rshnotsecure

https://news.ycombinator.com is run by M5 Hosting out of San Diego.

M5 Hosting is also known as M5 Computer Security out of San Diego.

These firms are a strange choice for a place like YCombinator to host I think.

Can we talk? One concern we had was that these cargo ships, some subset of the 220, have nuclear weapons onboard that the crew isn’t even aware of. Much like how the soviets used to hide their ICBMs in train cars that move around, this makes tracking these things really hard.

[email address redacted]

I am writing this all on a phone and I am more than happy to produce a 5000 word report which will be posted in 96 hours. I will follow up via a comment here and also send to Michael Forsythe at the New York Times for additional review.

You have my word.

EDIT: 5000 words not pages

Look into something called Reverse Mergers btw.

Old dying hosting companies were the perfect cover to be acquired by spy agencies.

You’ll notice a large posting of press releases and apparent spending in the last 4-5 years though still for all.

http://dcsmanage.com out of Los Angeles is another one btw...

It comes mainly from mapping the subdomains over time and analysis of the ASNs. This is key. You will often see a company with perhaps 200 or so subdomains, that only does business in the United States.

But then you will see one subdomain that maps to ASN 4803 or whatever, which then leads to “China Telecom xinjiang”. In fact I encourage you to type:

org:”China Telecom xinjiang” “NSFOCUS” into Shodan.

Also look at the capital expenditures psychz.net claims on their about page. There is no IaaS company in the world that can afford to lay down as much hardware as they are claiming.

Another thing btw is these sites never seem to have job openings. That is common pattern that applies to perhaps 60% of the firms listed.

Dozens of tech companies around the world that were established in the last 4-5 years were done so entirely for the purpose of being fronts for spy agencies to engage in the vast collection of data.

This extends also to shipping, licensing, and auditing companies.

One example is https://www.pacificbasin.com/en/fleet/fleet.php

Somehow they’ve managed to assemble the worlds 2nd largest cargo fleet in terms of dry weight tonnage, all verifiable on https://marinetraffic.com btw, and yet they appear on NO LISTING ANYWHERE for the top 100 cargo companies.

That company is a front for the Chinese military, because if you do a reverse WHOIS search you will see http://pacbasin.com was also registered by the same organization...it is an autonomous drone hardware and extended flight operations firm. There is more to say there, but I will leave it at that.

Other firms that have been espionage operations since day one, or were acquired at some point and repurposed as spy outfits. This list includes both Western and Eastern powers:

NSFOCUS Global

psychz.net

mimecast.com

terra.net

protonmail.com

creditkarma.com

ipvm.com

ClearDDOS

Neuvector

Multacom

HighWinds

Black Oak Computers

IT7 Networks

Ramnode

Gorilla Servers

Digital Core

InMotion Hosting

Choopa

LeaseWeb

StackPath

Voxility

Perfect International

I recently worked at a major retailer who has offices in the Bay Area.

Part of the role involved migrating the ERP and ATS system, which had employees, salary, details etc.

In the building I was in, which had incredible developers btw some of the best I’ve ever seen (and despite working on a legacy system!)...209 out of 209 were H1-B’s. Our consulting team at the time was about 20, and 19/20 of the team were H1-B’s.

The really sad part about it was as we were leaving, they were establishing a training program for junior H1-B’s with liberal arts degrees to learn programming. I have no idea how they got the visa licenses for those folks.

At the same time, they were the best people I ever worked with. But it’s not a sustainable way to run an economy.

Since the early 2000s, Microsoft has done a significant amount of work for the NSA. AWS has had GovCloud, and it is true the CIA uses AWS, but MSFT has built out quite well some of the more exotic requests of the NSA.

The crown jewel of the NSA’s MSFT partnership is the San Antonio, Texas data center. The “5150 Rogers Road” data center was chosen because Texas has cheap electricity, which is an enormous cost outlay for the NSA. Additionally, and the FBI chose San Antonio for a significant presence as well because of this, is Texas has a separate electrical grid from the rest of the US.

Also San Antonio has something like 4 military bases. Ft. Sam Houston where the Army medics train, Lackland Air Force Base (home of cybercommand for the Air Force), Kelley Air Force Base, and perhaps even 1 or 2 I can’t recall.

120 minutes to the north is the recently established Army Futures Command in Austin, along with Ft. Hood in Killeen, the Army’s largest base in the world.

AWS does not currently have a data center in Texas, which has always frustrated the Texas government. They did establish a shipping center in San Marcos, but even GCO is building out in Dallas where IBM Cloud has a data center, and Oracle Cloud has an Austin data center.

I think you make a valid point that also is the most plausible argument I’ve heard. Except though if I do this exercise for USA sites, I don’t see the same thing. My guess though is that the USA sites are maybe just more aggressive about filing abuse claims to the registrar?

There are some interesting results if you check the Google Analytics ID of TikTok.

They seem to also manage a somewhat sizable portfolio of gambling sites, sites selling knockoff Sports Jerseys, and adult videotube sites.

I am counting about 45 sites right now for UA-75850242.

Many Chinese sites seem to operate like this. I believe Huawei has about 500 completely unrelated sites.

A sort of SFW “soft core” example of this would be yoma202.com [1] which is also used to manage huaweimarine.com. Please note that Huawei and Huawei Marine separated about 6 months ago technically.

[1] http://yoma202.com

The AWS Associate and Professional Architect certifications together costs $450. 12 months of self-study from knowing nothing about computers, and many have done it in less. Compare them (although this is not the best metaphor) to an Associate’s and Bacehlor’s degree. You would certainly earn as much...probably quite a bit more.

The study materials for those exams, worst case, bring the total to $750.

So $750 vs $50,000 for a modestly priced 4 year university.

Can anyone in intellectual good faith argue that the latter system is going to survive outside of the very short term?

That flood is terrifying btw. I can barely watch the 3G geographic movie models without feeling terrified. That would have been 5 million years ago though I think. The #1 rule of humans and archaeology and anthropology is whatever your dates are, it probably happened sooner :)

But tough to imagine that flood could have been it (although amazing story) and agree with your final paragraph.

Docker Hub still does not have any form of 2FA. Even SMS 2FA would be something / great at this point.

As an attacker, I would put a great deal of focus on attacking company’s registries on Docker Hub. They can’t have 2FA, so the work/reward ratio is quite high.

This is quite serious. Interstellar objects travel at very fast speed. Comets, because of their highly elliptical orbit, already impact earth at much higher speeds than asteroids. Can only imagine what a hit from something further than the Oort Cloud is.

It is very likely that the global flood monomyth is based on the impact of a comet around 13,000 years ago. This was somewhat discounted only 10 years ago, but now is more than the majority consensus in the field (“Younger Dryas Impact Hypothesis”).

Comet would have hit Greenland by the way, with many pieces falling apart and hitting North America. This would have destabilized the entire ice shield across that area.

Back in late 2016 a lot was made about a 20+ year Oracle/Linux veteran at ORCL jumping ship to Microsoft to lead their burgeoning Linux group.

9 months later the guy returned to Oracle. Always thought that spoke a little bit to the quality of OEL, especially after this profile from BI: https://www.businessinsider.com/wim-coekaerts-microsoft-open...

MSFT and Linux seem to be doing cool things right now, so I assume he returned to Oracle our of some love for the product, and not because he didn’t like what he saw at MSFT.

The fact that FB can task developers to this, but not the breached servers (of a 3rd Party but who has access to highly confidential material) I’ve reported via their BB page that are online right this second is somewhat insulting to me.

If this comment gets downvoted, be suspicious. It is going to be well written, but it is does contain accusations against Facebook. My real name is in my About Section so I have no fear of libel. I hate to play this card because I am sort of immunizing myself (or trying to) against downvotes, but you can look through my comments and it’s not something I’ve ever done before.

1. The 3rd Party who led to the breach at Doordash is also a Facebook contractor. A significant amount of Facebook data has been stolen because of this.

2. Dashlane, Deliveroo (UK), Netflix, Uber, AirBnB, Quora, EventBrite, BetterDoctor, and about 10 other firms that I know of are also clients of this contractor as their data was also leaking or obtainable through extremely simple exploits.

3. Yes I did file a Bug Bounty with evidence. FB has acted...sort of...but the evidence is still online, at this moment.

4. I have already begun conversations with ISC2 asking for a significant amount of CISSP cert holders at FB to have their certifications revoked for breach of ethics violations via the “good of society” clause and negligent blindness. I absolutely made sure to have a carve out saying they probably were just ignored by management, and in such case for the names I cited to ignore my claim (and I would write a written public apology if asked).

5. I get that everyone here is tired of FB negativity here. Me too. Just a little longer if you don’t mind.

Facebook has a couple dozen contractors that employ thousands of people. These contractors fall out of the scope of Facebook’s Bug Bounty in most cases, and the contractors do not have a way to contact them about security vulnerabilities or a defined process.

It is an enormous legal arbitrage finance maneuver it seems. These contractors are awarded very large contracts in exchange for essentially assuming huge legal liability. They are gambling nothing bad will happen. It makes sense from a business perspective for both parties.

These contractors can be quickly identified via some searching online. From there if you have map their DNS infrastructure via common tools like https://dnsdumpster.com, you will very poorly (or at least quickly) set up AWS/Azure infrastructures running software behind on patching usually from 1-3 years, and having documented exploits that can be triggered remotely without previous auth.

The situation is very sad, and I would encourage the engineers at Facebook to at least ask their managers if they think this serves the company. The good news is of course it can be fixed quickly and dramatically. OS updates and a few L4 firewall rules for the host is often all that is needed.

EDIT: changed a plural

This is not unusual. My spouse works for Glassdoor. Entry level programmer jobs in Texas will get 2000 applications (not bots) within about 72 hours. Desperate people from all over the US.

I think at one time the advice to “play the numbers game” was correct for online job apps. Not anymore.

Even more saddening, Glassdoor uses a temp/test sample job ad. It’s for cat sitting. $15/hr. That will get hundreds of apps in 48 hours if someone forgets to take it down (is only supposed to go up for 60 mins max but things happen).

Highly recommend Leo Braudy’s “Frenzy of Renown”. Basically considered the default text in the field of celebrity studies.

Braudy’s hypothesis is the celebrity has always been an inherently quasi-religious phenomenon. Religious only in the sense though of being post-death or of having an afterlife. Attaining celebrity is a transcendent goal in each generation a few can reach.

Every era of society has a means of attaining life in the next world. This is often seen as the ultimate purpose / highest goal one can achieve. The best way to attain this is being known in eras beyond the one you live in. Sometimes this is via extreme piousness (sainthood), military and political conquest (history), or in modern conceptions, being so extremely known in the present it simulates a forever-knowing effect through everyone-knowing.

Wish I could describe it better, but here is the book: https://www.amazon.com/Frenzy-Renown-Fame-Its-History/dp/067...

Has anyone asked why in the Linux Kernel there has been an extraordinary amount of work on Huawei in a few key networking files? In fact in such file the changelog since 2016 mentions Huawei more than any other proper noun combined.

The person who is in charge of this module...runs two small sites. One is a foundation he created help with overpopulation. The other is a 9/11 was an inside American job website.

Here is the module. If you search the forum you will find 4,800 mentions of Huawei. The term Cisco brings up 7 mentions. Netgear only 60. Ridiculous purely in terms of vendor favoritism.

EDIT: link - http://www.draisberghof.de/usb_modeswitch/

It’s such an oversight that to quote someone from early 20th century ... “is this stupidity or is this treason”.

Not doing this was a deliberate choice. The benefits of implementing it outweigh at maybe a dozen orders of magnitude not implementing it.

The very scary thing btw is simple. They were bribed the same way the WordPress Core Contributors have been for years. Let me discuss this quickly, and I’m happy to name names in a separate posting (Gary Pendergast out of Australia is going to jail though along with another America dev). That being said please review this discussion where several core contributors admit to not even reading an extremely important path from arguably one of the best PHP developers in the world (certainly in terms of security): https://core.trac.wordpress.org/ticket/39309

That article does not clarify anything. I want to provide a link. It is nothing but thousands of words saying they aren’t partnering by putting an app in Huawei App Store.

For years companies used to provide all sorts of incentives to put apps in their store. It benefits them highly.

This is ridiculous: https://protonmail.com/blog/clarifying-protonmail-and-huawei...

Yubikeys are one of the few forms of 2FA that are highly resilient to being phished. Google has not only an option to restrict SMS 2FA, but an additional one below to restrict “all 2FA options except security keys” in GSuite.

It has been known for some time that TOTP 6 digit codes are easy to intercept. SMS Codes can also be intercepted, or gained via SSB7 vulns/ SIM jacking. This made things like Google Authenticator or Authy more resilient but certainly still quite vulnerable.

To intercept and exploit MFA in ProtonMail would absolutely trivial for a skilled single person to do. DNS poisoning + this github library would be all you needed: https://github.com/kgretzky/evilginx2

EDIT: replaced quotemark with asterisk

ProtonMail does not support Yubikeys. I would like to ask all of HN to think seriously about this and what this means. ProtonMail does many things exactly right. This 1 oversight suggests something very very scary going on at the organization.

HN does not allow you to delete comments. I would ask that if you think that not having Yubikeys does not require a significant and immediate answer from the ProtonMail team, to sign your name (I will) at the bottom of your response. If you can’t do that, perhaps provide a burner email address.

Dan Ehrlich

dan@ehrlichserver.com

CISSP, CCSP, CISM

EDIT: spacing between my signature, change of comment to commentS

The skills we’re missing could be easily trained for. People would happily do the training for free even if it lasted months (say through online portals that were self paced) just for a chance at getting a job / a guaranteed in-person interview at least.

There is a skills shortage again yes, but it is remarkably easy to remediate a significant portion of it, particularly in an industry with such profits.

I think though also Peter Thiel is right in his criticisms of colleges. They have dropped the ball significantly, especially compared to India’a colleges, which almost overnight rapidly shifted to an IT/Healthcare focus in the 1980’s.

Capella University has a very low reputation / is for profit. My understanding is it is no better than ITT or University of Phoenix, which have a very bad and infamous reputation in the United States.