Hello world,
Anonymous’ latest operation had them hack into controversial hosting provider Epik.
But we now know what may have been the point of entry.
And ransomware gangs are now threatening to erase the data of any victims which hire professional
ransom negotiators. But the reason why isn’t what you might think.
That’s in today’s episode of the weak web where we break down and dissect cyber
security related tech news. You’ve probably heard about the epik data
breach perpetrated by Anonymous last week, well there have been some new juicy developments,
we now know what may have been the likely point of intrusion, as well as some details
surrounding the piss poor security standards implemented by epik, in addition there’s
been a rather colourful press conference with epik’s CEO. I didn’t cover this story
initially, but we now have a much better understanding of what happened.
But first a lowdown of events, epik is a web hosting provider, much like godaddy, dreamhost,
bluehost, etcetera. What makes epik different is that they’re not afraid to host websites
which have been deplatformed by the mainstream hosting providers. It’s no debate that epik
does host controversial sites. The debate is about how objectionable the sites they
host actually are, some of the websites they’ve given refuge to are in my opinion shall we
say, of pretty poor taste. But others I would argue are merely disliked because they cater
to people of opposing political opinions.
In either case, epik has become a magnet for sites to the right of center. This makes them
a ripe target for political activists, in particular Anonymous. Anonymous breached epik’s
defenses and leaked a decade’s worth of data, totalling 180GB - which is massive.
Anonymous has called this dump “Operation Epik Fail” - bit inevitable that naming
when your company is called ‘epik’ - they leaked the spoils through “Distributed Denial
of Secrets”, which in their own words is a “non-profit devoted to enabling the free
transmission of data”.
The leak includes an array of personal data on the people that have used epik for hosting,
including domain purchases, transfers, payment history, and even unhashed passwords - a mortal
sin. The storage of user data by epik seems to have been absolutely abysmal, they’ve
seemingly broken every rule in the data storage playbook. The fact that epik stored user data
in this way at all is difficult to forgive if you’re a customer. To make matters worse,
the breach includes customer information going back 10 years, so presumably the leak even
includes people who ditched epik as their hosting provider long ago.
Epik initially refused to even acknowledge the breach, even with a torrent out there
in the wild and the veracity of the leak going unchallenged. However they did eventually
send a disclosure email to their customers, which rather strangely - and I haven’t seen
this before in corporate communication, invoked the divine in helping to cure the evil in
the people that had commited this breach.
Strangely on epik’s site there is no mention of a hack, their blog and news sections are
particularly bare. Usually in the event of a breach, a responsible company will have
a running commentary on their site, a page wherein they detail what customer information
is affected and mitigation actions customers should take, such as changing passwords and
so on.
Epik’s CEO, one ‘Rob Monster’ - and yes that is his name. Mr Monster. The CEO
hosted a video conference to address the situation. Within which he “admitted that his company
had been breached” as well as explained the origins of the hack. {video} The almost
4 hour long conference was hectic to say the least, it included Mr Monster trading insults
with journalists which accused him of platforming doxers.
We don’t know for sure what caused the breach, however there is one potential intrusion point
in the form of a vulnerability reported to epik many months ago. One Corben Leo discovered
a remote code execution flaw in Epik’s website way back in January. From an interview with
techcrunch, Leo said “a library used on Epik’s WHOIS page for generating PDF reports
of public domain records had a decade-old vulnerability which allowed anyone to remotely
run code directly on the internal server without any authentication,” “You could just paste
this [line of code] in there and execute any command on their servers,”. Epik doesn’t
have a bug bounty program or way of formally disclosing flaws, so instead he did the responsible
thing and “contacted Epik’s chief executive, Mr Monster over LinkedIn”. A read receipt
indicates Monster read the message, but no action was ever taken. At the time Monster
thought it was just spam, Leo is pretty confident “that’s how they got owned”.
Haveibeenpwned has updated their database with epik’s data. Now, I always link my
sources in the description, though in this case I will not be linking to the leaked data
for obvious reasons. Let me know what you think of this Anonymous operation in the comments
- do you think this operation was warranted? Y’know it’s a weird one, hosting websites
which dox journalists isn’t something that can be defended.
But on the other hand two of the most prominent examples I’ve read about that are given
for epik’s hosting of far right content are eight chang and the bailey stormer. Now
epik kicked eight chang from using their services, so they deplatformed them just like cloudflare
did. And the bailey stormer, an objectively race list news website was from my research
never really hosted by epik. In reality, epik acquired a company called ‘BitMitigate’
which was at the time providing hosting for them, when epik realised this they kicked
off the site from using ‘BitMitigate’.
When two of the most cited examples of epik hosting extreme content turn out to be not
so quite straightforward it makes me think the whole drama of epik hosting awful things
may be at least somewhat exaggerated, but it’s a sticky subject and there are examples
of sites that epik hosts which aren’t too pleasant, bnut anyhow let me know your thoughts
in the comments.
Speaking of database leaks and how you can defend against the effects of them...
The easiest way to level up your security is by using a password manager. I recently
surveyed you guys on instagram - make sure to follow me by the way. I found half of you
guys aren’t even using one! Come on! Reusing passwords is obviously an awful idea, but
even storing passwords in your browser is a massive nono - it’s very common for malware
to simply hoover up autofill credentials.
Now, this video is sponsored by RoboForm, I recently switched to their password manager,
setting up was hassle free, importing passwords from chrome and other browsers was super easy.
Then I just downloaded their browser extension and mobile app, which runs on mac, windows,
linux, ios and android, and I was done. Cross platform automatic password syncing, safe
in the knowledge that malware can’t so easily scoop up your credentials if you’re hacked.
Greatly enhance your security today, for the price of a pizza. If you use the link in the
description you’ll get a whole year’s access for just $16, that’s little more
than a dollar a month. And in the unlikely scenario you aren’t happy with Roboform
for any reason they have a 30 day money back guarantee. Roboform, linked in the description.
A new tactic of ransomware gangs has emerged: Threaten to immediately delete files if victim
companies hire professional ransomware negotiators to try and lower ransom demands.
Now typically after a company is victimised with ransomware, the ransomware gang links
the victim to a dark web site where they can communicate with their captors. It’s kind
of like a help desk, this gives the victim the possibility to negotiate a ransom payment
with the gang. Many victim companies hire ransomware recovery specialists to help them
negotiate with the attackers. As you can imagine, ransomware gangs aren’t too fond of these
ransomware recovery experts.
Recently the “Ragnar Locker” gang adopted the strategy of pledging to simply delete
data if victims hired professional negotiators. Following this, the “Grief corp” ransomware
group hopped on the bandwagon and enlisted a similar strategy. These two gangs both published
blog posts on their dark web sites explaining their reasoning behind the new policies. Of
course the reasoning they provide is completely divorced from reality, but we’ll get to
the real reason behind this shortly.
It’s kind of funny, “grief corp” in particular paints these negotiators almost
as leeches, just wanting to profit from the situation. Now I’m going to have to paraphrase
grief corps’ blog post here, the English is as bad as any other cybercriminal. They
point out recovery companies get paid regardless of whether the ransom is paid and allege negotiators
aren’t interested in a solution. That “The strategy of Recovery Companies™ is not to
pay the requested amount or to solve the case, but to stall. ” Thus frustrating grief corps’
attempts to make coin. No wonder they don’t like them.
Then we get to the real reason ransomware gangs are turning to this new tactic, “grief
corp” is one of the many ransomware gangs subject to OFAC sanctions. OFAC is the “Office
of Foreign Assets Control”. The sanctions make it illegal for any US citizen or business
to transact with grief corp at all, for any reason. Ransom negotiators will be wary of
this, and it’s in fact part of their job, to check if a gang is under sanctions from
OFAC, thus scuppering any chance of grief corp getting paid. Breaching OFAC sanctions
even if you weren’t aware the entity you were transacting with is under sanctions come
with some pretty hefty penalties, including fines of up to 20 million USD and 30 year
prison sentences. It’s no surprise ransomware gangs want ransomware specialists out of the
picture.
If you enjoy this kind of video make sure to help me out by tickling the like button
for the youtube AI as well as turning on those sub notifications.
If you want to see what goes on behind the scenes make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
If you’re looking for something to watch next go check out my previous video on how
Anonymous hacked and defaced the Texas republican website.
As always sources will be linked in the video description, stay tuned for more hacking videos,
and have a good one.