alert Epik Had A Major Breach

[DaveX]

Just read this. Looks like Epik may have been hacked and sensitive data compromised...

Read here:
https://domainnamewire.com/2021/09/14/hackers-claim-significant-epik-breach/

Thought I would share this.

 

[Future Sensors]

• Make sure passwords and security codes are in fact secure.

• Make sure you have access to your own codebase.

 

[shoulda9393]

There are a number of entities which keep track of registrars which have a disproportionate incidence of things in which the entity has an interest. Without either endorsing or criticizing any particular of these "watchdog" type outfits, you can find registrar rankings by, say LegitScript in relation to what they perceive as rogue pharmacies, Spamhaus keeps a "top ten" list of registrars that are used by spammers:

etc.. Spamhaus uses a "badness index" that is normalized to domains under management. Certainly, if you are doing numeric compilations, you would expect GoDaddy to have the highest raw score of (insert "bad thing" here). But if GoDaddy has 10 "bad thing" names to Registrar X's 1 "bad thing" name, but GoDaddy has 100 more domains than Registrar X, then Registrar X has a higher incidence of that "bad thing".

Everyone in the industry keeps something of a running ledger of "what domain registrars are most likely to be utilized by domain thieves". I personally have noticed that I get regular SMS phishing messages using .info domain names which follow a pattern and are remarkably and consistently registered with one registrar.

Over the long term, if a registrar is attracting a disproportionate share of pathological customers, then there can be instability issues. One notorious registrar was disaccredited by ICANN a while back (they may be still arguing in court after a default), so, to any legitimate customers of theirs were adversely impacted by the large volume of abuse upon which they didn't act. But those also involve narrowly defined consensus categories of abuse.

So, registrar responsiveness to certain types of abusive registrants, as ranked by whomever you might trust on things like spam, phishing, child abuse imagery, etc., is worth taking into account in selecting a registrar.

Spam, phishing, CP etc is not what I meant by 'content'.

By 'content' I meant what Epik is debated over, ie the controversially political customers it has as some customers or 'watchdogs'.

You spend a lot of time nitpicking my statements about things this thread isn't even about.

 

[shoulda9393]

True. But if a registrar is also a host and a problematic site is drawn to their attention that is against their TOS then it would be expected that actions would be taken.



This is very different from a registrar who is actively courting, seeking, and promoting ideals of such sites and players. Epik has made it a business model.



This is especially true when it comes to shared hosting. If customers sharing the same server space who are on the same IP range where sites are put on black lists will be effected in detrimental ways. The reputation of customers who are operating in bad faith can impact those that are unrelated simply by being in close proximity. So if an IP is flagged because of someone else's actions, and you happen to share the same IP then you are screwed.

I don't really see why it matters if a registrar is courting political extremism when the same is already allowed on major registrars, and the sites would have existed without Epik.

If the sites would have existed anyway, why does it matter if Epik is the one giving them a name rather than Tucows?

Fortunately, no one is going to turn the internet in a big space where everyone agrees on everything. People have to allow dissenting (legal) speech to be able to express their own.

If a person gets bumped off Epik they have plenty of options to go to, although it is inconvenient being bumped off a registrar.

 

[Future Sensors]

far-left customers it has

Can you name some of these customers?

 

[shoulda9393]

Can you name some of these customers?

I have them in my DMs. And yes there were (many) more far-rightists than far-leftists using the registrar. But why exactly would I tell people who they are when this thread is about a data leak and such people are concerned about their personal info.

Oh right cuz this thread isn't about that, it's about all these personal vendettas people have.

To be honest though, Njalla and PRQ is better than Epik for (most) far-left content.

 

[shoulda9393]

Anyway, the whole narrative of Epik allowing sites that wouldn't exist elsewhere, or 'enabling' them is 100% bunk. They can and do exist without Epik. That narrative is like 3 years old now, and this thread is about 3 year old drama. The rogue sites that can't exist anywhere are at vanwatech, not Epik.

Epik let go of many legal sites that activists wanted to take down over the years. Albeit it took a lot of effort, registrars aren't and shouldn't be in the position to police content. I don't count spam and phishing as content, and neither do the wholesalers.

People can bump this thread 10000 times and post on twitter 10000 times until Gab/infowars/etc feels the need to move off Epik. But then they'd move to DirectNic, Eranet, Nicenic, Vanwatech, Tucows, Russian registrars, or Enom. This would just be the first in like 10 whack-a-moles, and it's taken people like 4 years to get to this point where they are struggle sessioning Epik without much pushback. (that analogy from Rob was apt despite my issues with my info being breached). So it'd take like 20 years if they wanted to do the same to the rest of the registrars, and at that point there'd be more companies popping up.

If people have major concerns about 'enabling' extremist content, they should look at reforming section 230 rather than going after the nuts and bolts of the internet. We can have a functioning internet with a reasoanbly changed section 230 that keeps website admins from harbouring or even sockpuppeting as illegal terrorists. But it's hard to have a functioning internet long term when people using domain registrars as blanket content policers...

 

[Future Sensors]

This is from the Epik.com TOS:

Further, You may not use the Site or the Services provided through or in connection with the Site to: (a) defame, abuse, harass, threaten or otherwise violate the legal rights (such as rights of privacy and publicity) of others;​

 

[shoulda9393]

This is from the Epik.com TOS:

Further, You may not use the Site or the Services provided through or in connection with the Site to: (a) defame, abuse, harass, threaten or otherwise violate the legal rights (such as rights of privacy and publicity) of others;​

All of those are crimes. If someone is doing a crime, and better yet if you know their name, that's what the authorities are for. If Epik isnt' abiding by their ToS, that's bad (I don't know), but that's not an excuse for people (not yourself but at least one other person in this thread), to wantonly hack or leak the personal info of thousands of law abiding customers. Many non-political people used the registrar, and this thread is about the breach, not ToS violations.

 

[Future Sensors]

@shoulda9393 Okay, can you tell more about the breach then?

 

[shoulda9393]

@shoulda9393 Okay, can you tell more about the breach then?

I wish I knew, because my personal info was in it, and that was a crime against me and thousands of others, including thousands of non-political people.

 

[shoulda9393]

Thanks, I guess this thread is not for you, after all. Nice to have been in touch, in any case.

Nope, this thread is best suited for the thousands of innocent domainers who had a crime commited against them by leaking their personal info, myself included.

As much as people want to make the breach about 1-2 z-list e-celebs and culture warriors who spread misinfo about Epik, that is not what this thread is about.

Anyway, yes good day and I hope you find whatever you are looking for in the thread. But I'd prefer some legal justice for the thousands of domain owners who had passwords, usernames, failed passwords, home addresses, EPP codes, email addresses, and phone numbers illegally leaked, for political reasons it appears, in some way or fashion. There's a lot of non-political people who used the service, but their info was also irresponsibly leaked, by these overzealous culture warriors.

People expect privacy when registering domain names, and breaches like this are massively illegal to thousands of people.

 

[DN Playbook]

I don't really see why it matters if a registrar is courting political extremism when the same is already allowed on major registrars, and the sites would have existed without Epik.

If the sites would have existed anyway, why does it matter if Epik is the one giving them a name rather than Tucows?

Registrars/hosts can have views that don't sit well with many of their customers. However, it is much different when they publicize, impose, and even use those views publicly to attract certain type of clientele. It is a well known fact that was reported on by many media outlets that Epik took on extreme websites and domains that were deplatformed by other registrars due to the extremist content. In fact, RM even operates a social media site that is a pot for hate speech, prejudice and hostility toward minorities, and other extreme views. This is what makes Epik stand apart from these other registrars. They have a reputation.

 

[DN Playbook]

I am getting more and more notifications that my accounts have been compromised.

 

[Windoms]

I am getting more and more notifications that my accounts have been compromised.

Blame the swiss bank of privacy and security.

Man boasts about privacy and security, thats dangerous territory.
Knows he's got cheap security, thats lame.
Sees GAB opportunity to make lemonade, instantly jumps on the wagon.
Claims protection of free speech, wages war and protects deviants like nazis to gain momentum, OK, thats intelligent.
Take into account he's got weak security, thats dumb. Disconnected from reality.
Literally gambling and trying lemonade in order to win while putting people's lives at stake.
Criminal behaviour.
And he doesnt give a single f*ck.

 

[Derek Peterson]

I think this articulation from Derek is the best I have seen in terms of understanding his mindset.

It is probably a bit apparent that I don’t like Derek. And yet I can still love him. Similarly, I don’t like Joey Camp, Aubrey Cottle, Chad Loder, or Molly White. And yet I can still love them and I can hold an optimistic view about them. The act of sending Aubrey $444 had nothing to do with what he did, but rather it has to do with who he is: a child of the most high God. When a colleague shared the GoFundMe story, it just seemed like the obvious thing to do. After all, love conquers all. Wise as serpents. Harmless as doves.

Today's Sunday message is on "LOVE".

-Love does not lie about the security of a website and expose thousands of people's personal data to criminals and tyrants all over the world.
- Love does not cancel people on an emotional whim.
- Love does not try to silence those who tell the truth.
- Love does not defame those who tell the truth.
- Love does not threaten to sue those who tell the truth.
- Love does not try to humiliate others over personal relationship and financial struggles.
- Love does not hire people to harass and intimidate others because you didn't like what they wrote on the internet about you.

Anyway, my point is that Rob Monster is one of the most disingenuous and dishonest people I have ever encountered. He has literally done everything he can do legally and illegally to silence those you have exposed his lies short of hiring a hit man and I'm sure that has crossed his mind. I honestly can't tell if he believes the things he says and is just completely disconnected from reality or just doing it all as some kind of a troll but in any case the fact of the matter is that he has done all those things and much more. The notion that he will ever take responsibility for all his lies and the damage he has done is just naive and so is the notion that he will ever change his ways unless he is put in a box.

 

[Evil.dll]

This incident creates many future vulnerabilities across any internet accounts you may have. Attacks that may follow this will begin with simple credential stuffing attacks where known passwords may be used across different platforms. Then once all the data is parsed and put into a more readable format (It was pretty readable to begin with and is already in a format most could find useful) all information that is tied to you could be used to build unique wordlists that may escalate into dictionary attacks against your passwords for any site, and you maybe asking yourself well how easy is it to find all the accounts that maybe are linked to let’s say a unique username (15 seconds using a simple python tool) and with a dictionary attack how long would it take to crack my password (15-30 seconds depending on the computer cracking it and the strength of the wordlist) and the answer to that really depends on the person attempting to access the information (Is it a skid trying to sell 35,000 social security numbers to a fed and doxx people at the behest of “billionaire” investors or is it a a real hacker) and how motivated they are to attacking you. Some of you may see nothing and if you simply exercise digital hygiene and change your passwords to something that has more than 12 unique characters and enable at least two factor authentication on your online accounts, that could be the end of this breach for you except for the phishing attempts every one should be watching out for anyway. Some of you may not be so lucky and you may be under constant attack based on your world views, your human decency, and how you treat people you don’t like, for those people, the answer is not so simple. This is just an opinion… Take it with a grain of salt, or don’t.

 

[DN Playbook]

 

[Evil.dll]

When passwords are stored they are usually salted, where the password gets additionally encrypted, so in the event of a breach they require more time and processing to see the plaintext password. Even a salted password can be cracked easily with an optimized GPU. Passwords that are stored in plaintext are like leaving your front door open with a sign that says “Steal my shit”. Credit Card info that is stored without salting the md5 hash is like dropping cash on the ground and expecting it not to be picked up. Security is the theatre of risk management and its effectiveness boils down to the actors involved. Shitty actors lead to shitty productions.

 

[Evil.dll]

Companies should get well acquainted with the BAD model. B is for build a well engineered system as a foundation for your platform. A is for attack as in pay a team to attack your platform. D is for defend by using the knowledge gained from finding the vulnerabilities in your own system proactively and following best practices to mitigate potential threats. Always be attacking your own security. If your platform is new or rebuilt from scratch pay an external purple team to ensure synergy between your red and blue teams. Believe it or not I am not just pulling this stuff out of my ass. These terms should be known and employed by your organization, what you save from not employing or understanding these practices may make your investors happy, but the potential losses from not educating yourself on these basic fundamentals will cost you time, money and stress in the long run.

 

[Future Sensors]

Companies should get well acquainted with the BAD model. B is for build a well engineered system as a foundation for your platform. A is for attack as in pay a team to attack your platform. D is for defend by using the knowledge gained from finding the vulnerabilities in your own system proactively and following best practices to mitigate potential threats. Always be attacking your own security. If your platform is new or rebuilt from scratch pay an external purple team to ensure synergy between your red and blue teams. Believe it or not I am not just pulling this stuff out of my ass. These terms should be known and employed by your organization, what you save from not employing or understanding these practices may make your investors happy, but the potential losses from not educating yourself on these basic fundamentals will cost you time, money and stress in the long run.

I personally enjoy the security knowledge you share. We can argue about small details about algorithms being strong or weak, but the situation at Epik personally gave me salty tears.

If Epik had formed a competent Red Team immediately after the acquisition in 2011, the company could have gained access to the code much earlier. But hey, never underestimate the capabilities of the Blue Team of a foreign party who completely managed the codebase.

Thanks again.