news Was there a Hack/Data Breach at Epik?

[accurate]

They released a 3rd dataset from the hack, earlier today.

What was the data? Seems like they leaked it all.

 

[404]

What was the data? Seems like they leaked it all.

More bootable images and hosting accounts, Texas GOP.

 

[accurate]

Seems like they are beating a deadhorse but what do I know.

@404 is a great username!

 

[404]

Seems like they are beating a deadhorse but what do I know.

@404 is a great username!

Cheers. Couldn't find my old credentials so wanted something nice this time around . Been following again for a while...

On subject, if this thread is your only source regarding this hack, do some proper research. The magnitude of it is highly underrated over here.

 

[robmonster]

My relative silence in this thread should not be misunderstood for being indifference. I don't think it will come as a surprise that the normally hard-working Epik team was working particularly hard in recent weeks.

Although it is too early to declare victory, we are certainly making progress. Here is a recap of just some of the actions taken:

 Retained forensic investigation and technical security firm on a full-time basis;

 Retained data privacy and cybersecurity outside counsels to report and remediate the Incident;

 Implemented industry best practice for secure password vault;

 Worked with development teams to cycle all SSH keys multiple times and shut down other means of access to Epik systems;

 Implement bug bounty program (est. Oct 7, 2021);

 Daily coordinated work and efforts combining executive, legal, PR, and security team;

 Migrated all source code to new platform;

 Forced client password resets;

 Shut down all outside access endpoints into Epik’s systems;

 Removed all credit card information from live databases;

 Implemented an SSO where strongly encrypted passwords are not stored on Epik systems and authorization;

 Continued to expunge unnecessary personal information from systems and implement best practices;

 Explored SOC-2 Compliance options after Incident response in near-term;

 Notified clients who were impacted by the data Incident on several dates (Sept 18 and 20, 2021), secured critical systems and provided 2 years of credit monitoring to clients who had payment information included in the Incident;

 Timely notified State Attorneys General in relevant jurisdictions, where prescribed by applicable state data breach notification law;

 Worked with the FBI to help identify the threat actors and take appropriate legal action.

I do greatly appreciate the continued support of our loyal clients as we continue to deploy best practices across the board as we set the stage to be an even better version of Epik.

#BeEpik

 

[accurate]

Thank for the update and all the hardwork @robmonster.

 

[amplify]

Thank you for responding, @robmonster. I hope that this puts the conspiracy theories to rest that DNForum is moderating any side of the conversation, when in fact, we welcome anyone's opinion to use as a possible option to reevaluate and possibly better ourselves.

#BeEpik #BeHeard #DNFourm

 

[404]

On an off-topic note, I think that this can be used to show our newly Epik-funded update for utilizing forum tags in a more useful way—implementing hashtags that are united to forum tags.

This isn't the only project we've been working on. There are several more additions that are at the tail end of the pipeline.

Things can only get better from here.

I was going through the latest leaked data and noticed there is mention of a DNforum git repo...

Might be wise to tighten up security.

 

[Domainnature]

Only some people with 6th sense know how busy you were with the whole team, our thoughts and support are with you.

About security I was thinking what if there can be implemented a firewall on server side (?) with rate limiting, something similar as Wordfence for WP sites, when there are too many attempts from hackers that are searching for holes, when too many accesed links are detected to block them, I use also redirection plugin and redirect all non existend found links to existent pages, I even have a special page with allot of bad words which I redirect them to it.

 

[accurate]

Only some people with 6th sense know how busy you were with the whole team, our thoughts and support are with you.

About security I was thinking what if there can be implemented a firewall on server side (?) with rate limiting, something similar as Wordfence for WP sites, when there are too many attempts from hackers that are searching for holes, when too many accesed links are detected to block them, I use also redirection plugin and redirect all non existend found links to existent pages, I even have a special page with allot of bad words which I redirect them to it.

You rate limit attempts from the same IP address?

 

[amplify]

I was going through the latest leaked data and noticed there is mention of a DNforum git repo...

So you want an illegal copy of Xenforo? If that's what it contains.

If so, I'm sure they won't be too happy it's being used on another URL not authorized to run it. Better off finding a nulled version (and hoping it's not got some built-in exploits) than screaming to the creators of Xenforo that you're running an illegal copy of their software... they don't play too kindly either way I hear.

@robmonster finds it beneficial to white-label and support all of the add ons/development that we're doing to Xenforo anyway (like the #hashtags above for instance), so you might as well wait before putting up something that might be buggy and not even waste time trying to find an exploit in old software.

 

[amplify]

@404 is a great username!

Indeed it is. I couldn't read his posts at first... ba dum tss (I'll see my way out)

Cheers. Couldn't find my old credentials so wanted something nice this time around . Been following again for a while...

Well, welcome back either way! If you need help recovering an old account and want access to it, I could surely help by PM.

 

[404]

So you want an illegal copy of Xenforo? If that's what it contains.

If so, I'm sure they won't be too happy it's being used on another URL not authorized to run it. Better off finding a nulled version (and hoping it's not got some built-in exploits) than screaming to the creators of Xenforo that you're running an illegal copy of their software... they don't play too kindly either way I hear.

@robmonster finds it beneficial to white-label and support all of the add ons/development that we're doing to Xenforo anyway (like the #hashtags above for instance), so you might as well wait before putting up something that might be buggy and not even waste time trying to find an exploit in old software.

Nah, all good . Just letting you know in case some credentials are somewhere out there. Better to be safe than sorry. Judging by what I see on various SM I can imagine DNF could be a potential target, just for the amusement of some.

Indeed it is. I couldn't read his posts at first... ba dum tss (I'll see my way out)

Well, welcome back either way! If you need help recovering an old account and want access to it, I could surely help by PM.

Lol, and thanks for the offer but this one will do just fine.

 

[sekkuhaydi]

Epik hire bad people, is that security problem too? Bad people have access to my info for bad purposes. I want trust people with access, I don't trust

This valid problem, don't delete my post again

news - "For as long as I run DNForum"

For as long as I run DNForum You are bad to me: I correct error: https://archive.is/L5y4o#selection-7319.0-7319.13 I get warn of ban: Official warning (1/2) You are going off-topic. If you want to participate in the thread, draw attention to whether or not Alexa is important today as it was...

dnforum.com

Since censorship:

https://archive.is/bE2Jw

 

[accurate]

A discussion about a Struggle Session @robmonster.

https://dnforum.com/threads/what-is-a-struggle-session-and-why-we-should-avoid-them-at-dnforum.600093/

 

[accurate]

I have two different Epik accounts. I noticed on the one where I forgot to change my password I received this email. My main account I did not receive the below Required Password Reset email.

Even if you do not change your password you can still login. I did not get a prompt to change my password. I change it anyway out of caution and security.

Stay safe out there. It's a jungle.

Hello,

Out of an approach toward maximum caution, we have required Epik users to change their passwords following an unauthorized intrusion into some of our domain-related systems on or before September 13, 2021.
For those who have not manually reset their passwords — our security team has already done so for your protection. For customers who have already changed their passwords since September 13, 2021, no further action is needed at this time.
To create a new password, simply complete the process through the login portal, here.

We recommend creating a unique password that you have not previously used for your account(s). Once your password reset has been finalized, you will be able to access your account information and all services as normal.

For questions related to this password change, or to learn more about our security features, please contact Epik Customer Support.

Sincerely,
Epik Security Team

 

[robmonster]

I have two different Epik accounts. I noticed on the one where I forgot to change my password I received this email. My main account I did not receive the below Required Password Reset email.

Even if you do not change your password you can still login. I did not get a prompt to change my password. I change it anyway out of caution and security.

Stay safe out there. It's a jungle.

This bulk operation was done for folks who had not done a password update since September 13. If you previously changed your password and had 2FA in operation, there was no forced password reset.

 

[accurate]

I have two different Epik accounts. I noticed on the one where I forgot to change my password I received this email. My main account I did not receive the below Required Password Reset email.


This bulk operation was done for folks who had not done a password update since September 13. If you previously changed your password and had 2FA in operation, there was no forced password reset.

Thanks for sharing this Rob.

 

[serosoft]

I am holding 10 crazy valued 4L domains + 100 2word project domains at epik.com
They are still there.
Still have all my trust at epik

 

[MapleDots]

I am holding 10 crazy valued 4L domains

Crazy valued 4 letters?

Unless they are a dictionary term I don't often see any crazy valued 4 letter domains. Most of them go for under 2k and the oddballs often sell in the 2-$400 dollar range.

Unless by crazy you mean undervalued?

I have a pronounceable 4 letter .com asking 7.5k and no takers.
At one time I had it at 2.5k and considering it is a very nice pronounceable that was a bargain.

Anyways, I decided to hold it until 7.5k was a sale so I am not sure what you mean by crazy value.