IT.COM

alert Epik Had A Major Breach

Spaceship Spaceship
Watch

Silentptnr

Domains88.comTop Member
Impact
47,106
Last edited:
33
•••
The views expressed on this page by users and staff are their own, not those of NamePros.
"Monster, YT2:59:00: And then Wikipedia! Those of you who think Wikipedia is anything other than propaganda, you’re…

Unidentified: He’s just fucking around talking about it. Did he like apologize for getting everybody’s fucking data? Or is he just rambling like a fucking idiot?

Monster: Uh, no. No, no, no, not like a fucking idiot.

Unidentified: Oh, you can hear me?

Monster: I can.

Unidentified, YT2:59:22: You fucking clown.

Monster: …because you can mute yourself, or you can… what’s your name?

Unidentified: No I’m not gonna bother. No thank you. Continue on, keep going.

Monster: Alright. Well if you’re gonna masturbate, just turn the audio off okay, because I don’t really want to hear it.

Unidentified: Yeah you do.

Monster: No, I don’t really get off on it.

Unidentified: Yeah you do. That’s why you’re talking about it."
 
2
•••
That is all someone in a weak position can do. It is the go to playbook.
Behind the looks of a criminal that doesn't wish to repent.

1264632471.jpg
 
1
•••
0
•••
"Monster, YT2:59:00: And then Wikipedia! Those of you who think Wikipedia is anything other than propaganda, you’re…

Unidentified: He’s just fucking around talking about it. Did he like apologize for getting everybody’s fucking data? Or is he just rambling like a fucking idiot?

Monster: Uh, no. No, no, no, not like a fucking idiot.

Unidentified: Oh, you can hear me?

Monster: I can.

Unidentified, YT2:59:22: You fucking clown.

Monster: …because you can mute yourself, or you can… what’s your name?

Unidentified: No I’m not gonna bother. No thank you. Continue on, keep going.

Monster: Alright. Well if you’re gonna masturbate, just turn the audio off okay, because I don’t really want to hear it.

Unidentified: Yeah you do.

Monster: No, I don’t really get off on it.

Unidentified: Yeah you do. That’s why you’re talking about it."

Unidentified makes a valid point.
 
0
•••
The Wikipedia page about the 2021 Epik Data Breach is a textbook example of how to properly inform all stakeholders about this incident.

https://en.wikipedia.org/wiki/2021_Epik_data_breach

This thread would have been very different and not as long if RM/E had some self awareness and responded right away acknowledging the hack, informing and requiring customers to change their passwords, cancel credit cards, etc., informing them that a strong firewall is being added along with other specific measures being taken. And answering valid and direct questions raised.

Instead, RM denied the hack at first, minimized it later on, and he has presented himself as the victim. That he is being attacked because of his religion. That this thread is a "struggle session" like that which the Chinese government used to discredit people.

What is wrong with this picture?
 
2
•••
This thread would have been very different and not as long if RM/E had some self awareness and responded right away acknowledging the hack, informing and requiring customers to change their passwords, cancel credit cards, etc., informing them that a strong firewall is being added along with other specific measures being taken. And answering valid and direct questions raised.

Instead, RM denied the hack at first, minimized it later on, and he has presented himself as the victim. That he is being attacked because of his religion. That this thread is a "struggle session" like that which the Chinese government used to discredit people.

What is wrong with this picture?

I think this thread is very educational for all of us.
 
3
•••
During the impromptu video town hall, I temporarily disabled the site YourDaddyJoey.com due to allegations of content that violates our ToS. The takedown was for a single site. It was done as a good faith gesture pending confirmatory investigation of the alleged ToS violation.

On the next morning, I did have a call with Joey where I voiced my concerns and also sought to gauge his willingness to adapt his content if and when he is called upon to do so. He was adamant that his content was lawful. At the time, he said he was unwilling to commit to process takedown requests.

As a result of that impasse, a decision was taken to part ways with Joey. YourDaddyJoey.com left Epik and as far as I know that site did not come back online. His other domains are either being dropped by his request, or transferring elsewhere. I understand he is in depositions, but it is happening.

@Rob Monster So, if I am reading this correctly, on September 17, you had a call with Joey, and as a result Epik and Joey "decided to part ways". However, a month later, Joey is continuing to use Epik services for numerous domains, including one that is continuing to host exactly the same type of content you took down in the September 16 call (one such example is the same site at you took down, but at .org rather than .com). He is also using the domain discussed in the September 16 call, where you intentionally avoided disabling his email, to send harassing emails. He has been actively creating new websites and updating his existing ones with new content, so it would seem whatever "depositions" you're referring to are not eating into his time too much. You are of course aware of all of Mr. Camp's actions that I describe here, as you have spoken with at least one individual on the phone about it (and fobbed him off on abuse@epik), and have been receiving continuous reports from numerous individuals to your abuse@ address. Just this morning I received further threats about Joey Camp adding "new content" to his various websites.

How long will Epik continue to service Mr. Camp while claiming to have "parted ways"? Can he just continue to use your services indefinitely to endanger myself and others?
 
Last edited:
7
•••
How long will Epik continue to service Mr. Camp while claiming to have "parted ways"? Can he just continue to use your services indefinitely to endanger myself and others?

@Rob Monster, this is your opportunity to clarify.
 
4
•••
As I have mentioned earlier on this thread everyone has to decide what the goal is here as far as whether it's to Destroy or to Reform and although there are no guarantees that Epik is willing or able to rebrand with a new mindset, strategy, goal, and platform even if given the chance and as such I reserve all judgments about this situation until I see what steps are going to be taken going forward.

That is just a logical fallacy.

Sometimes called the “either-or” fallacy, a false dilemma is a logical fallacy that presents only two options or sides when there are many options or sides. Essentially, a false dilemma presents a “black and white” kind of thinking when there are actually many shades of gray.

There are plenty of other options. I couldn't care less if Epik survives or not, the free market will decide that largely based on their previous actions and response to this.

Epik needs to take full responsibility for their role in this, which includes terrible security based on "shitty code." All we are getting is ignore, blame, deflect. It has been their go to playbook in the past as well.

The ball is in their court to step up and take responsibility and take actions to correct their massive failure.

Brad
 
Last edited:
8
•••
That is just a logical fallacy.

Sometimes called the “either-or” fallacy, a false dilemma is a logical fallacy that presents only two options or sides when there are many options or sides. Essentially, a false dilemma presents a “black and white” kind of thinking when there are actually many shades of gray.

There are plenty of other options. I couldn't care less if Epik survives or not, the free market will decide that largely based on their previous actions and response to this.

Epik needs to take full responsibility for their role in this, which includes terrible security based on "shitty code." All we are getting is ignore, blame, deflect. It has been their go to playbook in the past as well.

The ball is in their court to step up and take responsibility and take actions to correct their massive failure.

Brad

Brad you are entitled to have that opinion, but sooner or later people have to choose whether they want to see some reforms or whether they are already deadset on destroying Epik. Although to be fair a lot of things depend on what course of action is going to be taken by Epik and that's why that I said earlier that I am going to reserve all judgments until I see what steps are going to be taken to improve Epik.

IMO
 
0
•••
Brad you are entitled to have that opinion, but sooner or later people have to choose whether they want to see some reforms or whether they are already deadset on destroying Epik.

The fallacy is the second option you mentioned, "they are already dead set on destroying Epik". What examples have you come across that give you this impression?
 
Last edited:
4
•••
I appreciate the position you are coming from. The scope of this thread is the E situation. If we delve into the big picture, root causes, morals, cyber wars, etc., then the thread can be easily derailed. As mentioned by @jmcc, another thread should be created for that.

That's definitely true @DN Playbook. And at the same time, this data breach case has many stakeholders, who largely all want to tell their side of the story. Or read it passively.

In the many pages (121 as I'm writing this), there has been a very detailed discussion of the technical side, the legal side, the marketing side, the way which credit card data should be handled, and maybe a thousand more related topics that I personally found very valuable.

At the start of this thread we knew little. Now we know quite a bit more. And that even without having received serious cooperation from Epik or their CEO himself!

This community is top notch.
 
10
•••
The fallacy is the second option you mentioned, "they are already dead set on destroying Epik". What examples have you come across that give you this impression?


It's not a fallacy, its a fact that some people here like to see Epik shutdown and go out of business,

At least that's the impression that I have gotten from some of the posts on this thread so far.

As I have said on several occasions it might very well end up that way if Epik is unwilling or unable to rebrand with a whole new mindset, strategy, goal, and platform, but unlike some people here I am going to reserve all judgments until I see what steps are going to be taken to improve Epik.

IMO
 
1
•••
It's not a fallacy, its a fact that some people here like to see Epik shutdown and go out of business,

At least that's the impression that I have gotten from some of the posts on this thread so far.

The domain industry is not exactly portrayed positively by outsiders. This specific data breach does not help in any way to improve that image. The CEO's reactions worsen this image for the entire industry. Thank you very much?

Epik has been Registrar Of The Year in the past and that comes with responsibilities.

Rob Monster, any news today? Still lots of essential questions remain unanswered.
 
3
•••
It's not a fallacy, its a fact that some people here like to see Epik shutdown and go out of business,

At least that's the impression that I have gotten from some of the posts on this thread so far.

As I have said on several occasions it might very well end up that way if Epik is unwilling or unable to rebrand with a whole new mindset, strategy, goal, and platform, but unlike some people here I am going to reserve all judgments until I see what steps are going to be taken to improve Epik.

IMO
It's not a fallacy, its a fact that some people here like to see Epik shutdown and go out of business,

At least that's the impression that I have gotten from some of the posts on this thread so far.

As I have said on several occasions it might very well end up that way if Epik is unwilling or unable to rebrand with a whole new mindset, strategy, goal, and platform, but unlike some people here I am going to reserve all judgments until I see what steps are going to be taken to improve Epik.

IMO

We are talking about the breach and waiting for information from Rob and you keep posting the nonsense things like:how can you do to improve Epik and get Epik out of the hole, the environment, etc...

It's not your job to do that. Read the topic and get back to the discussion. No one would understand any of your posts.
 
4
•••
It's not a fallacy, its a fact that some people here like to see Epik shutdown and go out of business,

At least that's the impression that I have gotten from some of the posts on this thread so far.

As I have said on several occasions it might very well end up that way if Epik is unwilling or unable to rebrand with a whole new mindset, strategy, goal, and platform, but unlike some people here I am going to reserve all judgments until I see what steps are going to be taken to improve Epik.

IMO

It is a fallacy because no one has stated that. How is it a fact?? People have stated their frustrations with regards to false statements, abuses, and lack of answers to valid questions. How do you take that as them wishing to shut E down. Any shutdown of E will land only on the hands of E.
 
Last edited:
4
•••
Too many posts to look through, so sorry if this has been covered. Someone apparently tried to log into my account, as I received a message with my 2 factor authentication code. They would have had to enter my account login and password to generate the code. Unless it was a system error, they likely got the info from the breach. I can't say that for sure, but I am extremely careful with my accounts.
 
4
•••
An issue with using out-of-the-box "latest binaries", such as Apache/Nginx, is that developers do not understand how pentesters/attackers perform remote code execution on vulnerable services, and will most likely have no IDS/ebpf logs in place, or post-attack mitigation other than "just keep upgrading the software".

This is an example of a 9.8 CVE rating exploit that can be used to gain access to the server that was leaked. I posted this with the permission of Bravo/Paul.

MkT8hhb.png


The reason: Developers that write in a scripting language such as PHP, have no idea where malloc is being called under the hood, where an insecure x86 subroutine is MOV'in data without boundary checks, stackguards, overwriting the EIP address, or just even a dangling pointer being dereferenced.

It's not so much the work of "cybersecurity teams", but rather engineers and not developers, maintaining and auditing a codebase that's not writen on interpreted code impossible to gdb inspect/trace, and is not jit-running on php-fpm behind precompiled software stack.

I will be concern that this issue won't get addressed in the short term. Unless engineers are hired and begin hardening the code, it feels like the underlying Zend C code that runs under PHP will remain the same.
 
Last edited:
9
•••
Catching up here. Quick update.

On the tech and development side, the team continues to make very strong progress. As mentioned, the non-core upstream developments have largely been put in hold in order to focus on the core. The "Office of the CTO" is already in operation with a decentralized A-team, and I am not part of it.

On the domain management side, a "Domain Core Team" has been formed and is comprised of industry veterans Sufyan Alani, May Chen, Sevan Derderian, Anthony Kirlew and Jessica Robison. This is a team of diligent individuals is working well together. No politics. Just results.

On the topic of governance, I am currently the sole Board Director as well as the major shareholder. I am hopeful that we'll see a "Unicorn" grade Board emerge soon. For example, earlier today, I interviewed a retired US Major General with a deep background in security, including cybersecurity.

As for other unanswered comments, in no particular order:

- A legacy URL for triggering SMS codes was disabled on Monday. It was not part of the live SSO but was away to spam people with SMS codes. That was promptly removed. There was no account compromise related to the legacy SMS spam as Epik had moved to Federated Identity in January 2021.

- Joey Camp did receive his notice and his deadline did pass at noon today. As of this evening, I am not aware of any live sites powered by Epik that are outside of our TOS.

- Daily transfers in continue to outpace transfers out many times over. This pattern has been steady and domains under management continues to rise. The folks who are crying wolf are not doing anyone a great service at this point but they keep this thread active so God bless 'em.

- The escrow business is doing just fine. So far today no less than 5 transactions started with transaction sizes above $100K each. With crypto booming, much of this is crypto-related. As far as I know, Epik is the only registrar-escrow that is also integrated as a licensed crypto exchange.

- As mentioned, Epik has completed about a dozen acquisitions in the last 3 years. For strategic reasons, not all of them get announced. We do talk to a lot of folks. When we say no to a deal, it is often due to bad cultural fit, e.g. a Dutch company that has gone on to become stronger after some transitional assistance.

- I don't actually recall having any M&A discussion with Derek. If any such discussion occurred, it would have been very preliminary. In general, we don't do a lot of partnerships. We either build or we acquire. In the case of Derek, it is safe to say that there would not have been a cultural fit.

- There will be no re-brand of Epik.com. The Epik brand continues to be healthy. Brand awareness is higher than ever. Our product and service are good and improving. We don't need to be everyone's cup of tea to have a sustainable enterprise. I was encouraged by this poll today:


Looks like the trolls have 8 hours to stuff the ballot:
upload_2021-10-15_19-52-21.png

If you still like Epik, you are definitely not alone despite the determined efforts of the vocal trolls who are running a "struggle session" on this forum for reasons that I could speculate about, but won't!

#BeEpik
 
8
•••
- Joey Camp did receive his notice and his deadline did pass at noon today. As of this evening, I am not aware of any live sites powered by Epik that are outside of our TOS.

Did you look? Because the .org site I mentioned in my previous message is still online and serving the same doxing and harassing content, and whois still shows Epik as the registrar. I will direct message you the URL just for absolute clarity, though I was very clear, and it was included in an abuse report as well.

Furthermore, does this mean that Mr. Camp will continue to be an Epik customer? I assume so, given the number of his domains I am still seeing with Epik listed as the registrar. What happens when he puts this type of content back on the domains you are still servicing? Who is responsible for monitoring to see that he doesn't do that, the victims of his harassment?
 
Last edited:
6
•••
Catching up here. Quick update.

On the tech and development side, the team continues to make very strong progress. As mentioned, the non-core upstream developments have largely been put in hold in order to focus on the core. The "Office of the CTO" is already in operation with a decentralized A-team, and I am not part of it.

On the domain management side, a "Domain Core Team" has been formed and is comprised of industry veterans Sufyan Alani, May Chen, Sevan Derderian, Anthony Kirlew and Jessica Robison. This is a team of diligent individuals is working well together. No politics. Just results.

On the topic of governance, I am currently the sole Board Director as well as the major shareholder. I am hopeful that we'll see a "Unicorn" grade Board emerge soon. For example, earlier today, I interviewed a retired US Major General with a deep background in security, including cybersecurity.

As for other unanswered comments, in no particular order:

- A legacy URL for triggering SMS codes was disabled on Monday. It was not part of the live SSO but was away to spam people with SMS codes. That was promptly removed. There was no account compromise related to the legacy SMS spam as Epik had moved to Federated Identity in January 2021.

- Joey Camp did receive his notice and his deadline did pass at noon today. As of this evening, I am not aware of any live sites powered by Epik that are outside of our TOS.

- Daily transfers in continue to outpace transfers out many times over. This pattern has been steady and domains under management continues to rise. The folks who are crying wolf are not doing anyone a great service at this point but they keep this thread active so God bless 'em.

- The escrow business is doing just fine. So far today no less than 5 transactions started with transaction sizes above $100K each. With crypto booming, much of this is crypto-related. As far as I know, Epik is the only registrar-escrow that is also integrated as a licensed crypto exchange.

- As mentioned, Epik has completed about a dozen acquisitions in the last 3 years. For strategic reasons, not all of them get announced. We do talk to a lot of folks. When we say no to a deal, it is often due to bad cultural fit, e.g. a Dutch company that has gone on to become stronger after some transitional assistance.

- I don't actually recall having any M&A discussion with Derek. If any such discussion occurred, it would have been very preliminary. In general, we don't do a lot of partnerships. We either build or we acquire. In the case of Derek, it is safe to say that there would not have been a cultural fit.

- There will be no re-brand of Epik.com. The Epik brand continues to be healthy. Brand awareness is higher than ever. Our product and service are good and improving. We don't need to be everyone's cup of tea to have a sustainable enterprise. I was encouraged by this poll today:


Looks like the trolls have 8 hours to stuff the ballot:
Show attachment 202006
If you still like Epik, you are definitely not alone despite the determined efforts of the vocal trolls who are running a "struggle session" on this forum for reasons that I could speculate about, but won't!

#BeEpik

I would love to see more updates on how you got into the situation in the first place, with terrible security protocols built on decade old "shitty Russian code".

I am guessing the following is the primary reason -

On the topic of governance, I am currently the sole Board Director as well as the major shareholder.

It is rather clear at this point that Epik did not have the technical ability onboard when it came to security. If they did, then the alternative is even worse - they had the ability, but just didn't do anything about it.

You clearly had no business ever being the "acting CTO" or whatever you claimed to be.

Oh, and that poll is about as legitimate as your 2020 mid-year NamePros Registrar of the Year win.

Brad
 
Last edited:
2
•••
despite the determined efforts of the vocal trolls who are running a "struggle session" on this forum for reasons that I could speculate about, but won't!

- deny that you suffered a data breach despite everyone having downloaded your data

- start a harassment and defamation campaign against journalists who report on the data breach

- hold a prayer meeting talking a lot of nonsense about cursed data

- wonder what ulterior motive made all these people interested in me and my company
 
Last edited:
4
•••
There will be no re-brand of Epik.com. The Epik brand continues to be healthy. Brand awareness is higher than ever. Our product and service are good and improving. We don't need to be everyone's cup of tea to have a sustainable enterprise. I was encouraged by this poll today:

If you still like Epik, you are definitely not alone despite the determined efforts of the vocal trolls who are running a "struggle session" on this forum for reasons that I could speculate about, but won't!

#BeEpik

That's great! Too bad your customers (and non customers) are dealing with the fallout from your shitty security.

Here is an example from your poll tweet -


As someone who likes to quote proverbs, I am going to give you a free one -
"Pride comes before the fall."
 
Last edited:
2
•••
- deny that you suffered a data breach despite everyone having downloaded your data

- start a harassment and defamation campaign against journalists who report on the data breach

- hold a prayer meeting talking a lot of nonsense about cursed data

- wonder what ulterior motive made all these people interested in me and my company

Remember when Rob Monster sent transparent legal threats to Paul about the content in this thread?

After that didn't work it seems like he has just adopted ignore, blame, deflect with a dash of just being a general narcissistic troll mixed in.

Throw in a little playing the victim as well. Epik was using "shitty Russian code", suffered a major hack based on their terrible security protocols, then have the audacity to say they are facing a "struggle session" when being called out on those facts.

Brad
 
Last edited:
4
•••
Catching up here. Quick update.

On the tech and development side, the team continues to make very strong progress. As mentioned, the non-core upstream developments have largely been put in hold in order to focus on the core. The "Office of the CTO" is already in operation with a decentralized A-team, and I am not part of it.

On the domain management side, a "Domain Core Team" has been formed and is comprised of industry veterans Sufyan Alani, May Chen, Sevan Derderian, Anthony Kirlew and Jessica Robison. This is a team of diligent individuals is working well together. No politics. Just results.

On the topic of governance, I am currently the sole Board Director as well as the major shareholder. I am hopeful that we'll see a "Unicorn" grade Board emerge soon. For example, earlier today, I interviewed a retired US Major General with a deep background in security, including cybersecurity.

As for other unanswered comments, in no particular order:

- A legacy URL for triggering SMS codes was disabled on Monday. It was not part of the live SSO but was away to spam people with SMS codes. That was promptly removed. There was no account compromise related to the legacy SMS spam as Epik had moved to Federated Identity in January 2021.

- Joey Camp did receive his notice and his deadline did pass at noon today. As of this evening, I am not aware of any live sites powered by Epik that are outside of our TOS.

- Daily transfers in continue to outpace transfers out many times over. This pattern has been steady and domains under management continues to rise. The folks who are crying wolf are not doing anyone a great service at this point but they keep this thread active so God bless 'em.

- The escrow business is doing just fine. So far today no less than 5 transactions started with transaction sizes above $100K each. With crypto booming, much of this is crypto-related. As far as I know, Epik is the only registrar-escrow that is also integrated as a licensed crypto exchange.

- As mentioned, Epik has completed about a dozen acquisitions in the last 3 years. For strategic reasons, not all of them get announced. We do talk to a lot of folks. When we say no to a deal, it is often due to bad cultural fit, e.g. a Dutch company that has gone on to become stronger after some transitional assistance.

- I don't actually recall having any M&A discussion with Derek. If any such discussion occurred, it would have been very preliminary. In general, we don't do a lot of partnerships. We either build or we acquire. In the case of Derek, it is safe to say that there would not have been a cultural fit.

- There will be no re-brand of Epik.com. The Epik brand continues to be healthy. Brand awareness is higher than ever. Our product and service are good and improving. We don't need to be everyone's cup of tea to have a sustainable enterprise. I was encouraged by this poll today:


Looks like the trolls have 8 hours to stuff the ballot:
Show attachment 202006
If you still like Epik, you are definitely not alone despite the determined efforts of the vocal trolls who are running a "struggle session" on this forum for reasons that I could speculate about, but won't!

#BeEpik

Glad to hear things are going good.
 
3
•••
Back