Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

washingtonpost.com

Post reply on HN
Print view View original

191–200 of 257 posts

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#191

Post by WarOnPrivacy »

TampaBay times has a more detailed article w/ some details from netsec researchers. They're indicating a well-known spammer is behind the company.

https://www.tampabay.com/news/military/2021/04/24/pentagon-m...

This Sunbiz record has company principals and filings from 2007-2013 - inc names (not in TBT article) and another dropbox address, this one in Chicago

http://search.sunbiz.org/Inquiry/corporationsearch/SearchRes...

That Chicago dropbox address is currently shared by:

This intellectual property law firm https://www.greengriffith.com/contact/

This venture capital firm http://www.lakecapital.com/contact_location.asp

This management company adds another name and address and is tied to the FL addresses https://floridadb.com/company/M06000002257/filinet-llc

.

OpenCorpWiki has an additional dropbox addy down the street

https://opencorporates.com/companies/us_fl/M20000009226

note: The BBB listing confirms reconciles FL address w/ the domain https://opencorporates.com/companies/us_fl/M20000009226

This mailing list has been following the same trail I have https://www.mail-archive.com/nanog@nanog.org/msg112229.html

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#192

Post by WarOnPrivacy »

ttul wrote: post #31
tyingq wrote: post #20

Still seems a bit odd to me. It doesn't explain why "GLOBAL RESOURCE SYSTEMS, LLC" is involved. Poking around, the individuals associated with that aren't government employees. The company was formed 9/8/2020 in Delaware.

Who are the people associated with that company? I’d like to further investigate them.

I'm posting what I find here: https://news.ycombinator.com/item?id=26929926

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#193

Post by Galanwe »

ev1 wrote: post #162
freeflight wrote: post #160

Earlier quoted context omitted.

From the article: > What is clear, however, is the Global Resource Systems announcements directed a fire hose of Internet traffic toward the Defense Department addresses. Madory said his monitoring showed the broad movements of Internet traffic began immediately after the IP addresses were announced Jan. 20. > Madory said such large amounts of data could provide several benefits for those in a position to collect and…

> If China or Russia would suddenly reroute a ton of traffic from outside their countries, to their respective government agencies It is their IP space. It is entirely on your incompetent network staff if you are stealing IPs that are 1) not yours, 2) in use, 3) not in your country for internal use and on top of that, not rejecting external routes to it. It is not "rerouting a ton of traffic", the traffic was destine…

These IPs have been unused since so long, that using these for private networks is absolutely not uncommon.

Somehow the discussion seem to point to China and Russia, but I know a ton of EU companies that use these ranges.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#194

Post by toiletfuneral »

frogpelt wrote: post #129
ufmace wrote: post #94

Earlier quoted context omitted.

That isn't really how it works anymore. It's possible (and standard) to push any political agenda without ever stating an opinion directly. It's all about which specific facts you choose to report and which you choose to ignore. It's very easy to select and report only facts that make group A look good, or only facts that make them look bad. In that way, 2 news sources can give people the opposite opinion without any…

And furthermore, public sentiment (and therefore elections) are decided by what the main sources of media determine is the most important news. Example: Cops have shot a thousand people a year for several years in a row (maybe a decade). About 300 of those each year have been black, which is a disproportionate amount by some measures. However, it is nowhere near the biggest problem in our country even for black peopl…

I agree with some of your post but I also think that reducing it to body count is sidestepping just how differently police treat black communities.

Cops have done horrible things to every race, they are especially aggressive with black people.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#198

Post by xxpor »

woleium wrote: post #93
xxpor wrote: post #69

Earlier quoted context omitted.

If they're not actually using the whole /8 (highly likely), you can setup a 1:1 NAT. basically from network b, if you want to talk to network a, you find out the address in 11/8 that corresponds to the 10/8 address and vice versa. You can use split horizon dns to make it mostly transparent. Every networking problem in the world can be solved with more NAT or more encapsulation :)

what you call 1:1 NAT is just called NAT by cisco, the stuff most folks think NAT is is actually NAT+PAT (like what you run on your home router with a single public IP)

exactly, that's why I specified.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#199

Post by xxpor »

jandrese wrote: post #85
xxpor wrote: post #69

Earlier quoted context omitted.

If they're not actually using the whole /8 (highly likely), you can setup a 1:1 NAT. basically from network b, if you want to talk to network a, you find out the address in 11/8 that corresponds to the 10/8 address and vice versa. You can use split horizon dns to make it mostly transparent. Every networking problem in the world can be solved with more NAT or more encapsulation :)

You don't have to use every address in 10.0.0.0/8 to effectively fill it up. If your corporate policy is to assign a /16 to each floor of a building, and you have a LOT of buildings it's pretty easy to fill up the space even if most of the /16s are sparsely populated. It's much easier to move on to the 11. space when you build that new building that pushes you over than renumbering your entire corporate LAN.

Right, but that's not relevant for 1:1 NAT (well, at least it doesn't have to be). Since the NAT would happen in software, you're no longer constrained by subnets being physically under routers. 11.2.3.0/24 could contain 10.0.1.0/24 and 10.128.128.0/24 without any issues, assuming they don't use in total more than 256 address.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#200

Post by moonchild »

Aperocky wrote: post #180
sterlind wrote: post #109

Earlier quoted context omitted.

but if they're not filtering BGP announcements for those ranges (however unlikely), and the GFW isn't blocking traffic out to those addresses (even more unlikely), and the internal metrics were high (super unlikely), I guess it'd slurp out all the traffic? maybe this was a weird smash-and-grab.

You'd be surprised, but GFW is a blacklist not a whitelist, as such the blocked domains and/or IPs are a very small subset of all public addresses out there.

I'd imagine that, with the advent of ipv6, it would have to be.
Post reply on HN