alert Epik Had A Major Breach

[DaveX]

Just read this. Looks like Epik may have been hacked and sensitive data compromised...

Read here:
https://domainnamewire.com/2021/09/14/hackers-claim-significant-epik-breach/

Thought I would share this.

 

[Future Sensors]

One of the big ? to me is, whether the foreign development team who used to maintain and protect the codebase from RM's prying eyes, is now working together with external security talent to fix their shortcomings.

 

[bmugford]

One of the big ? to me is, whether the foreign development team who used to maintain and protect the codebase from RM's prying eyes, is now working together with external security talent to fix their shortcomings.

Another question I have is how many talented people are even willing to work with RM and Epik?

How many people wanted to be associated with Epik before this, never mind after the data breach?

Their actions are going to really limit the potential talent pool.

Brad

 

[Future Sensors]

Another question I have is how many talented people are even willing to work with RM and Epik?

How many people wanted to be associated with Epik before this, never mind after the data breach?

Their actions are going to really limit the potential talent pool.

Brad

One would reasonably expect that, but Epik has always been able to surprise with new lab initiatives. Curious to see what's brewing this time. How will the 32MM be spent? On marketing, devops, politics, lawyers, bunkers, or a Russian language course for all employees?

 

[johnjhacking]

Another question I have is how many talented people are even willing to work with RM and Epik?

How many people wanted to be associated with Epik before this, never mind after the data breach?

Their actions are going to really limit the potential talent pool.

Brad

I'm going to have to agree. They are the laughing stock of the Information Security industry right now. No one wants to work infosec for a company that doesn't take it seriously.

 

[Future Sensors]

I'm going to have to agree. They are the laughing stock of the Information Security industry right now. No one wants to work infosec for a company that doesn't take it seriously.

Is this even discussed outside this forum, you mean? That's disturbing.

 

[jmcc]

One of the big ? to me is, whether the foreign development team who used to maintain and protect the codebase from RM's prying eyes, is now working together with external security talent to fix their shortcomings.

It sounds like development by accretion where layers of code are built upon layers of code. It can be quite deadly from a security point of view. Ironically, it is now getting a free security audit.

Regards...jmcc

 

[Kirtaner]

Is this even discussed outside this forum, you mean? That's disturbing.

Epik is the joke of the Internet at large.

 

[Kirtaner]

https://www.nytimes.com/2021/10/21/technology/trump-truth-social-hackers.html
https://archive.md/UVbmm

Hackers lay claim to Donald Trump’s social app before its launch.

Within two hours, hackers had gained access to a private version of the social network, creating fake accounts for Mr. Trump; the far-right personality Stephen K. Bannon; Ron Watkins, the QAnon conspiracy theorist; and Twitter’s chief executive, Jack Dorsey, who barred Mr. Trump from Twitter after his supporters stormed the Capitol on Jan. 6.

Using a false “donaldjtrump” account, hackers posted images of defecating pigs, wrote expletive-laced rants aimed at Mr. Dorsey and inquired about the whereabouts of the former first lady Melania Trump. Images of the hackers’ handiwork were circulated on other social media platforms.

In interviews on Thursday, the hackers, who are affiliated with Anonymous, the loose hacking collective, said the effort was part of their “online war against hate.”

After a several-year hiatus, Anonymous has re-emerged as a digital force against the far right. The collective recently took down a Texas Republican website after the passage of an anti-abortion bill, replacing the site with a Planned Parenthood fund-raiser. And last month, Anonymous was behind a breach of Epik, an internet services company popular with the far right, dumping 220 gigabytes of data, including personal details of its customers.

In exposing the innards of Truth Social ahead of its launch, hackers demonstrated that Mr. Trump’s soon-to-be-released social network had lax safeguards and left open the ability to spoof anyone, including the former president.

Mr. Trump had revealed the social network in an online presentation on Wednesday as part of Trump Media and Technology Group, which aims to take on big social media platforms.

A representative for the Trump media company did not immediately respond to requests for comment.

“We had a fun time trolling it to high heaven,” Aubrey Cottle, a hacker affiliated with Anonymous who goes by the alias Kirtaner, said in an interview.

A Truth Social app was made available for “preorder” on Apple’s App Store on Wednesday, inviting anyone interested to join a waiting list for its release. The digital crumbs from that post, Mr. Cottle said, were enough for him and other Anonymous hackers to gain access to the prerelease version of the app.

Once inside, Mr. Cottle said, hackers posted memes from spoofed accounts for Mr. Trump, former Vice President Mike Pence and other prominent figures.

The activity forced the Trump Media & Technology Group’s app developers to bar new accounts and eventually shutter the development platform. (The New York Times viewed screenshots backing up hackers’ claims.)

 

[Future Sensors]

Thanks. Epik has been in that newspaper before. That has been an important reason for them co-facilitating alternative media, with varying degrees of success.

 

[Kirtaner]

https://www.nytimes.com/2021/10/21/technology/trump-truth-social-hackers.html
https://archive.md/UVbmm

Hackers lay claim to Donald Trump’s social app before its launch.

Within two hours, hackers had gained access to a private version of the social network, creating fake accounts for Mr. Trump; the far-right personality Stephen K. Bannon; Ron Watkins, the QAnon conspiracy theorist; and Twitter’s chief executive, Jack Dorsey, who barred Mr. Trump from Twitter after his supporters stormed the Capitol on Jan. 6.

Using a false “donaldjtrump” account, hackers posted images of defecating pigs, wrote expletive-laced rants aimed at Mr. Dorsey and inquired about the whereabouts of the former first lady Melania Trump. Images of the hackers’ handiwork were circulated on other social media platforms.

In interviews on Thursday, the hackers, who are affiliated with Anonymous, the loose hacking collective, said the effort was part of their “online war against hate.”

After a several-year hiatus, Anonymous has re-emerged as a digital force against the far right. The collective recently took down a Texas Republican website after the passage of an anti-abortion bill, replacing the site with a Planned Parenthood fund-raiser. And last month, Anonymous was behind a breach of Epik, an internet services company popular with the far right, dumping 220 gigabytes of data, including personal details of its customers.

In exposing the innards of Truth Social ahead of its launch, hackers demonstrated that Mr. Trump’s soon-to-be-released social network had lax safeguards and left open the ability to spoof anyone, including the former president.

Mr. Trump had revealed the social network in an online presentation on Wednesday as part of Trump Media and Technology Group, which aims to take on big social media platforms.

A representative for the Trump media company did not immediately respond to requests for comment.

“We had a fun time trolling it to high heaven,” Aubrey Cottle, a hacker affiliated with Anonymous who goes by the alias Kirtaner, said in an interview.

A Truth Social app was made available for “preorder” on Apple’s App Store on Wednesday, inviting anyone interested to join a waiting list for its release. The digital crumbs from that post, Mr. Cottle said, were enough for him and other Anonymous hackers to gain access to the prerelease version of the app.

Once inside, Mr. Cottle said, hackers posted memes from spoofed accounts for Mr. Trump, former Vice President Mike Pence and other prominent figures.

The activity forced the Trump Media & Technology Group’s app developers to bar new accounts and eventually shutter the development platform. (The New York Times viewed screenshots backing up hackers’ claims.)

I think it would behoove some here to understand some things about me at this point.

https://techmonitor.ai/technology/cybersecurity/the-return-of-hacktivists

The return of the hacktivists

Epik was the ‘Swiss Bank’ of domain registration services, according to its founder Rob Monster. Privacy was an organising principle, he said. Unlike other domain providers, Epik would afford its users a safe haven to freely express themselves on the websites they registered with the company without intervention. This was the responsible thing to do, according to Monster (his real name), amid a “continuing, coordinated and perhaps accelerating theme of censorship” afflicting the domain registration ecosystem.

But all this was a smokescreen, critics argued. The only safe haven Epik provided was for the alt-right, they said, servicing domains from which extremists could freely spout racial hatred and coordinate vicious trolling campaigns.

The scale of the alt-right’s presence on Epik’s domains was revealed earlier this month after Anonymous-affiliated hackers breached its servers and published over 220GB of user data in two tranches. The leaks contained not only the domains belonging to alt-right figures, but their real names, credit card numbers, home addresses, and Epik email chains discussing FBI subpoenas against customers (“DO NOT TELL the registrant,” read one.)

Epik’s fate is especially sweet for Aubrey Cottle, a security researcher and a founding member of Anonymous. While subsequent analysis has shown that much of the exposed data was mundane and unrelated to Epik, the leak has nonetheless been described as a ‘Rosetta stone’ for researchers eager to understand the internal machinations of the far-right. For Cottle – who prefers to be known by his hacker nom de guerre, ‘Kirtaner’ – it’s the first step in dismantling what he calls the “sources of hate” that have afflicted the web over the past decade (he declines to give details about those involved in the hack.) “The last handful of years have been pretty rough as far as the far-right [goes],” he says. “There’s a major pushback, as people are getting sick and tired of it.”

The Epik hack is just the latest manifestation of a new wave of so-called ‘hacktivism’ that’s not only targeting the alt-right. From the breach at video security start-up Verdaka, in which hackers took control of 150,000 cameras in hospitals, police stations and schools, to the ongoing campaign against the dictatorial Lukashenko regime by the Belarus Cyber Partisans and similar efforts among pro-democracy groups in Myanmar, activists are once again using hacking as a form of protest.

This level of hacktivism has not been seen since the glory days of Anonymous and Wikileaks, when hacktivists around the world lent their services to the Arab Spring, undermined the Church of Scientology’s online presence and leaked thousands of US diplomatic cables and war logs.

Kirtaner himself is a thread of continuity between that time and now. Having lain low for several years after a series of arrests ended Anonymous’s first era, the security researcher revealed his role in its creation last year before embarking on his own campaign against conspiracist movement Q-Anon. Aside from his disgust at the movement’s role in inspiring mass shootings and other crimes, Kirtaner is also motivated by a sense of personal regret at the line that can be traced from Anonymous’ early trolling phase to Gamergate, alt-right extremism and the rise of Donald Trump.

“That is a very long and complicated story,” he says. “By virtue of the butterfly effect, I’ve always felt a ream of responsibility, personal responsibility, for the state of the current world. And I felt I needed to do something about it, if only to [put] my own soul at ease.”

Kirtaner aside, the current wave of hacktivism is propelled by a new generation, politicised by the rise of the alt-right and the Black Lives Matter movement. But while the political environment may have changed, the legal context has not. The cybersecurity laws that enabled the crackdown on Anonymous and enabled those arrests remain in place, and it remains to be seen if the current generation will avoid the same fate.

 

[Jona4s]

I will argue hackers are immune to patches submitted via bug bounty programs.

It discourages script kiddies and botnet scanners hammering an origin, but application-level vulnerabilities are rarely the cause of an entire system being rooted, as it was with Epik.

As jonh said, it is a matter of competent engineers and security experts.

Btw, thanks Rob for offering me a bounty, which I won't take. Unless you start taking security seriously by announcing you have rebuild your entire codebase, and are not relying on "remote PHP developers" to power Epik, I honestly think you are doomed.

Apologize to their customers, transfer them to a different company, shut down completely, and rebuild. Or just shut down.

There are no other options for them.

That is my professional opinion.

Kirt gave you an honest advise, listen to the part "rebuild". A broken technology is a broken technology, no patch and no team will fix it.

This stuff means Epik is persisting in using remote PHP devs, Zend cannot be patched, but well time will tell if your technical debt is really irreversible.

https://twitter.com/x/status/1451501873991651331

PHP, Wordpress, alright. That's not how you play the game, that's why you are losing.

 

[johnjhacking]

Is this even discussed outside this forum, you mean? That's disturbing.

Yes. I've watched the infosec community rip on Epik.

 

[johnjhacking]

Uhhhh what? Application-level vulnerabilities make up a giant percentage data breaches. I can't send links, so google "How many web apps get breached" -- you'll see a varying percentage, but it's not a small number. Infact, most of the networks I've breached have been a result of vulnerabilities i've found on the client side of web applications.
@Jona4s

 

[Jona4s]

Yeah, I was refering to more secure networks, and not Internet-facing services based on cve tracked stacks.

Such as a bank with propietary protocols over layer-2, with no "application-level" to exploit.

It's rare to see credit cards stored in the same server as the application server.

I'm sure you can MITM'in your way into internal endpoints, but those services are not public-facing so cve vulnerabilities will not apply.

 

[Future Sensors]

I think you should set up security in such a way that you don't trust anyone within your own organization. A sort of Zero Trust, as it were. Especially in an organization like Epik, that seems to be a chain of takeovers, remote workers and third parties that develop software. Furthermore, I think all CVEs are important, including those that concern non-Internet facing systems. Usually they are used in combination to gain, consolidate and perpetuate access within a network.

 

[Future Sensors]

And for your crown jewels, always use the five eyes principle.

 

[Kirtaner]

And for your crown jewels, always use the five eyes principle.

FVEY???? WHERE

 

[Future Sensors]

FVEY???? WHERE

Caps.

 

[Jona4s]

I wonder who is going to use MaxMind now that their risk score factors were exposed in plaintext

 

[Evil.dll]

Time to take a Mulligan. Pay competent engineers to build a solid foundation from scratch, pay a real red team to attack that foundation, Learn to defend with a competent blue team and bring in a purple team to ensure the red and blue teams are working in step, but the idea of being able to secure that site will be impossible with the current or any variation of the existing code and with the data that was leaked, securing any system moving forward will be a difficult task. Sure, you can change your password and your credit cards, but the data like names, birthdays, security questions, password histories will populate wordlists and credential stuffing attacks. Judging by the clever quips and solutions cybermarks posts it does not feel like they have a grasp on the idea that NO system is secure. A padlock will keep an honest man from stealing your lawnmower from your tool shed and you can sleep comfortably knowing that you gave it your best shot, but if someone really wants that lawnmower they are gonna get a couple wrenches or a pair of bolt cutters and destroy the theatre of security most live in. Sure, another site may pop up, but it will be furiously attacked because someone left the gun cabinet unlocked and painted a target on their back.An organizations biggest vulnerability will always be the arrogance of the people saying it is “The Fort Knox of….” Or the “Swiss bank of…” you might as well just hand them the keys to the server room and write your passwords on a post it.