alert Epik Had A Major Breach

[DaveX]

Just read this. Looks like Epik may have been hacked and sensitive data compromised...

Read here:
https://domainnamewire.com/2021/09/14/hackers-claim-significant-epik-breach/

Thought I would share this.

 

[mr-x]

This was already mentioned in the press and on Twitter. What we are now starting to see are these formal notifications and investigations by Epik customers that were part of the same breach.

Thanks.

 

[DN Playbook]

Source: https://texasgop.org/data-breach/

Show attachment 201654

This was already mentioned in the press and on Twitter. What we are now starting to see are these formal notifications and investigations by Epik customers that were part of the same breach.

TexasGOP.org appear to be on shared hosting. As such, they would not have any control over server side security. They would still be at the mercy of Epik as long as they host there. This also shows that the hack is not limited to E's registrar service.

 

[SirDrago]

Active attempts to login to my account by hackers...

Unbelievable,
And I told @Rob Monster that his site was vulnerable months ago!

Tried using chat to tell them while it was happening and Raj had NO CLUE HOW TO HELP.

I'll find the conversation and post here later.

 

[SirDrago]

Who ever hacked your platform is now running bots with "our stolen" emails and passwords.

I TOLD YOU SO @Rob Monster

 

[fatter]

Got the same messages, will changing password help

 

[DN Playbook]

Got the same messages, will changing password help

It is always a good idea to change passwords. Whether it would help in the case of E depends on any announcement and assurance that the security holes have been fixed. Otherwise, hackers may still have access. But if you used the same email/password combo on any other service, you should definitely change those asap.

 

[johnn]

Some people still did not get it and want to give Rob a second chance.
It's not simple like pricing mistakes or transfer names but he is stubborn with the security and MESSED UP the life of his customers - at least thousand of people.
This is not a mistake but stupidity from his part. And if he is a good guy then where the hell he has been hiding for the last several weeks.

Wake up people.
Several Civil lawsuits may come soon!

 

[DN Playbook]

And if he is a good guy then where the hell he has been hiding for the last several weeks.

It would certainly be advisable to move out your assets (domains, websites) until a high level of certainty is given from RM/E that the security problems have been fixed. And even then, proceed with caution. It is hard to understand why no updates are given by E with exception of a PR spin. If we knew the full scope of the situation perhaps it wouldn't be so hard to understand. Unfortunately, we are left with speculation. But the signs are all there.

 

[Windoms]

It would certainly be advisable to move out your assets (domains, websites) until a high level of certainty is given from RM/E that the security problems have been fixed. And even then, proceed with caution. It is hard to understand why no updates are given by E with exception of a PR spin. If we knew the full scope of the situation perhaps it wouldn't be so hard to understand. Unfortunately, we are left with speculation. But the signs are all there.

Problem is Rob doesnt want you to move your domains.

 

[topdom]

What would be the damage: Are you domains safe. Now, your info, name address, list of your domains may have been stolen. Even your pw may have been stolen. What now, will you lose your domains. First change your pw. The hacker can still have access to your pw and login to your account from his device (and you can probably check if this happened). But can your domains be stolen, there are two ways to transfer, one with authcode, and another with push. Authcode is not displayed anymore (?: not shown to us at least), and emailed to admin contact. So unless your admin email was also stolen your domain can't be moved to another registrar*. What else can happen: theft via PUSH, or SALES via Epik's own marketplace. Epik must do something about it, and I bet they did. ... So, the important thing is making sure your admin contact email is safe. *Can admin contact be modified from Epik, if so this would be a big risk.
Nameserver changes should also require verification (if new ones used at least).
Another thing: The hacker can sell his own domains to you using Epik marketplace (but this would be very noticable, and probably not happen).

Other stuff: hosting, certs etc are more complicated, and can't say anything about it.
Can such data be used against you in UDRP, yes, but I think this would count as an illegal use.
Finance: use a low limit card, and monitor it frequently. How about cards used in the past?
You can consider moving all your domains elsewhere , but this can mean an enormous renewal/transfer cost in a short period of time.

 

[Future Sensors]

Active attempts to login to my account by hackers...
Show attachment 201686

Show attachment 201687

Unbelievable,
And I told @Rob Monster that his site was vulnerable months ago!

Tried using chat to tell them while it was happening and Raj had NO CLUE HOW TO HELP.

I'll find the conversation and post here later.

A message to Epik, as its source code has now been made public and is under public investigation. Check your 2FA / PIN code generation procedure, and that it has not been tampered with. Make sure that it has the greatest possible degree of randomness. And rebuild everything.

https://resources.infosecinstitute....ques-for-attacking-two-factor-authentication/

 

[Future Sensors]

@SirDrago You are now in effect being DoS'ed with PINs. I do not rule out that customers will turn off this method for that reason.

 

[bmugford]

I noticed on the other domain forum that the "struggle session" thread posted by Rob, that was supposed to be an "open dialogue", is no longer publicly viewable.

Currently it shows the following -

"You must be logged-in to do that."

I wonder why.

Brad

It now looks like the "Struggle Session" thread Rob posted on the other website has been fully deleted.

It shows -

Oops! We ran into some problems.
The requested thread could not be found.

The memory holing is not going to work.

#memoryhole

Brad

 

[Kirtaner]

Epik Fail was in Rolling Stone today.

It will not be the only time.

Media saturation will continue indefinitely, there is no stopping it.

 

[Kirtaner]

https://twitter.com/x/status/1447772188963229702

 

[Future Sensors]

Epik Fail was in Rolling Stone today.

Thank you. Epik and RM are mentioned a couple of times in the article.

The article can be found on the original website and in Google Cache.

A Pro-Choice Hacking Team Defaced the Texas GOP Website. So We DM’d Them
Hackers speak out after one the biggest leaks of far-right data ever​

https://www.rollingstone.com/politi...m-that-defaced-the-texas-gop-website-1238782/
​

 

[dirk]

It now looks like the "Struggle Session" thread Rob posted on the other website has been fully deleted.

It shows -

Oops! We ran into some problems.
The requested thread could not be found.

The memory holing is not going to work.

#memoryhole

Brad

It's still there. Only accessible to logged in users though. They've labelled it as controversial.

Edit: it's public again.

 

[Future Sensors]

It's still there. Only accessible to logged in users though. They've labelled it as controversial.

So controversial content is only shown to members. I'm sure there's a market for that.

 

[Wali Dahot]

A message to Epik, as its source code has now been made public and is under public investigation. Check your 2FA / PIN code generation procedure, and that it has not been tampered with. Make sure that it has the greatest possible degree of randomness. And rebuild everything.

https://resources.infosecinstitute....ques-for-attacking-two-factor-authentication/

I was not getting 2FA codes to my mobile last week so I contacted support via Live Chat and the guy said he will forward the complaint to the management. I somehow started getting 2FA messages the next day so I thought my issue was resolved.
But I recieved a message yesterday from Ian at Epik asking for my account PIN, I ignored and deleted it as the issue was already resolved but now after reading the article, I am suspicious of a social engineering attempt as mentioned in the article.

 

[Windoms]

Someone logged into my microsoft account, didnt find anything, left.
Couple days later someone logged into a streaming service account of mine, found a credit card on file, changed the email, but not the password.
I received an email with "email changed to xxxx", logged in using that email, same password, logged in, changed email back to mine, changed password.

Reality is the vast majority of people have one email, and one password for everything.
If they are cautious, they will use a different password for their email adress, and another one for the other services. Not a different password for each service like you guys are saying.

This leak is going to mess up a lot of people's lives, they are literally trying to login everywhere and look for stuff.

Us happen to be on namepros, but many that have no idea what namepros is have already been screwed by epik's silence.