9 ms·

New leak of Epik data exposes company’s entire server

60 points by blopeur 5y ago

threatofrain 5y ago
https://www.youtube.com/watch?v=aZ9MFts28XI&lc=UgzhE63LoInoN-w9OgB4AaABAg https://www.youtube.com/watch?v=aZ9MFts28XI&lc=UgzhE63LoInoN... 4 hour video of Epik CEO on livestream.
- aniforprez 5y ago
  "Nah I'm not in a state of denial come on bro" Geez this is the response of the CEO to the hack. That they "only" gained access to the backup of the data and not live data. That we should be praying and that hard drives "infected" with the data will explode and burst into flames and that the "hijackers" are "cursing themselves" I don't think it can get any more irresponsible
  - lelandfe 5y ago
    Yeah, the bit about curses was particularly inspired: https://twitter.com/svpndotcom/status/1439071684766707716 https://twitter.com/svpndotcom/status/1439071684766707716
    - zwirbl 5y ago
      think of all the burning hard drives, how irresponsible!
- lelandfe 5y ago
  If (for some reason) you're not expecting it, I'll caution that a guy whose handle I won't promote gets into gross rhetoric on this regarding Jews, women's rights, and so on. Edit: also this transcription linked in the video's description is excellent (and redacts the gross asides I mentioned): https://blog.mollywhite.net/monster-qa https://blog.mollywhite.net/monster-qa
  - notadev 5y ago
    The handle the above comment won’t mention is “Weev”. He’s not Voldemort.
    - mhoad 5y ago
      "Andrew “weev” Auernheimer is a neo-Nazi white supremacist infamous for his internet trolling and extremely violent rhetoric advocating genocide of non-whites. Auernheimer regularly pens vicious diatribes for the neo-Nazi website the Daily Stormer, and manages its technical side, as well as assisting other racist websites with systems issues." Taken from a well researched and fully cited account here https://www.splcenter.org/fighting-hate/extremist-files/individual/andrew-%E2%80%9Cweev%E2%80%9D-auernheimer https://www.splcenter.org/fighting-hate/extremist-files/indi...
    - weeblewobble 5y ago
      I think the point is not to give him any attention/notoriety, which is what fuels him. It's not about fear
      - lelandfe 5y ago
        Correct – which I'm realizing I Streisand'd and attracted more attention :)
skilled 5y ago
Is this one of the most brutal hacks in recent history? Can’t say it’s not deserved considering the scope of data exposed.
- op00to 5y ago
  You’d need security for this to be a brutal hack.
  - shapefrog 5y ago
    This is the most brutal copying and pasting of publicly accessible data ever.
    - threatofrain 5y ago
      No, Epik lost plaintext credentials because they didn't practice proper secrets management.
    - viktoracoric 5y ago
      It's not copying and pasting of public data, it's illegal obtaining of other party's data. Extra illegal since credit cards got hacked as well. Just a reminder if you seed this torrent.
  - 0xy 5y ago
    No matter who you are and how much "security" you have, you're not beyond the reach of hacks or inexcusable exploits. Microsoft, Google, Facebook all spend billions on security and have all been pwned to varying degrees. Microsoft's Azure has had multiple cross-tenant exploits revealed in the last 3 months, absolutely inexcusable flaws. One of them exposed a large swathe of Fortune 500 companies' data. You're not "safer" at Azure than a small provider spending almost nothing on security, because of the impact of more attention and a larger target on your back. Dunking on providers for being hacked is essentially victim blaming. There's a roughly 100% chance the providers you choose are vulnerable or have lost your data at some point in time.
phoe-krk 5y ago
> Epik CEO Rob Monster, who did not respond to requests for comment from the Daily Dot, would go on to hold a more than four hour long live video conference online to address the initial hack. The meeting would see Monster break out into prayer numerous times, make attempts to vanquish demons, and warn viewers that their hard drives could burst into flames due to “curses” placed on the hacked data. Yikes.
- tgv 5y ago
  How do they combine curses with their Christian belief? Doesn't the Bible condone magic? Not that I'm expecting any rational or coherent answer to that question, but it does surprise me. Anyway, when some Amazon cloud center catches fire, we'll have some evidence of providence.
  - geofft 5y ago
    Strictly speaking, what the Bible prohibits by "magic" is recourse to powers other than God. Curses are fine: the third- and fourth-last verses of the Bible itself are a warning of plagues and misfortune to anyone who messes with the text of the book of Revelation. But that is an invocation of God's power, so it's fine. Making a deal with some demon is not.
  - jareklupinski 5y ago
    > How do they combine curses with their Christian belief? Doesn't the Bible condone magic? I don't believe they are actually Christian or faithful, they are just using these 'rituals' as a sort of "look how silly i am, i am clearly insane, please dont sue or prosecute me" ruse which will turn into a "it was your fault you trusted a crazy person" argument when it gets to court
- optimalsolver 5y ago
  Sounds like an alt-history where the Medieval church discovers electricity and computation.
  - phoe-krk 5y ago
kleiba 5y ago
I'm digging the ASCII art, although I think the kerning could be tweaked a bit: ________ _______ _____ ___ ____ ________ _ _____ _____ |_ __ | |_ __ \ |_ _| |_ ||_ _| |_ __ | / \ |_ _| |_ _| | |_ \_| | |__) | | | | |_/ / | |_ \_| / _ \ | | | | | _| _ | ___/ | | | __'. | _| / ___ \ | | | | _ _| |__/ | _| |_ _| |_ _| | \ \_ _| |_ _/ / \ \_ _| |_ _| |__/ | |________| |_____| |_____| |____||____| |_____| |____| |____| |_____| |________| ________ _______ _____ ___ ____ ________ _ _____ _____ |_ __ | |_ __ \ |_ _| |_ ||_ _| |_ __ | / \ |_ _| |_ _| | |_ \_| | |__) | | | | |_/ / | |_ \_| / _ \ | | | | | _| _ | ___/ | | | __'. | _| / ___ \ | | | | _ _| |__/ | _| |_ _| |_ _| | \ \_ _| |_ _/ / \ \_ _| |_ _| |__/ | |________| |_____| |_____| |____||____| |_____| |____| |____| |_____| |________|
- afiori 5y ago
  relevant xkcd: https://xkcd.com/1015/ https://xkcd.com/1015/
  - kleiba 5y ago
    Honestly surprised about the downvotes.
    - rubyn00bie 5y ago
      It’s because it’s really irritating to have a giant block of ASCII art take up the screen in a comments section.
      - kleiba 5y ago
        Okay, that's understandable. Sorry about that. Still, I would have expected that on Hacker-News, a comment about ASCII art and font kerning would have been more welcome. I mean, it's not like I was trolling or anything, in my opinion it was a serious post. But okay, I get it now. And admittedly, my post wasn't exactly a revelation.
beezischillin 5y ago
Can't say "alt tech" is doing much to persuade me to move away from "Big Tech", despite how awful some of those companies are. This is an unmitigated disaster.
- user-the-name 5y ago
  Is there some reason you expected more of a company run by a white supremacist fundamentalist weirdo who offers hosting for neo-nazis?
rvz 5y ago
It would have been just better to report and target the content that you find hateful or illegal to the authorities directly to force the registrar in question (Epik) to take it down rather than a full fledged breach affecting beyond 15 million users. All for what? Of course now it also affects people who haven't even used the service. [0] Won't be surprised to see the authorities being involved in the investigation of this breach. [0] https://arstechnica.com/information-technology/2021/09/epik-data-breach-impacts-15-million-users-including-non-customers/ https://arstechnica.com/information-technology/2021/09/epik-...
- jonnycomputer 5y ago
  My email appears in the hack, but not because I am a customer of Epik. I think they had a database of scraped WHOIS data.
JulianMorrison 5y ago
If Epik doesn't have the basic integrity to shut the hell down and get a security expert to rebuild their systems, then at the very least, I hope PayPal and friends are hurriedly cancelling those API keys (and the accounts that acquired and failed to secure them).

60 points by blopeur 5y ago

https://www.youtube.com/watch?v=aZ9MFts28XI&lc=UgzhE63LoInoN-w9OgB4AaABAg https://www.youtube.com/watch?v=aZ9MFts28XI&lc=UgzhE63LoInoN... 4 hour video of Epik CEO on livestream.

aniforprez 5y ago
"Nah I'm not in a state of denial come on bro" Geez this is the response of the CEO to the hack. That they "only" gained access to the backup of the data and not live data. That we should be praying and that hard drives "infected" with the data will explode and burst into flames and that the "hijackers" are "cursing themselves" I don't think it can get any more irresponsible
- lelandfe 5y ago
  Yeah, the bit about curses was particularly inspired: https://twitter.com/svpndotcom/status/1439071684766707716 https://twitter.com/svpndotcom/status/1439071684766707716
  - zwirbl 5y ago
    think of all the burning hard drives, how irresponsible!
lelandfe 5y ago
If (for some reason) you're not expecting it, I'll caution that a guy whose handle I won't promote gets into gross rhetoric on this regarding Jews, women's rights, and so on. Edit: also this transcription linked in the video's description is excellent (and redacts the gross asides I mentioned): https://blog.mollywhite.net/monster-qa https://blog.mollywhite.net/monster-qa
- notadev 5y ago
  The handle the above comment won’t mention is “Weev”. He’s not Voldemort.
  - mhoad 5y ago
    "Andrew “weev” Auernheimer is a neo-Nazi white supremacist infamous for his internet trolling and extremely violent rhetoric advocating genocide of non-whites. Auernheimer regularly pens vicious diatribes for the neo-Nazi website the Daily Stormer, and manages its technical side, as well as assisting other racist websites with systems issues." Taken from a well researched and fully cited account here https://www.splcenter.org/fighting-hate/extremist-files/individual/andrew-%E2%80%9Cweev%E2%80%9D-auernheimer https://www.splcenter.org/fighting-hate/extremist-files/indi...
  - weeblewobble 5y ago
    I think the point is not to give him any attention/notoriety, which is what fuels him. It's not about fear
    - lelandfe 5y ago
      Correct – which I'm realizing I Streisand'd and attracted more attention :)

skilled 5y ago

Is this one of the most brutal hacks in recent history? Can’t say it’s not deserved considering the scope of data exposed.

op00to 5y ago
You’d need security for this to be a brutal hack.
- shapefrog 5y ago
  This is the most brutal copying and pasting of publicly accessible data ever.
  - threatofrain 5y ago
    No, Epik lost plaintext credentials because they didn't practice proper secrets management.
  - viktoracoric 5y ago
    It's not copying and pasting of public data, it's illegal obtaining of other party's data. Extra illegal since credit cards got hacked as well. Just a reminder if you seed this torrent.
- 0xy 5y ago
  No matter who you are and how much "security" you have, you're not beyond the reach of hacks or inexcusable exploits. Microsoft, Google, Facebook all spend billions on security and have all been pwned to varying degrees. Microsoft's Azure has had multiple cross-tenant exploits revealed in the last 3 months, absolutely inexcusable flaws. One of them exposed a large swathe of Fortune 500 companies' data. You're not "safer" at Azure than a small provider spending almost nothing on security, because of the impact of more attention and a larger target on your back. Dunking on providers for being hacked is essentially victim blaming. There's a roughly 100% chance the providers you choose are vulnerable or have lost your data at some point in time.

phoe-krk 5y ago

> Epik CEO Rob Monster, who did not respond to requests for comment from the Daily Dot, would go on to hold a more than four hour long live video conference online to address the initial hack. The meeting would see Monster break out into prayer numerous times, make attempts to vanquish demons, and warn viewers that their hard drives could burst into flames due to “curses” placed on the hacked data. Yikes.

tgv 5y ago
How do they combine curses with their Christian belief? Doesn't the Bible condone magic? Not that I'm expecting any rational or coherent answer to that question, but it does surprise me. Anyway, when some Amazon cloud center catches fire, we'll have some evidence of providence.
- geofft 5y ago
  Strictly speaking, what the Bible prohibits by "magic" is recourse to powers other than God. Curses are fine: the third- and fourth-last verses of the Bible itself are a warning of plagues and misfortune to anyone who messes with the text of the book of Revelation. But that is an invocation of God's power, so it's fine. Making a deal with some demon is not.
- jareklupinski 5y ago
  > How do they combine curses with their Christian belief? Doesn't the Bible condone magic? I don't believe they are actually Christian or faithful, they are just using these 'rituals' as a sort of "look how silly i am, i am clearly insane, please dont sue or prosecute me" ruse which will turn into a "it was your fault you trusted a crazy person" argument when it gets to court
optimalsolver 5y ago
Sounds like an alt-history where the Medieval church discovers electricity and computation.
- phoe-krk 5y ago

kleiba 5y ago

I'm digging the ASCII art, although I think the kerning could be tweaked a bit: ________ _______ _____ ___ ____ ________ _ _____ _____ |_ __ | |_ __ \ |_ _| |_ ||_ _| |_ __ | / \ |_ _| |_ _| | |_ \_| | |__) | | | | |_/ / | |_ \_| / _ \ | | | | | _| _ | ___/ | | | __'. | _| / ___ \ | | | | _ _| |__/ | _| |_ _| |_ _| | \ \_ _| |_ _/ / \ \_ _| |_ _| |__/ | |________| |_____| |_____| |____||____| |_____| |____| |____| |_____| |________| ________ _______ _____ ___ ____ ________ _ _____ _____ |_ __ | |_ __ \ |_ _| |_ ||_ _| |_ __ | / \ |_ _| |_ _| | |_ \_| | |__) | | | | |_/ / | |_ \_| / _ \ | | | | | _| _ | ___/ | | | __'. | _| / ___ \ | | | | _ _| |__/ | _| |_ _| |_ _| | \ \_ _| |_ _/ / \ \_ _| |_ _| |__/ | |________| |_____| |_____| |____||____| |_____| |____| |____| |_____| |________|

afiori 5y ago
relevant xkcd: https://xkcd.com/1015/ https://xkcd.com/1015/
- kleiba 5y ago
  Honestly surprised about the downvotes.
  - rubyn00bie 5y ago
    It’s because it’s really irritating to have a giant block of ASCII art take up the screen in a comments section.
    - kleiba 5y ago
      Okay, that's understandable. Sorry about that. Still, I would have expected that on Hacker-News, a comment about ASCII art and font kerning would have been more welcome. I mean, it's not like I was trolling or anything, in my opinion it was a serious post. But okay, I get it now. And admittedly, my post wasn't exactly a revelation.

beezischillin 5y ago

Can't say "alt tech" is doing much to persuade me to move away from "Big Tech", despite how awful some of those companies are. This is an unmitigated disaster.

user-the-name 5y ago
Is there some reason you expected more of a company run by a white supremacist fundamentalist weirdo who offers hosting for neo-nazis?

rvz 5y ago

It would have been just better to report and target the content that you find hateful or illegal to the authorities directly to force the registrar in question (Epik) to take it down rather than a full fledged breach affecting beyond 15 million users. All for what? Of course now it also affects people who haven't even used the service. [0] Won't be surprised to see the authorities being involved in the investigation of this breach. [0] https://arstechnica.com/information-technology/2021/09/epik-data-breach-impacts-15-million-users-including-non-customers/ https://arstechnica.com/information-technology/2021/09/epik-...

jonnycomputer 5y ago
My email appears in the hack, but not because I am a customer of Epik. I think they had a database of scraped WHOIS data.

JulianMorrison 5y ago

If Epik doesn't have the basic integrity to shut the hell down and get a security expert to rebuild their systems, then at the very least, I hope PayPal and friends are hurriedly cancelling those API keys (and the accounts that acquired and failed to secure them).