots or puppet accounts. Every time we've investigated such claims, they turned out to be not just unfounded, but verifiably false.

Address the claims within each post, not the person or account behind those claims.

 

[finitecrystal]

I was just saying based on your posting style that I think I know who you are. I think it's odd that you joined under a pseudonym when you already have an account here.

I did not have an account here before creating this one. I used the same username as my Twitter handle in hopes that some people would recognize my Tweets. I believe if my posting style proves anything, it's that I am in fact @FiniteCrystal from Twitter. More ridiculous conspiratorial garbage from the Epik Defense Force

I'm certainly not here to attack Rob Monster. I don't think Rob is a respectable person but as previously stated, I really don't care about him at all. I'm also not here to "be political", but I won't shy away from making political statements for reasons I've already discussed. The reason I'm here is to discuss the Epik hack, and share information about what exactly it contains. Now if we can get over this bizarre arc of harassing the new girl because she thinks your favourite company is bad and move on to actually discussing the topic of the damn thread, I'd appreciate it.

 

[.X.]

btw, I thought I had bought killcops.com here on Namepros but I had to look it up to be sure. I think I paid $10.

https://www.namepros.com/threads/updates-list-of-names.87000/#post-566345

Also bought QUICKBUNNY.COM, POKERBITCH.COM, and a couple others on the list.

And wow about the Hitler crap. This is turning into a witch hunt. The narrative is obvious. Paint Rob as a Nazi and destroy his image.



Epik has some major players of the Far Right like Gab. But as you pointed out about many Right Wing sites and domains they are not exclusively or even the majority registered at Epik. Also note that IT IS NOT ILLEGAL. There is absolutely nothing illegal happening.

Cancel culture working really hard today.



Yes, all fairly true. Massive screw up by Epik. I'm fairly sure they know that. A person could absolutely decide to leave their service and middle-finger them on the way out. Or a person could decide their value to them and choose to forgive expecting them to fix the problems. I don't see that as super desperate. Just willing to give Epik a chance at fixing this and moving forward hopefully stronger.



But that's where Epik goofed. You logged EVERYTHING and you should not have. I assume you know this now but realistically your site should never had needed 150GB of database or files. My site is 17 years old with 50m posts and millions of members. The whole thing is under 10GB archived. I prune what I don't need. I don't log what I don't need. I don't backup what I don't need. I'm gonna assume Rob made these choices and I hope the lesson he learns from all this is to find a competent CTO to make these choices.

I look at the whole Federated thing and I get it but I don't like it. I've seen these types of attempts at multi-system integrations before. I even tried it myself once. They tend to fail. It might sound easier to have one login but it ends up causing headaches. You're better off allowing social logins like Google, Twitter, and Facebook if you want that type of system. If I want a Bitmitigate account, then I'll sign up for that.



Then understand and respect that when you're a member of a community targeted by groups like Anonymous, SJW's or Marxists that people like Rob are brave as they are the few willing to stand up and help when nobody else will. It's impossible to be apolitical when your ideals and speech are being cancelled.

You just want the right to exist, maybe that's all other people want as well. You think it's okay to target people you don't agree with but you're not okay with people targeting you. There is a word for that, hypocrisy. You're here to be political and to smear Rob. I doubt you were ever an Epik customer so this has never personally effected you. I question your motives for participating here. I think you're gloating and want to do your best to spread the story and say whatever you can to hurt Rob and Epik because you have an agenda. Joining here just for that imho disqualifies you from participating in a manner befitting this community.



It's actually why I used Epik. Not because I agree with racists or extremists but because I know my domain is protected by someone that actually cares about free speech. As an American I've grown up believing in the Constitution. I continue to see its power being diminished by cancel culture and I don't like it. I'm not a racist, extremist, or whatever label. Just a guy that believes in liberty, not just mine but yours too. When I test on political spectrums I'm dead central. Just saying that believing someone who uses Epik is supporting racism or is a racist isn't accurate.



I think we all know who you are.

the Nazi domains are at another register .. the register that bans websites lol ..

I agree .. it appears like a full effort to defame character to finish what the hack didn’t .. expose or whatever .. but like I said … the Nazi domains are at another register . So

a Witch hunt .. there is a thought ..

 

[Samer]

what the hell does Transphobic mean ??

well .. I mean .. people come on here to attack Rob Monster .. so people will post to defend Rob Monster … what is good for the goose is good for the gander .. that is fair play … maybe stop the attacks altogether ?? Or deal with getting attacked back

Talk to @Rob Monster

He is the most affable person i’ve ever met.

Dont trust the hit pieces by people who just want Rob to look like Hitler political narrative. Monster treatment ultimate case of projection.

God bless you, @Rob Monster.

Samer

 

[Future Sensors]

I found a table that included mailer logs for all of the registrar related emails that Epik sent out, including domain expiration notifications. The data wasn't for all time or anything, I don't remember what the start and end dates were, but it was mostly in 2020. Oddly, one of the columns in this table indicated that Epik has been Bccing ALL of these emails to an account on a seemingly random domain that is operated by one of their customers. I looked up the domain's invoice and it was paid for by a customer in Russia. I am willing to provide more info about this domain if it's allowed here.

Tagging @Rob Monster here, to give him a chance to give his view on the matter.

Rob, in your live Q&A following the Epik Breach you mentioned several times that Epik is using "shitty" Russian code, for instance here:

[Monster] "Yes, shitty Russian code. We bought some shitty Russian code and we actually didn’t really have an opportunity to evaluate that code until we finished, until we really took control over everything."
​

Is this (the use of the Russian code) related to the findings mentioned above by @FiniteCrystal?

What was the intention of these bcc mails? Do you think this is alarming? Were you aware of it?

 

[FernandoBMS]

[Monster] "Yes, shitty Russian code. We bought some shitty Russian code and we actually didn’t really have an opportunity to evaluate that code until we finished, until we really took control over everything."

@Rob Monster in the Q&A about the Epik Fail hack

"Monster, 0:11:05: It’s me. I tried to mute the new person but I muted myself, that’s me. So when we… this will sound funny. When this breach occurred, I think for many of our top engineers this was the first time they saw the code. And that sounds really stupid, but the history of Epik is that we acquired a company called IntrustDomains back in 2011..."

(...)

[reading the chat. Full comment from chat was from “JorgeOrwell”: “So you bought some shitty russian code and never fixed it? MD5s. Rob common (sic) man”] Yes, shitty Russian code. We bought some shitty Russian code and we actually didn’t really have an opportunity to evaluate that code until we finished, until we really took control over everything."

(...)

But in the process of doing those acquisitions and raising that capital, what we assembled was really capable people, and some of the different business units that we’ve acquired came with really really talented technologists, and we’re working on basically retooling the development organization. In fact, because of this incident we formed a technical core team. I’ve been kind of the acting CTO if you look at the org chart, well, it’s not public."

Unfortunately I think that org chart may be public now. Rob Monster is the CEO and acting CTO. Vitaliy Opryshko is (was?) Head Of Software Development for the last decade according to his linkedin.

 

[finitecrystal]

the Nazi domains are at another register .. the register that bans websites lol ..

I agree .. it appears like a full effort to defame character to finish what the hack didn’t .. expose or whatever .. but like I said … the Nazi domains are at another register . So

a Witch hunt .. there is a thought ..

I believe it's been well established that Rob's ownership of the nazi domains was primarily due to Epik's stupid expiration system that involves the domain being placed into Epik's account so they can sell it for a profit after it expires. I agree that this makes Rob's ownership of those domains less bad, but it does not absolve him of all responsibility. For starters, putting his name as the registrant on every domain that expired at Epik was an incredibly stupid decision on his part. Moreover, the reason he got those domains is because Epik is a fan favourite of nazis and all kinds of other unsavory people that Epik was clearly going out of their way to market to. Epik even gave Parler technical advice after they got yanked from AWS.

For what it's worth, Rob Monster also had his name on the registrant contact for hitlerdidnothingwrong dot com for a while. It's not a good look, even if it wasn't really his domain. He needs to seriously reconsider his commitment to putting his name on everything like a wannabe Donald Trump because it's making him look like an asshat right now.

 

[FernandoBMS]

What was the intention of these bcc mails? Do you think this is alarming? Were you aware of it?

I know to whom it was forwarded to, but I don't know if I'm allowed to mention in this forum.

 

[jmcc]

I believe it's been well established that Rob's ownership of the nazi domains was primarily due to Epik's stupid expiration system that involves the domain being placed into Epik's account so they can sell it for a profit after it expires.

This kind of breaking of the natural domain name registration/renewal/deletion lifecycle is not limited to Epik. There is a grace period after a domain name expires where the registrant can renew the expired domain name. Some registrars will, after that variable period expires, move the domain name to an auction site (if it is considered valuable or has traffic) rather than let it go through the full deletion process.

https://www.icann.org/resources/pages/gtld-lifecycle-2012-02-25-en

Regards...jmcc

 

[finitecrystal]

Is this (the use of the Russian code) related to the findings mentioned above by @FiniteCrystal?

What was the intention of these bcc mails? Do you think this is alarming? Were you aware of it?

I believe that the "shitty Russian code" that Epik "inherited" was responsible for how poorly the data was being stored, yes. I haven't actually looked into it much, but I think most of Epik's website code was actually included in the leak. I'm not really a security researcher so I wouldn't be able to point out anything interesting, but another Twitter user found at least a couple really horrible flaws, at least one of which still allowed drive-by XSS attacks on the current version of Epik's site(!!!) Epik blocked that person from logging into their bug reporting system, indicating that they still don't give a shit about security. If we give them the benefit of the doubt, we could say they're too busy scrambling to fix things to worry about the bug reports, but instead of spending time blocking a security researcher from doing their job, they should have spent that time fixing their shit.

I know who registered the domain that the Bccs were going to, I will share that information if it's expressly allowed by a mod. As for whether or not it's alarming, in my opinion, it is alarming that Epik was doing this in the first place, but again it was probably due to gross negligence and not some evil plot. Not sure what you're asking at the end, was I aware of what?

EDIT: I forgot to add that I think this so-called "legacy" "shitty Russian code" that Monster was referring to was written by the same guy who wrote all their other code, so unless he was referring to the entire registrar system, including Epik's additions, he kinda fibbed about that.

 

[Future Sensors]

I believe that the "shitty Russian code" that Epik "inherited" was responsible for how poorly the data was being stored, yes. I haven't actually looked into it much, but I think most of Epik's website code was actually included in the leak. I'm not really a security researcher so I wouldn't be able to point out anything interesting, but another Twitter user found at least a couple really horrible flaws, at least one of which still allowed drive-by XSS attacks on the current version of Epik's site(!!!) Epik blocked that person from logging into their bug reporting system, indicating that they still don't give a shit about security. If we give them the benefit of the doubt, we could say they're too busy scrambling to fix things to worry about the bug reports, but instead of spending time blocking a security researcher from doing their job, they should have spent that time fixing their shit.

I know who registered the domain that the Bccs were going to, I will share that information if it's expressly allowed by a mod. As for whether or not it's alarming, in my opinion, it is alarming that Epik was doing this in the first place, but again it was probably due to gross negligence and not some evil plot.

Thanks. I do think it's alarming too, but tried to ask it in a neutral way.

Not sure what you're asking at the end, was I aware of what?

That question, and all my questions, were addressed to @Rob Monster, but I had to quote your posting.

 

[finitecrystal]

That question, and all my questions, were directed to @Rob Monster, but I had to quote your posting.

Oh, I apologize. I misread the post since you mentioned me in one of the questions. My bad.

 

[tonyk2000]

For starters, putting his name as the registrant on every domain that expired at Epik was an incredibly stupid decision on his part.

It is neither good nor bad. Epik, like many other registrars, elects to remove expired domains from their original accounts (the original owner may still reclaim the domain, under certain conditions, but it is another story). Since each domain is supposed to have admin/tech/billing contacts, it is not surprising that Epik elected to use their company as a temporary new contact (pending final deletion or pre-release resale). Human name is a natural part of any contact record, so Rob (the CEO) was listed. Imo. Epik might use generic Domain Manager name instead [like web.com for example, just check whois of web.com] - would it make any practical or legal difference? No.

 

[Paul]

I know who registered the domain that the Bccs were going to, I will share that information if it's expressly allowed by a mod.

We'd rather this not turn into that sort of thread. There's going to be no shortage of such discussion taking place elsewhere, but NamePros is focused on domain investing. Many of our members are worried that their life's work may now be in jeopardy as a result of this incident.

I know Epik makes for great political news elsewhere, but that controversy has played out incessantly here for years. Most of us are tired of it. Everything that could possibly be said has been said, and there's really not much more to add. The threads now just devolve into flame wars.

An aspect to consider for people outside the industry is that Epik is renowned for their hands-on support. Regardless of what anyone may think of their politics, Rob and his team have a reputation for bending over backwards to help their customers, regardless of political affiliation (or lack thereof). For the most part, Epik has been a stellar example of perfect customer support, and I think even their detractors here would largely agree with that. That context is important to keep in mind when assessing the reactions from our community.

It would be best if this discussion headed toward remediation: what should our members do? What do our members need to worry about, and what's not worth worrying about?

 

[finitecrystal]

Epik might also use generic Domain Manager name [like web.com for example, just check whois of web.com]- would it make any practical difference? No.

The practical difference is that researchers and journalists looking through this dump won't see his name popping up dozens of times when they search for keywords like "nazi".

 

[finitecrystal]

We'd rather this not turn into that sort of thread.

Got it. The only reason I offered is because it's not an Earth-shattering revelation.