Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

washingtonpost.com

Post reply on HN
Print view View original

151–160 of 257 posts

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#151

Post by spiritplumber »

MereInterest wrote: post #123
dunmalg wrote: post #120

Earlier quoted context omitted.

I used to work in intelligence. "Secrecy creep" has long been a serious problem inside DoD. How information get classified has largely been left up to low level federal bureaucrats, people my father used to angrily refer to as "big haired women from Mississippi". Basically, they are low level federal office drones, with minimal knowledge about the actual content of classified programs, who re left to determine how th…

Don't answer this if it isn't legal to answer, but do you have any examples you can share? I can entirely picture the process, and completely believe that it happens, but I don't have a mental image of what the end result looks like.

There has been a brief period in my life when I did not have the clearance to read code I was writing.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#153

Post by drawkbox »

tyingq wrote: post #28
Fnoord wrote: post #24

Earlier quoted context omitted.

Means nothing. Companies can be a front for a government.

Well, yes, but I'm interested in "for what purpose, in this specific case".

If other scammers are using spoofing the ranges then another company does it, that doesn't raise alarm in the other entities abusing the same trick.

If you announce it as DoD then it may scare off the others.

In any good investigation, you want to shroud the data/intel collection. Using a front company, or series of levels of fronts, is the way you have to go about it.

In short, a honeypot.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#154

Post by zeusk »

hujun wrote: post #150
pgn674 wrote: post #14

Earlier quoted context omitted.

Ohh, I think I see. So instead of (or in addition to) creating internal subnets inside 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, they set up subsets inside DoD's 11.0.0.0/8 etc., and it worked out because there were no external BGP announcements for those ranges. But now that there are, if they did not explicitly configure their border gateways to route those ranges inside their networks, the traffic may now lea…

it is very unlikely to for a company like Alibaba not configuring their BGP right

Have you seen the talk about AI with Jack Ma and Elon?

I wouldn't be surprised.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#155

Post by judge2020 »

throwaway2474 wrote: post #152

Can someone explain how we know these “announcements” are real? What’s to stop me setting up a company and announcing random dormant address ranges that I don’t own?

rpki[0], but that doesn't mean fake bgp announcements, considered bgp hijacking[1], don't happen[2].

Once every t1 drops invalid prefixes, then rpki will effectively mean no T1 can turn off the internet for other ASNs, but everyone signing their prefixes is required to mean nobody can fake announce an IP.

It looks like the DOD's routes are indeed signed[3].

0: https://isbgpsafeyet.com/

1: https://www.thousandeyes.com/learning/glossary/bgp-route-hij...

2: https://hn.algolia.com/?q=bgp

3: https://bgp.he.net/AS8003#_prefixes

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#156

Post by MathCodeLove »

shigawire wrote: post #143
frogpelt wrote: post #129

Earlier quoted context omitted.

And furthermore, public sentiment (and therefore elections) are decided by what the main sources of media determine is the most important news. Example: Cops have shot a thousand people a year for several years in a row (maybe a decade). About 300 of those each year have been black, which is a disproportionate amount by some measures. However, it is nowhere near the biggest problem in our country even for black peopl…

Yes - cops should kill fewer people.

What does that statement have to do with the comment you're responding to? Yes cops should kill fewer people, but as the person to whom you replied mentioned, police violence is far from the most serious issue facing the US currently. Let's get outraged at the obesity epidemic, let's revolt against black on black violence in the inner cities, let's "defund" platforms which encourage division and turmoil.

Even my comment is derivative, the point is that news and media outlets are able to control public opinion even by being honest and factual. By simply ignoring some facts it's trivial for these outlets to skew their audiences perspectives on current events. The whole "left vs right" ideology is toxic and cancerous to a healthy society and it sickens me. It's increasingly difficult to hold a moderate opinion about a subject without being demonized by one group of extremists or another.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#157

Post by NovemberWhiskey »

spiritplumber wrote: post #151
MereInterest wrote: post #123

Earlier quoted context omitted.

Don't answer this if it isn't legal to answer, but do you have any examples you can share? I can entirely picture the process, and completely believe that it happens, but I don't have a mental image of what the end result looks like.

There has been a brief period in my life when I did not have the clearance to read code I was writing.

Yeah. I once worked on a project implementing the software for a fighter aircraft first-line test set - the kind of thing that a maintainer would connect up to the pylons to check out the wiring and make sure the right voltages were getting where they were meant to.

We had to run the whole project on a completely separate network from the rest of the business due to the classification of the software, which was driven entirely by a handful of frequencies used in testing; details of which were also broadly available from OSINT sources.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#158

Post by Jach »

zeusk wrote: post #154
hujun wrote: post #150

Earlier quoted context omitted.

it is very unlikely to for a company like Alibaba not configuring their BGP right

Have you seen the talk about AI with Jack Ma and Elon? I wouldn't be surprised.

FWIW Ma seems significantly smarter than he showed during that event when you look at translations of his Chinese (speaking or written). But in any case, even an incompetent CEO can still have competent IT.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#159

Post by A_non_e-moose »

MathCodeLove wrote: post #156
shigawire wrote: post #143

Earlier quoted context omitted.

Yes - cops should kill fewer people.

What does that statement have to do with the comment you're responding to? Yes cops should kill fewer people, but as the person to whom you replied mentioned, police violence is far from the most serious issue facing the US currently. Let's get outraged at the obesity epidemic, let's revolt against black on black violence in the inner cities, let's "defund" platforms which encourage division and turmoil. Even my comm…

See John Cleese on Extremism https://m.youtube.com/watch?v=HLNhPMQnWu4

The "you're either with us or against us" mentality leads to the eradication of moderates and further extremism.

A healthy society needs balance.

How can we counteract this?

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#160

Post by freeflight »

jasonhansel wrote: post #21
pgn674 wrote: post #14

Earlier quoted context omitted.

Ohh, I think I see. So instead of (or in addition to) creating internal subnets inside 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, they set up subsets inside DoD's 11.0.0.0/8 etc., and it worked out because there were no external BGP announcements for those ranges. But now that there are, if they did not explicitly configure their border gateways to route those ranges inside their networks, the traffic may now lea…

Maybe DoD is trying to catch security flaws caused by traffic intended for their own internal networks accidentally reaching the public internet? Advertising those IPs publicly and logging all traffic could be a good way of detecting such bugs in DoD systems.

From the article:

> What is clear, however, is the Global Resource Systems announcements directed a fire hose of Internet traffic toward the Defense Department addresses. Madory said his monitoring showed the broad movements of Internet traffic began immediately after the IP addresses were announced Jan. 20.

> Madory said such large amounts of data could provide several benefits for those in a position to collect and analyze it for threat intelligence and other purposes.

It's interesting how this is framed as something "defensive in nature", when it's yet another massive funnel for data being slurped up by a US government agency.

If China or Russia would suddenly reroute a ton of traffic from outside their countries, to their respective government agencies, I doubt anybody would believe a benign "Just checking our security!" explanation.

Post reply on HN