Hacker News Reader

Comment by cuonic | Hacker News Reader

Here is the full file tree: http://pastebin.com/HWf43kav

Any idea what this is ?

Edit: this article [1] provides more information stating that the list is the NSA's list of staging servers, compromised machines that they use to launch attacks from. Apparently the list is 9 years old.

[1]: http://www.networkworld.com/article/3137065/security/shadow-...

View on HN

Seemly this is a list of several NSA "zombies" used for cyberwarfare.

After googling parts of the file, I found a news report that claims they actually put some of the addresses there in SHODAN and actually did get into machines actually infected with NSA cyberwarfare software.

They can't really get in and scrub these, because people are watching them now, so upside, some poor sap isn't having to go in and do a ton of cleanup work, downside is there are a lot of potential honeypots now.

Scrubbing is the least of their issues. This list will make retroactively attributing attacks to the US a lot easier.

Assuming it's real, and not someone "framing" the US by releasing a list of their own relays.

I was looking through this "dump" yesterday. There's not really much in there other than some hostnames and IP addresses of compromised hosts used by the NSA to launch attacks but some of the "timestamps" were as far back as 2001 (there might be even older, I didn't look through all of the files).

A list of compromised (or C&C) servers, and what tools are being used.

edit: Posted at same time as speeder, what he said.

Reply on news.ycombinator.com