alert Epik Had A Major Breach

[DaveX]

Just read this. Looks like Epik may have been hacked and sensitive data compromised...

Read here:
https://domainnamewire.com/2021/09/14/hackers-claim-significant-epik-breach/

Thought I would share this.

 

[Future Sensors]

but I did check to see whether my own emails with Rob + Epik were included, and I didn't see them

According to the external MX records for the epik.com domain, Epik is using the trusted Google mail services for incoming email. The SPF records tell something about their sending IP ranges (Rob, if you're reading this: there's a typo in your spf records, "ip4:5"). I don't know how mail is handled, forwarded, and stored on internal servers. It's possible that it's all stored at Google for security reasons.

 

[Derek Peterson]

There is information that looks a lot like credentials and session IDs for hosting. The passwords appear to have been redacted, but session IDs are still present. I don't know whether any of the session IDs are valid or how sensitive they are, and I'm certainly not going to test them.

Scary. Probably how they got Oathkeepers server.

Not that I've seen. It's possible DNS requests were inadvertently logged somewhere--there's no shortage of inadvertent logging of sensitive information--but I doubt it would be trivial to link such logs to individual users.

Wouldn't surprise me. Wouldn't surprise me if intentional.

I'm not particularly interested in crawling through the communications that were leaked--there are already plenty of other people doing that--but I did check to see whether my own emails with Rob + Epik were included, and I didn't see them. That leads me to question whether any information was deliberately withheld, so I would be cautious in assessing any controversial communications that do come to light. Remember that all of the data you're seeing passed through an attacker first, and that attacker claims to have had an agenda. While fabricating data without being noticed would have been difficult for such a large dataset, withholding information would have been trivial, and there are multiple signs they did just that.

Yes, exactly. The feds always scrub the scene to protect themselves and their assets and you already know who I think the hackers are working for.

 

[bmugford]

Breaking News
Show attachment 200908

(That is to Rob, not you for posting it.)

How about an update on the actual data breach?

Brad

 

[dirk]

Breaking News
Show attachment 200908

 

[Future Sensors]

https://twitter.com/x/status/1443975549442011136

https://twitter.com/x/status/1443975550998130698

https://twitter.com/x/status/1443975552440930306

 

[Future Sensors]

In the absence of any direction from Epik, new Twitter members are taking the lead in responsible security research.

 

[dirk]

Is it to Destroy

or

Is it to Reform

Thanks. There was a lot worthy to discuss in your post but I decided to highlight the one thing that's applicable to this thread, imo.

Sure, some people are looking for blood, wouldn't mind seeing E destroyed. However, I have no doubt the vast majority of E users would rather see them prevail and succeed in securing their registrar.

Second chances are fine. But to be given one, one should atone for the fuckup(s) in the past, pardon my french.

From what I'm observing, E seems to be doubling down on their story of being the victim. When you have that mindset, reform is not an option.

 

[FernandoBMS]

Epik wasn't dealing drugs. They did business with people with objectionable politics.

"His company Epik describes itself as “the Swiss bank of domains” and is one of the few US-based registrars with a history of refusing to respond to reports of illegal activity. According to a report by the pharmaceutical watchdog organization LegitScript, Epik has been told that some of the domains the company sponsors sell illegal drugs and inauthentic medications, yet the company has not acted." (WIRED, 2018)

 

[Windoms]

Sad story is there are probably people who had the same password with gmail and had some of their stuff stolen. Once you have access to gmail, you have everything.

Epik's sept 15th email was secretive and didnt tell anyone about possible data or password leaks.
Only talked about an "alleged security incident".

Breach was acknowledged on sept 19th email, including possible username and password leaks.

Which means lots of people had no idea for 5 days.

...

 

[Derek Peterson]

Thanks. There was a lot worthy to discuss in your post but I decided to highlight the one thing that's applicable to this thread, imo.

Sure, some people are looking for blood, wouldn't mind seeing E destroyed. However, I have no doubt the vast majority of E users would rather see them prevail and succeed in securing their registrar.

Second chances are fine. But to be given one, one should atone for the fuckup(s) in the past, pardon my french.

From what I'm observing, E seems to be doubling down on their story of being the victim. When you have that mindset, reform is not an option.

This is more like Epik and Rob's 3r or 4th chance. I exposed their fake VPN over 2 years ago and he reacted the exact same way - lie, attack, deflect and manipulate with hyper-spiritual gobly gook. The fact is that they just don't care. You can not make someone care. You might be able to force them to make some changes but the same behavior will be back in the future to hurt others again.

 

[Derek Peterson]

"His company Epik describes itself as “the Swiss bank of domains” and is one of the few US-based registrars with a history of refusing to respond to reports of illegal activity. According to a report by the pharmaceutical watchdog organization LegitScript, Epik has been told that some of the domains the company sponsors sell illegal drugs and inauthentic medications, yet the company has not acted." (WIRED, 2018)

The issue, at least for me, is NOT about what sites Epik was servicing, it is about their lack of security, their lack of concern for user privacy and data, their dishonesty and now their outrageous response, and lack thereof, to the hack of ALL their users' very personal data.

The more you focus on political and social and moral things the less you focus on the main problem, Rob Monster is incompetent and dishonest, best case scenario.

 

[FernandoBMS]

A quick reminder that Rob Monster was not only denying that there was a breach, he was on Twitter posting links to websites created to defame the journalists who were reporting the story.

 

[dirk]

This is more like Epik and Rob's 3r or 4th chance. I exposed their fake VPN over 2 years ago and he reacted the exact same way - lie, attack, deflect and manipulate with hyper-spiritual gobly gook. The fact is that they just don't care. You can not make someone care. You might be able to force them to make some changes but the same behavior will be back in the future to hurt others again.

Thanks. I think I commented on this some years back. I have reason/sources to support you're right about most of this. I think we as a domainer forum should focus on E the registrar though.

Main takeaway, apparently E never audited their acquisitions in the right way, hence they acquired a registrar which wasn't very secure to begin with, which is an understatement.

What baffles me though is, they've been integrating a lot of stuff. At some point you'll be going through some of your registrar code to make that work... It's weird no one noticed. There were/are some talented people at E...

 

[DN Playbook]

Dear Paul,

This is a note written to your highest self.

First of all, I want to acknowledge that NamePros as a community is fundamentally a force for good where industry participants have an opportunity to learn from each other and overcome challenges as they arise. I am thankful that it exists.

My reason for acquiring DNF earlier this year was not because I want to be in the forum business. I don’t. Rather it was because of what I observed to be a systematic anti-Epik bias. This troubled me and the situation at NP did not improve.

As for the most recent hack incident, we are certainly learning from it. You likely heard that we secured significant investment funding. We have not announced the full extent of the hiring and acquisitions but suffice it to say, we have been upgrading.

Already before this investment, Epik was moving swiftly to bring new innovations to the industry. Although we are not without our blind spots or shortcomings, the progress of maturing as a company was well under way.

The hack incident is relatively understood. We know who did it, how they did it, and when they did it. We also have a pretty good idea of why they did it and for whose benefit.

As I review the latest NP thread, what I find most troubling is that you are actively participating in what looks to be a concerted effort to defame and undermine Epik. In all sincerity, and in the spirit of “love thy neighbor”, this is not a good look for you.

Your name is Paul — the namesake of the man who was once Saul of Tarsus. Whoever named you likely had some awareness of Paul. It is a Biblical name. As Bible characters go, Paul is a personal favorite as he embodies the optimistic view on man’s journey.

So, why am I telling you this? Because the choices you are making will have consequences.

Epik will not perish. Our compliance team is following best practices. Our insurance coverage is ample. Our team is solid. Our domains under management continues to grow. And lastly, and most importantly, because God is on the throne.

My encouragement to you is to view your current actions and choices through an eternal lens. If souls are eternal, as I am quite sure they are, then even a $1 million “Epik Fail” bounty would not be worth it if it factored materially in your eternal path.

Finally, as I believe there are many folks who are likely damning themselves with false testimony, I would encourage a time slot that allows forum thread commenters the opporunity to go back and redact any false testimony before it is memorialized for consequence.

Regards,
Rob

Edit:

My reply:

Have I made any incorrect statements of fact? If so, please enumerate them.

His response:

Paul,

This was not a legal letter. Perhaps you have decided to make it one but please know that the note I wrote was written to your eternal soul.

Regards,
Rob

Breaking News
Show attachment 200908

The only rational explanation for radio silence from RM/E is that they are listening to lawyers. Likely to mitigate possible class action or criminal charges. Total speculation on my part, but it seems reasonable.

When you are dealing with thousands of customers using your network and services, security is a monumental task on par with the code powering your infrastructure.

These small scale responses are bizarre. It almost sounds like RM is fighting the urge to make public statements against legal advice.

 

[Derek Peterson]

Thanks. I think I commented on this some years back. I have reason/sources to support you're right about most of this. I think we as a domainer forum should focus on E the registrar though.

Main takeaway, apparently E never audited their acquisitions in the right way, hence they acquired a registrar which wasn't very secure to begin with, which is an understatement.

What baffles me though is, they've been integrating a lot of stuff. At some point you'll be going through some of your registrar code to make that work... It's weird no one noticed. There were/are some talented people at E...

Rob Monster has owned Epik for like 10 years, enough time to check on the code and security. He doesn't care.

 

[Derek Peterson]

The only rational explanation for radio silence from RM/E is that they are listening to lawyers. Likely to mitigate possible class action or criminal charges. Total speculation on my part, but it seems reasonable.

When you are dealing with thousands of customers using your network and services, security is a monumental task on par with the code powering your infrastructure.

These small scale responses are bizarre. It almost sounds like RM is fighting the urge to make public statements against legal advice.

I think we are all in unity on the truth, except for Monster. He is used to bullying employees and family or people he has control over. Must be frustrating to have to look at and deal with reality for a change.

 

[dirk]

Rob Monster has owned Epik for like 10 years, enough time to check on the code and security. He doesn't care.

Maybe so, or he lacks the technical skills and knowledge which seems a plausible explanation. Either way, it's what resulted in the devastating hack we're experiencing.

 

[Derek Peterson]

Maybe so, or he lacks the technical skills and knowledge which seems a plausible explanation. Either way, it's what resulted in the devastating hack we're experiencing.

Of course he doesn't have the tech skills to do it himself but he has millions of dollars, hire someone. It isn't hard. The simple reality is that he doesn't care.

 

[mr-x]

A quick reminder that Rob Monster was not only denying that there was a breach, he was on Twitter posting links to websites created to defame the journalists who were reporting the story.

Was it defamation or criticism?

 

[FernandoBMS]

Was it defamation or criticism?

It was defamation. And doxxing.

Edit/Note: Although Monster promised in the Q&A that it would no longer provide services to this network of doxxing and defamation websites, Epik continues to manage their domains to this day.