7 ms·

Is this one of the most brutal hacks in recent history? Can’t say it’s not deserved considering the scope of data exposed.

op00to 5y ago
You’d need security for this to be a brutal hack.
- shapefrog 5y ago
  This is the most brutal copying and pasting of publicly accessible data ever.
  - threatofrain 5y ago
    No, Epik lost plaintext credentials because they didn't practice proper secrets management.
  - viktoracoric 5y ago
    It's not copying and pasting of public data, it's illegal obtaining of other party's data. Extra illegal since credit cards got hacked as well. Just a reminder if you seed this torrent.
- 0xy 5y ago
  No matter who you are and how much "security" you have, you're not beyond the reach of hacks or inexcusable exploits. Microsoft, Google, Facebook all spend billions on security and have all been pwned to varying degrees. Microsoft's Azure has had multiple cross-tenant exploits revealed in the last 3 months, absolutely inexcusable flaws. One of them exposed a large swathe of Fortune 500 companies' data. You're not "safer" at Azure than a small provider spending almost nothing on security, because of the impact of more attention and a larger target on your back. Dunking on providers for being hacked is essentially victim blaming. There's a roughly 100% chance the providers you choose are vulnerable or have lost your data at some point in time.
  - aniforprez 5y ago
    This is not true at all Yes a determined hacker will be able to breach systems and securities and vulnerabilities in hardware and software are found all the time. But a company that invests in security will almost always be less likely to be hacked and your data stolen. This does not mean the company is immune but, like in the case of Epic, if you store your data in an insecure location, you're practically asking to be hacked. It's not "victim shaming" to point fingers at a company with appallingly bad security
    - 0xy 5y ago
      If you host with Azure or Epik you were exposed to serious security vulnerabilities in the last 3 months. You seem to be claiming Azure is less likely to be hacked, however Azure has had cross-tenant security vulnerabilities. You can't claim Epik is an "insecure location" while Azure is not while Azure has the absolute worst kind of security vulnerabilities. I'll remind you that Microsoft spends multiple billions of dollars on security and has large security and incident response teams :)
  - deleted 5y ago
    [deleted]
  - beezischillin 5y ago
    I'm not particularly happy that this happened but bear in mind that this isn't just your regular small provider. Gab, Epik and Parler (I guess Parler probably less so, but still) have very publicly antagonised a large amount of politically-motivated activists while also not making some of more basic steps to secure themselves. So you're basically inserting yourself into a political battle while risking your data. I feel sorry for the victims but that's the extent of it. The motivation behind hacking Ubiquiti, SonicWall, SolarWinds and even Azure is very different and that matters.
    - 0xy 5y ago
      Cloudflare hosts white supremacist websites, anarchist groups, malware providers, hacking groups and otherwise yet if they were hacked I wager you would not have the same response. Why is that? In fact, Cloudflare currently provides services to Gab. Is this a case of double standards on your part for political beliefs of the founders?
deleted 5y ago
[deleted]
FDSGSG 5y ago
>Is this one of the most brutal hacks in recent history? No, not really. Epik can probably continue with their business relatively unscathed. This isn't going to straight up eviscerate the company like some ransomware attacks we've seen recently. In this case the hackers were either lazy or incompetent, they could've defaced every single Epik customer domain and made it very difficult for Epik to restore the DNS configurations. For some reason they didn't do that ¯\_(ツ)_/¯
- user-the-name 5y ago
  Well, yes, people don't come to this company for their competence or security, they come there because nobody else will put up with their vileness.
  - FDSGSG 5y ago
    Right now that might be the case, but epik has a long history which predates that reputation. Most of their customers are probably from before they were associated with the "vile" stuff.
    - kiawe_fire 5y ago
      Moreover, we live in a time where simple guilt by association and even asking simple counter narrative, science-driven questions is enough to get one blocked from all other mainstream registrars and hosts. There aren’t many other options that I’m aware of. So, it’s entirely possible even new customers have joined for lack of other options. I’ve resisted using them, and this incident vindicates why I’ve been hesitant to, but that still leaves me with no options for safely hosting thought that’s against authoritarian-approved narratives. Once again, nuance seems dead, with no place for free thinkers in the middle between the extremes.
      - user-the-name 5y ago
        > we live in a time where simple guilt by association and even asking simple counter narrative, science-driven questions is enough to get one blocked from all other mainstream registrars and hosts. No, we don't. You get blocked from mainstream registrars by spreading hate and making the excuse that this is somehow "counter narrative, science-driven questions", but you know very well that that is not being honest.

op00to 5y ago

You’d need security for this to be a brutal hack.

shapefrog 5y ago
This is the most brutal copying and pasting of publicly accessible data ever.
- threatofrain 5y ago
  No, Epik lost plaintext credentials because they didn't practice proper secrets management.
- viktoracoric 5y ago
  It's not copying and pasting of public data, it's illegal obtaining of other party's data. Extra illegal since credit cards got hacked as well. Just a reminder if you seed this torrent.
0xy 5y ago
No matter who you are and how much "security" you have, you're not beyond the reach of hacks or inexcusable exploits. Microsoft, Google, Facebook all spend billions on security and have all been pwned to varying degrees. Microsoft's Azure has had multiple cross-tenant exploits revealed in the last 3 months, absolutely inexcusable flaws. One of them exposed a large swathe of Fortune 500 companies' data. You're not "safer" at Azure than a small provider spending almost nothing on security, because of the impact of more attention and a larger target on your back. Dunking on providers for being hacked is essentially victim blaming. There's a roughly 100% chance the providers you choose are vulnerable or have lost your data at some point in time.
- aniforprez 5y ago
  This is not true at all Yes a determined hacker will be able to breach systems and securities and vulnerabilities in hardware and software are found all the time. But a company that invests in security will almost always be less likely to be hacked and your data stolen. This does not mean the company is immune but, like in the case of Epic, if you store your data in an insecure location, you're practically asking to be hacked. It's not "victim shaming" to point fingers at a company with appallingly bad security
  - 0xy 5y ago
    If you host with Azure or Epik you were exposed to serious security vulnerabilities in the last 3 months. You seem to be claiming Azure is less likely to be hacked, however Azure has had cross-tenant security vulnerabilities. You can't claim Epik is an "insecure location" while Azure is not while Azure has the absolute worst kind of security vulnerabilities. I'll remind you that Microsoft spends multiple billions of dollars on security and has large security and incident response teams :)
- deleted 5y ago
  [deleted]
- beezischillin 5y ago
  I'm not particularly happy that this happened but bear in mind that this isn't just your regular small provider. Gab, Epik and Parler (I guess Parler probably less so, but still) have very publicly antagonised a large amount of politically-motivated activists while also not making some of more basic steps to secure themselves. So you're basically inserting yourself into a political battle while risking your data. I feel sorry for the victims but that's the extent of it. The motivation behind hacking Ubiquiti, SonicWall, SolarWinds and even Azure is very different and that matters.
  - 0xy 5y ago
    Cloudflare hosts white supremacist websites, anarchist groups, malware providers, hacking groups and otherwise yet if they were hacked I wager you would not have the same response. Why is that? In fact, Cloudflare currently provides services to Gab. Is this a case of double standards on your part for political beliefs of the founders?

deleted 5y ago

[deleted]

FDSGSG 5y ago

>Is this one of the most brutal hacks in recent history? No, not really. Epik can probably continue with their business relatively unscathed. This isn't going to straight up eviscerate the company like some ransomware attacks we've seen recently. In this case the hackers were either lazy or incompetent, they could've defaced every single Epik customer domain and made it very difficult for Epik to restore the DNS configurations. For some reason they didn't do that ¯\_(ツ)_/¯

user-the-name 5y ago
Well, yes, people don't come to this company for their competence or security, they come there because nobody else will put up with their vileness.
- FDSGSG 5y ago
  Right now that might be the case, but epik has a long history which predates that reputation. Most of their customers are probably from before they were associated with the "vile" stuff.
  - kiawe_fire 5y ago
    Moreover, we live in a time where simple guilt by association and even asking simple counter narrative, science-driven questions is enough to get one blocked from all other mainstream registrars and hosts. There aren’t many other options that I’m aware of. So, it’s entirely possible even new customers have joined for lack of other options. I’ve resisted using them, and this incident vindicates why I’ve been hesitant to, but that still leaves me with no options for safely hosting thought that’s against authoritarian-approved narratives. Once again, nuance seems dead, with no place for free thinkers in the middle between the extremes.
    - user-the-name 5y ago
      > we live in a time where simple guilt by association and even asking simple counter narrative, science-driven questions is enough to get one blocked from all other mainstream registrars and hosts. No, we don't. You get blocked from mainstream registrars by spreading hate and making the excuse that this is somehow "counter narrative, science-driven questions", but you know very well that that is not being honest.