Comment by rshnotsecure | Hacker News Reader

Comment by rshnotsecure | Hacker News Reader

Let us not forget the Netsential leak from #BlueLeaks a few weeks ago.

Netsential.com [1] was a Houston-based software dev, hosting, and cloud provider. I lived most of my life in Houston, and they are loosely connected to an old ISP called Texas.net and a more recent data center company called Data Foundry.

Something like 630+ websites were hosted by Netsential. All of them DHS fusion centers, multi state intel sharing groups, police training outfits, etc. The source code leaked as well for all of these websites. Extremely poorly done ASP.net rigged together "web apps" with CSV files being used for the backend data tier.

Here is the most fascinating thing. 7 years ago, as part of the Edward Snowden document dump, a single page screenshot of an list of the Top 16 addresses the NSA was targeting in North America appeared.

#16 on that list [2], codenamed WAXTITAN, was the IP address 64.9.146.208, which belonged and belongs to Netsential/YHC Corporation [3].

The question now I think is who in the world are these other 15 IP addresses, all of which are scattered around typically rural North America?

[1] - netsential.com

[2] - https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/...

[3] - https://blog.12security.com/darkness-at-noon-01-waxtitan/

This is a throwaway account as I will be mentioning some slightly sensitive personal details.

I do not currently work in law enforcement or intelligence, but for various reasons from some years ago to the present I have been a member of one of the fusion-center-type communities which Netsential hosts. A small amount of my personal information is included in the breach as a result, but of course, this is far from the first time that's happened to me.

I think you have somewhat of a misunderstanding about Netsential's service offerings. While they do provide physical hosting, that is not their primary product, they are not used for "managing the physical servers (think Dell blade computers for instance) that these websites ran on top of" as you say in the blog post. This is only incidental. Their primary product is the software, which is not very good from either a code quality or user experience perspective, but is reasonably unique in its capabilities. They offer a completely "turnkey" solution, including for example a telephone technical support/customer service line for users of the portals that they staff and handles routine things like password resets.

They're not a hosting company, they are primarily a SaaS operation that also does some custom software development.

So it's not at all true that there's no reason to use them over a cheaper service like Azure. These organizations would need to hire some other company to develop the software if they did that, and that would end up costing them more because they'd be looking at a semi-custom project (COTS CMS solutions would partially meet the needs) rather than "just another license" with Netsential.

that is an incredible connection. thank you for sharing. im glad im not the only one who has read most of the Snowden leaks, and whenever anything new happens like a big hack or leak, i go back and search the Snowden files to see if there are any connections.

in that list of program names, i remember seeing WILDCHOCOBO and DARKTHUNDER in other Snowden files.

here is WILDCHOCOBO

https://search.edwardsnowden.com/docs/SPINALTAPMakingPassive...

page 19 of that is very very interesting. it lists around 100 NSA programs that are all part of some kind of global passive CNE implanted on hundreds of servers that provides ingest/exfil to feed back home into XKEYSCORE.

DARKTHUNDER is also on there.

the odd thing is that slidedeck is about NSA program JOLLYROGER tracking SD cards via their unique hardware volume IDs.

why would NSA TAO be hacking MSPs like Netsential at all? why is NSA spying on Fusion Centers, who get their reports from FBI, who themselves got the data to write the reports from NSA SIGINT? why is NSA spying on regional and local Law Enforcement further down the food chain? NSA already has that data. NSA wouldnt even need to use TAO and CNE to collect data from Netsentia. They could just ask for the data.

my best guess is it's some kind of Inside Threat monitoring system. TAO hacks into those systems to install CNE implants that watch for SD cards being inserted, to detect rogue Fusion Center and LE personnel who are bulk stealing files by copying them onto SD cards.

but that seems like a really dumb thing to do. why not just disable the SD card readers and/or remove the hardware? a PC in a Fusion Center shouldnt even have an SD card reader.

ironic, since Snowden roughly implied in his recent autobiography that the way he stole millions of NSA's top secret files was by sneaker net'ing them home using SD cards.

LOL NSA has been screwing up its defense against SD cards for at least a decade and that screw up is what made Snowden possible.

i bet dozens of Russian and Chinese and Israeli moles have stolen far more than Snowden ever took from NSA using

My concern is similar to yours. By hacking and subverting everything, the NSA paved the way / "presented a picture of what was possible" to rogue foreign governments. The US was unprepared for this, and once it was realized, we couldn't even morally accuse them of wrong due to NSA past...

I think US agencies have sort of realized this mistake now, and actually for the last couple of years. The former NSA directors have said some revealing comments that reflect pretty authentic looking doubt, shame, and guilt over the various pathways programs took (with the exception of perhaps Admiral John Poindexter).

Perhaps agencies like the DHS, which when it was created was the largest reorganization of government since the Department of Defense was created in 1947, have not yet learned...

one more thing...

presumably those other 15 IPs are MSPs similar to Netsentia. maybe Phineas Phisher better target those IPs to breach and leak them too.

now that i think of it, maybe every IP address appearing in any Snowden leak should be probed to see if it still leads to interesting goodies.

The NSA was something like 50 miles away from where this data was being hosted. It could have all been hosted in the much better / actually CJIS compliant Azure South at 5150 Rogers Road.

That some random hosting company Netsential, not even a Microsoft Partner was chosen, makes both me and apparently the NSA suspicious.

More than likely DataFoundry is a front company. DataFoundry, which definitely is a real company, was ultimately hosting the Nestential sites. Their founders are former Peace Corps [1] recruits from the 1970's. They look like nice people but definitely not engineering experts. Also everyone at the company has been in place for nearly its entire existence. That is a tell-tale sign of fraud, a tech company should have massive movement within its executive ranks during these last two decade boom years. Also no one I know has done business with them, and even their customer list seems pretty thin when you realized almost all of them have the same one or two Private Equity owners...

[1] - https://www.datafoundry.com/blog/meet-founders-ron-carolyn-y...

While far less interesting, I can't help but notice this quote from your source:

"In addition to Texas.Net and Data Foundry, Ron and Carolyn established a Usenet company, Giganews, and an Internet security solutions company, Golden Frog, which provides one of the world’s leading VPN services, VyprVpn."

How extremely curious -- they are & have been a major seller of Usenet access & "privacy"/VPN services for the past few decades; hmm.

None of this is really that surprising. DataFoundry is a real company and pretty typical for the industry, I don't see any particular reason to suspect that they're a front. They're on the small side for the datacenter/colo sector but similar to something like PheonixNAP. While I can't say I know any of their customers personally I have gotten quotes from them in the past which were competitive but not quite the best available.

No particular technical expertise is involved in running these sorts of companies, those staff are hired. The top-level executive management is more reminiscent of commercial real estate than anything technical---it's buying land, building buildings, and putting tenants in them.

That the owners of the company have been involved in Usenet and VPN services is quite unsurprising---these are both industries that are technically simple, easy to get into, and can show a pretty quick profit. The up-front capital involved to get into them is having rack space and connectivity... things that, as owners of a colo outfit, they already had on hand. VPN services also have a high degree of customer overlap and can share infrastructure with usenet, so there is a VERY high degree of overlap between usenet providers and VPN providers---to the extent that it's more suspicious if a Usenet provider doesn't share owners with a VPN provider.

Reply on news.ycombinator.com