alert Epik Had A Major Breach

[DaveX]

Just read this. Looks like Epik may have been hacked and sensitive data compromised...

Read here:
https://domainnamewire.com/2021/09/14/hackers-claim-significant-epik-breach/

Thought I would share this.

 

[JoeyCamp2020]

I appreciate that you are all talking about me. I will not address your lies, fake "evidence" etc.

Have a good life.

Joey Camp

 

[Kirtaner]

As a victim of this Epik breach and one of the individuals who has been heavily targeted as a result I want to jump in to express a few things.

First and important I am terribly concerned that Molly White continues to rag on this forum with lies and propaganda for the purposes of running to Twitter to incite others. Let me address her concerns here, since I have attempted to do so privately and she merely took those private messages to Twitter for more clout chasing. Let me start by very clearly stating that Molly White is a LIAR. She is a deceptive wordsmith who hides close to the line between truth and falsehood. Those who comprehend English understand her propaganda, those who live on Twitter assume that 180 characters and a "screenshot" are evidence of her integrity. She doesn't seem to mind when hackers steal large chucks of data and post them without censorship, but she sure does mind when someone aggregates publicly available and easy to find material when they relate to her. The irony is much too strong since she uses Wikipedia as a weapon to defame and then locks the profiles which she creates.

I want to address some of the claims made by molly Molly. To begin with her claims of a "child in a bathing suit" are erroneous. The child in question is a childhood photo of her, posted publicly by her mother on her mother's facebook page. To avoid confusion I simply removed her image. We did however at the time preserve the image and posting on several archive sites for reference. Next her claim that the site is a "doxxing" site but she doesn't define "doxxing" nor has she pointed to any illegal content or content that isn't found originally with a Google search -much like her beloved Wikipedia. She rambles about being defamed as a "drug addict" however such speech is an opinion of the administrator and she is subject to limited purpose public figure status and thus it is NOT defamation of any type so long as the user who generated the post believed it.

Next, and important, ROB MONSTER DID NOT HIRE ME FOR ANY REASON RELATED TO MOLLY WHITE OR ANY THING RELATED TO RESEARCH OF ANY SPECIFIC PERSON. End of Story. Molly can produce all the photoshopped screenshots, and spoofed emails that she wants, but she her claim is based on a posting on a satirical website. She clearly doesn't understand that satire is meant to be assumed true. More irony considering that Wikipedia policy would never allow such a site to be cited in an article, but molly Molly seems to think that it is credible enough for her in Twitter Court. Molly has had months on end to serve me legal action, use the administrative processes available -including DMCA, Removal Requests, Modification Requests, etc. She has not. She seems more determined to public harass and humiliate than to resolve this issue she is having professionally. That is evident by her taking everything attempt made or done in private and making it public.

With that in mind, I am not bothering to read hundreds of pages in this thread which seems to me to be nothing but celebration of criminal hackers, untruths about Epik, myself, Rob Monster, and others, and fake Twitter Court clout chasers hell bent of personal attacks over resolution and mending. I have no intention of checking back, don't know if this post will go to moderation, don't care about the style, format, or appearance of the post, and don't care about any feedback it might get.

The world I live in is not defined by cyber trolls, Wikipedia thugs, cancel culture specialist and corporate entities that will cave to pressures. News cycles hell bent of getting out anything before checking facts, basement dwellers who have nothing but time, rich white girls like Molly with mommy and daddy money to afford $500k mortgages and nothing better to do with their time than sit on a computer trying to cancel someone.

Nothing on my sites, none of my domains or my conduct is illegal, civilly actionable, but that wont stop molly Molly from engaging in targeted harassment against myself and others in a manner about 100x worse than she accuses me of. It's a real shame to be honest because she has brought disgrace to her grandparents and E.B. White specifically. The talent that produced Charlottes Web did not pass through the generational gene pool to Molly.

Respectfully, I don't care after this.

Have a good life.

Joey Camp

Joey, Joey, Joey..... when will you finally learn?

You stopped replying to my text messages... it's good to see that it is, in fact, possible to be too intimidating for you.

Thank you for bequeathing me with the title "Demon Hacker" though. It rules.

Moderators - I request that Joey's post and my response are left standing. Consider this a one-off foray into a side issue pertaining to the breach. <3

 

[Evil.dll]

I appreciate that you are all talking about me. I will not address your lies, fake "evidence" etc.

Have a good life.

Joey Camp

Nice edit. Thank god for screenshots.

 

[Evil.dll]

Nice edit. Thank god for screenshots.

I appreciate that you are all talking about me. I will not address your lies, fake "evidence" etc.

Have a good life.

Joey Camp

No response to my challenge?

 

[Jona4s]

I've probably spend years staring at the disassembly of my server binary written in C, looking for overflows, heap alloc leaks, racy code, and it stills segfaults when fuzzing.

What makes anyone think Epik with some developers can just write scripts in "Zend aka PHP", or use a "Latest Frameworks (??)" and that will prevent further attacks?

If you are starting from the ground up, it will take years to ship both a server and an IDS, and if not, well, using PHP and Apache only works when you are not targeted by security professionals.

The origin IP is also public on Sonar scans, so you can't really hide.

 

[Kirtaner]

Aww, I think I spooked him off.

 

[DN Playbook]

Aww, I think I spooked him off.

Maybe he got a message to remove it. Clearly we are not getting the truth or facts from the RM/E camp. Doesn't bode well.

 

[Kirtaner]

I've probably spend years staring at the disassembly of my server binary written in C, looking for overflows, heap alloc leaks, racy code, and it stills segfaults when fuzzing.

What makes anyone think Epik with some developers can just write scripts in "Zend aka PHP", or use a "Latest Frameworks (??)" and that will prevent further attacks?

If you are starting from the ground up, it will take years to ship both a server and an IDS, and if not, well, using PHP and Apache only works when you are not targeted by security professionals.

The origin IP is also public on Sonar scans, so you can't really hide.

Look at all the source code repositories available to tear apart. Just look.

 

[Molly White]

Perhaps Joey realized that a giant post exhibiting the exact same type of harassment he has been targeting at me is not the best way to argue that he's not harassing me and that he's really the victim here.

Or maybe his boss called him off.

 

[Altetra]

I appreciate that you are all talking about me. I will not address your lies, fake "evidence" etc.

Have a good life.

Joey Camp

It's not hard to see her post full of drama, together with this hacker Kirt, I don't think they are in a position to give us advice what Epik should do, I know very good their plan but they will not succeed.
This people come here and pretend to be good and offer solutions hahaha, don't make me laugh, the one who ordered the hack + the hacker offer advices. :D
You should be both in prison, but no wait Kirt is protected by his govt, wonder how much they pay you to hack companies per their orders.

 

[DN Playbook]

It is reasonable to expect that in any governmental or legal investigation, this thread will be used as evidence of complicity, negligence, intent, state of mind, etc. So RM and his cohorts have to be very careful what they write which may explain the lack of any real information from their side, and only a very generic statement from RM. This Joey person might have stepped into doo-doo with his comments. Ergo the edit.

 

[iAdam]

This thread is getting too complicated to follow, but for an average user it's normal.

All what i learned is that epik had a major breach, and Rob is nowhere to be found to repond to people's concerns.

God bless you all.

 

[Evil.dll]

Classic… The guy who attempted to sell 35,000 social security numbers to a Fed is suddenly the beacon of internet morality. Regale me with your tales of valor Joey Camp. It has been 45 minutes since I challenged you to a duel, sir. What are you afraid of Joey? I can assure you I am prepared for a rational debate, put that correspondence school legal secretary certificate to use. Where should we start? The Pandects, or maybe some Oliver Wendell Holmes, or maybe the United States v. Stevens? Your move, Chief!

 

[dirk]

Although it is too early to declare victory, we are certainly making progress. Here is a recap of just some of the actions taken:

 Retained forensic investigation and technical security firm on a full-time basis;

 Retained data privacy and cybersecurity outside counsels to report and remediate the Incident;

 Implemented industry best practice for secure password vault;

 Worked with development teams to cycle all SSH keys multiple times and shut down other means of access to Epik systems;

 Implement bug bounty program (est. Oct 7, 2021);

 Daily coordinated work and efforts combining executive, legal, PR, and security team;

 Migrated all source code to new platform;

 Forced client password resets;

 Shut down all outside access endpoints into Epik’s systems;

 Removed all credit card information from live databases;

 Implemented an SSO where strongly encrypted passwords are not stored on Epik systems and authorization;

 Continued to expunge unnecessary personal information from systems and implement best practices;

 Explored SOC-2 Compliance options after Incident response in near-term;

 Notified clients who were impacted by the data Incident on several dates (Sept 18 and 20, 2021), secured critical systems and provided 2 years of credit monitoring to clients who had payment information included in the Incident;

 Timely notified State Attorneys General in relevant jurisdictions, where prescribed by applicable state data breach notification law;

 Worked with the FBI to help identify the threat actors and take appropriate legal action.

 

[Kirtaner]

Although it is too early to declare victory, we are certainly making progress. Here is a recap of just some of the actions taken:

 Retained forensic investigation and technical security firm on a full-time basis;

 Retained data privacy and cybersecurity outside counsels to report and remediate the Incident;

 Implemented industry best practice for secure password vault;

 Worked with development teams to cycle all SSH keys multiple times and shut down other means of access to Epik systems;

 Implement bug bounty program (est. Oct 7, 2021);

 Daily coordinated work and efforts combining executive, legal, PR, and security team;

 Migrated all source code to new platform;

 Forced client password resets;

 Shut down all outside access endpoints into Epik’s systems;

 Removed all credit card information from live databases;

 Implemented an SSO where strongly encrypted passwords are not stored on Epik systems and authorization;

 Continued to expunge unnecessary personal information from systems and implement best practices;

 Explored SOC-2 Compliance options after Incident response in near-term;

 Notified clients who were impacted by the data Incident on several dates (Sept 18 and 20, 2021), secured critical systems and provided 2 years of credit monitoring to clients who had payment information included in the Incident;

 Timely notified State Attorneys General in relevant jurisdictions, where prescribed by applicable state data breach notification law;

 Worked with the FBI to help identify the threat actors and take appropriate legal action.

Given what I'm actively watching on Twitter, most of this post has to be a complete lie.

Also, will point out, Rob didn't think this community was worth giving this update to.

 

[Kirtaner]

It's not hard to see her post full of drama, together with this hacker Kirt, I don't think they are in a position to give us advice what Epik should do, I know very good their plan but they will not succeed.
This people come here and pretend to be good and offer solutions hahaha, don't make me laugh, the one who ordered the hack + the hacker offer advices. :D
You should be both in prison, but no wait Kirt is protected by his govt, wonder how much they pay you to hack companies per their orders.

Still waiting for 15 years of CIA backpay

 

[bmugford]

Although it is too early to declare victory, we are certainly making progress. Here is a recap of just some of the actions taken:

 Retained forensic investigation and technical security firm on a full-time basis;

 Retained data privacy and cybersecurity outside counsels to report and remediate the Incident;

 Implemented industry best practice for secure password vault;

 Worked with development teams to cycle all SSH keys multiple times and shut down other means of access to Epik systems;

 Implement bug bounty program (est. Oct 7, 2021);

 Daily coordinated work and efforts combining executive, legal, PR, and security team;

 Migrated all source code to new platform;

 Forced client password resets;

 Shut down all outside access endpoints into Epik’s systems;

 Removed all credit card information from live databases;

 Implemented an SSO where strongly encrypted passwords are not stored on Epik systems and authorization;

 Continued to expunge unnecessary personal information from systems and implement best practices;

 Explored SOC-2 Compliance options after Incident response in near-term;

 Notified clients who were impacted by the data Incident on several dates (Sept 18 and 20, 2021), secured critical systems and provided 2 years of credit monitoring to clients who had payment information included in the Incident;

 Timely notified State Attorneys General in relevant jurisdictions, where prescribed by applicable state data breach notification law;

 Worked with the FBI to help identify the threat actors and take appropriate legal action.

Kind of an odd opening here...

Although it is too early to declare victory, we are certainly making progress.

Like, you just got hacked in an almost unprecedented level data breach that exposed just how poorly you stored and secured customer data. They even took bootable server images.

It is bizarro world to even bring up the word "victory" at the moment. I would love to know what "victory" actually looks like.

It also comes down to what you can trust.

I am sorry, but after what Epik said in the past about security, and the security practices that this data breach exposed, I am highly skeptical of just believing what is said.

Brad

 

[NickB]

This thread has become toxic.......

Have been popping in very occasionally for a catch up read, but will not be doing so from now on........

 

[bmugford]

Although it is too early to declare victory, we are certainly making progress. Here is a recap of just some of the actions taken:

 Retained forensic investigation and technical security firm on a full-time basis;

 Retained data privacy and cybersecurity outside counsels to report and remediate the Incident;

 Implemented industry best practice for secure password vault;

 Worked with development teams to cycle all SSH keys multiple times and shut down other means of access to Epik systems;

 Implement bug bounty program (est. Oct 7, 2021);

 Daily coordinated work and efforts combining executive, legal, PR, and security team;

 Migrated all source code to new platform;

 Forced client password resets;

 Shut down all outside access endpoints into Epik’s systems;

 Removed all credit card information from live databases;

 Implemented an SSO where strongly encrypted passwords are not stored on Epik systems and authorization;

 Continued to expunge unnecessary personal information from systems and implement best practices;

 Explored SOC-2 Compliance options after Incident response in near-term;

 Notified clients who were impacted by the data Incident on several dates (Sept 18 and 20, 2021), secured critical systems and provided 2 years of credit monitoring to clients who had payment information included in the Incident;

 Timely notified State Attorneys General in relevant jurisdictions, where prescribed by applicable state data breach notification law;

 Worked with the FBI to help identify the threat actors and take appropriate legal action.

Also, looks like Rob is talking shit about NamePros on the other forum.

First he talks about a "struggle session" which he defines as -

The struggle session was famously used by the Chinese Communist Party to achieve alignment and consensus. It served to root out any remnant of dissent or misaligned thinking before more Draconian measures were introduced.

From there he goes on -

As some here will recognize, I have witnessed a struggle session in operation over the last month at NamePros. If you missed it, you can sample that here:

I believe the dynamic is toxic in its drive to conformity. Ironically it was a primary reason for Epik to acquire (Other forum name). I did not expect it to get this severe, but I guess we were prescient in that acquisition. I have great hope for (Other forum name) and believe others will discover why in time.

Although I am not a moderator and have no intention of becoming one, as the owner of (Other forum name), Epik will absolutely encourage open dialog in the hope that more discussion is better. In promoting dialog, the silent majority should never have to live in fear of the apparatchiks. Independent thought should be welcome and encouraged here.

As for the folks who prefer to be part of the hive mind, they might feel more at home elsewhere. Nevertheless, they should still feel welcome to sample the engagement of free thinkers.

 

[bmugford]

Then Rob gets called out by a poster on his forum who says -

I believe that thread is active because you don't address specific issues brought up. It seems you want to skirt around them bringing in religion and posts like these. Some of the emails the owner Paul posted from seems you're not so ok with open dialogue, and they come across as beware what you post.

In other posts here you talk about unity among the industry, when literally on your site you have pages going against competitors like GoDaddy.

I received yet another email from you today about password reset.

I'm more concerned about what you're doing to secure the site. What about the "shitty code" your words the site is built on. Has that been fixed yet?

and

Just saw your post in the other thread. Why not post that at Namepros and send an email letting customers know what is being done. That's what we've been asking for.