270 karma · joined September 6, 2019
Organs per individual go for $2,000,000 if a full ECMO harvest can be done.
That is quite a bit of money, but illegal medical experimentation, as documented by the book "ScienceMart", generates an equivalent amount. Obviously the experimentees might not wind up completely dead like the organ transplant victims though.
About 40-50k of Zoom's subdomains are customers. Company.Zoom.Us.
About 5k of the subdomains reference MMR. Likely this means "Meet Me Rooms" which are seen in data centers.
About 200 contain the word tracking, 300 the word face, and 400 the word elasticsearch. Something like 700 contain the word vip. Maybe 1000 gitlab. They really like gitlab! These are not customers again and the whole structure is impressive and strictly followed.
IPA is the most used term after zoom of course. I think it is a reference to "international phonetic alphabet" for the China based engineers. Anita is used around 4K times. Likely this references the CFO since 2018.
Most interestingly, every US state and every Chinese province has about 10-20 subdomains carved out for it.
So xj-restricted.acv.ipa.zoom.us refers to "Xinjiang".
And xz-influxdata.amp.ipa.zoom.us refers to "Tibet".
Finally as a last example "va-accounts.asset2.ipa.zoom.us" refers to Virginia one would assume. All the other states are there. Didn't check other countries though.
Have never worked at like an MPLS company but overall fascistic fastidiously well designed naming schema that they had the discipline to adhere to. These can get out of hand so fast at companies so again cool.
This is a term from the US Intelligence Community that refers to the 7 most prestigious universities in China that support the People's Liberation Army. This includes "Beinhang University" and "Northwest Polytechnical University". These schools are closer to the Army in China than say Westpoint is to the Army in the US. These schools guarantee some of the best paying jobs in all of China, and if you desire, a chance to reach the upper strata of the CCP hierarchy. For this, reasonably I think too, they expect a pretty large amount of loyalty measured in decades.
They have overruled consistently (there is nothing wrong with this I am just saying there were objections often) to massive capital infrastructures that make no sense in Facebook and that has always driven the finance people wild.
I don't think there is a conspiracy here. I do think that a lot of specific Chinese hardware manufacturers have gotten very very rich off of these decisions. Their architectural decisions are certainly really strange. They tripled-down on blueray DVD storage in 2009, even though massive cheap flash, then NVMe, then NVMe EVO Plus rolled out in quick succession.
I recommend this report and web app from the Australian Strategic Policy Institute: https://unitracker.aspi.org.au/.
If you look at my previous posts on HN I've written extensively about this topic.
Ignore some (but not all) of the dissenters on here. I don't mean to be rude, but these fake hosting companies are backed by quite the army of pr crisis tech support people, and they will dogpile on a thread like this quickly. You'll sometimes see them leave Yelp and Google Local reviews of their beloved friendly neighborhood data center too (which is preposterous no one does this in real life).
Anyway the clusters you are seeing do not appear to be about observation as much as destruction. From the analysis that I and others have done, our best guess is that someone is buying out hosting provider after hosting provider, and then peering at the 1 Gbs and 10 Gbs level as much as possible.
The purpose of this is two fold. First you are denying your enemy freedom of movement in that area. So think "squatting" or just taking up the board in monopoly.
The second more disturbing piece is that someone is building a kind of DDOS death star that will be unlike anything seen so far. From all the papers I've read, such an attack is likely to come through some novel IOT exploit and perhaps using one of the newer protocols like MQTT or COAP. But owning this much hosting space would be a terrific backup / serve as good defense for the expected counter attack.
This does not bode well at all for Europe. Even if the internet was off for months in the US the country could recover and rearm. All of Europe on the other hand, if stripped of the internet, could be overtaken in weeks if not days if Russia or China were so motivated.
The enormous capital expenditures that these IaaS providers have been sustaining points to China most certainly. Check out also Choopa, Tucows, Enom, Psychz, Shaw, Sharktech, Joe's Data Center, Hetzner, UnityMedia, Incapsula, and Mimecast.
This report is also very helpful : https://transparencyreport.google.com/safe-browsing/malware
Typically this happens on websites that look like junk/ad websites to you and me. Also sometimes they will look like the ads you see on parked domains.
There will be hidden words, or perhaps you will need to know how to adjust the CSS in chrome developer tools. Often times it is a small URI fragment you need to append to the URL, or a specific place to click every time.
Again I want to emphasize how common this is, and the “dark web” is not used nearly as much in terms of overall volume by such groups.
Owlhousing.com was until recently and still probably is one such site. It looked like some junk casino ad website, but scroll down for a very lengthy period and you would find...sophisticated electronic Microscopes for sale out of Hong Kong. Now it is some car website.
The best way to find these websites is to use Spyse.com. Using the “prefix” search operator enter something like “000000000” or “aaaaaaaaa”. Hundreds if not thousands of sites show up. No real person would take out these domains. Start with them.
That being said it should be noted US Naval strategy has never particularly relied on subs or been that great at it.
This has always fallen to the Eurasian powers such as Germany, Russia, and China/Japan.
Nothing has been downed by a torpedo in actual combat for the last 75 years, so realize that there are so many unknowns today in submarine warfare that you don’t see in say land warfare. That being said it looks like Underwater Unmanned Autonamous Drones is where sub warfare is heading. Supposedly China is way ahead of the pack here much like they are in the drone space (supposedly again) as well. The 2016 capture of a US Navy UUAV really was not good for the USA and marked a shift in the balance of power.
Probably discovered by tons of people before me FYI. I’m a mediocre engineer who happens to occasionally uses Shodan / BinaryEdge. The fact that you get treated like absolute garbage if you’re wrong (even if there is nothing to be gained financially) I think suggests why others haven’t spoken up. That and Elasticsearch isn’t the easiest.
That being said, corporations have closed ranks at this point and basically refuse to hire from them.
It’s very sad to see and very unfair and not deserved.
Don’t go into web development also. It’s quite a crowded field even if pretty in demand.
I would recommmend Cloud Engineering especially since you don’t have a network. Pass your associate and pro cert for AWS for instance and that will guarantee you 100k+ job (assuming you don’t have any crazy issues I’m unaware of and have at least basic service industry level experience). After you pass the certs, which takes 6 months to study at a total cost of like $450, maybe 10 business days max to find a job?
What about say configuring my own OpenBSD server to act as a router? I am out of my intellectual depth here but I feel like that would be more secure than Linux in general if we are going for max security.
As governments and private equity groups continue to buy out whatever hosting provider, VPN, Registrar, etc they can find...I feel like Open Source is a pretty soft target in the grand scheme of things. I am trying to become somewhat ruthless in analyzing my dependencies when it comes to software.
NOTE: another commenter mentioned a TP-Link product. Those devices are absolutely insecure to the core of their firmware for the time being. 7 days ago I discovered their completely open production Elasticsearch API server for their entire camera and IOT platform in the United States. It has now been remediated but that event puts under suspicion anything else the company deals with via the TP-Link brand out of Shenzhen.
These posts were rapidly put up as I wrestled with the cloud hosted Ghost platform, so excuse the grammar mistakes.
Further posts on the topic you’re referring to, broad surveillance of the forums, comments, and chat rooms of the internet using streaming timeseries databases, I am working on now.
In fact there is a rule of thumb from the Cold War...US - Nuclear, Soviets - Chemical, Chinese - Biological. Indeed most plagues have originated in China due to the population density and the prevalence of swine (there is a reason many religions don’t consume certain types of meat and in particular pork, it’s correlation with plague goes back thousands of years).
Besides these biological weapons which can be quickly looked up online at US Think Tanks and places like the Army War College...China has also maintained a pretty firm grip on HackerNews.
Twice now as a cybersecurity researcher I’ve come across Elasticsearch clusters employing Logstash in combination with a filebeat that streams in HackerNews topics and comments. This ingestion pipeline seems to be set off if you hit enough “hot words” after which time an Elastalert is sent out to presumably trigger human-in-the-loop to comment and pounce on any criticism. Based on the architecture that I saw in both cases this is a straightforward if not modest and not that sinister interpretation of the infrastructure. Yet it is still very concerning in the aggregate.
In conclusion, China could use these innovations for weapons to kill not as much us as their own people. Additionally their attempts to monitor and at times squelch free speech abroad goes against...a lot of things that people who live in Democracies would agree is valuable and worth protecting.
They also conveniently left open an Elasticsearch cluster with 600,000 US Air Force personnel PII records.
Yesterday it was posted about front companies acquiring massive resources in the US. Who are these people?
Case in point...look at their hosting records. It looks like some malware laden VPS budget hoster from the late 90’s. Incredibly careless setup. Their products also suffer from enormous lag. Again very strange because you can call in and get immediate and overwhelmingly thorough help...not sure why the products can’t just work though.
The main reason is China. In 2010 they used more concrete than all of the United States from 1900 - 2000. Mind boggling. Since concrete is essentially 25% sand or gravel this makes a big dent.
A small but interesting cause of China using so much concrete is the intricacies behind GDP calculation. Essentially building a skyscraper and tearing it down both count towards GDP. Thus if any province is behind on the GDP numbers you will see a rush of construction followed by a rush of demolition...completely pointless.
Also some have commented on the destruction of Uyghur cemeteries by the Chinese as if it’s some Nazi cultural extermination campaign. While I get the comparison it’s really about the gravel in the end. Gravestone robbery is actually a pretty significant worldwide problem, as they can be usually ground up and sold for a quite a bit. This is the motive in Xinjiang for the Chinese.
Supposedly China is also pushing cremation because the ash can be used for treating acidic soil but also as a substitute for sand in concrete.
Also use a pen for underlining. That way you don’t have to switch utensils if using a highlighter when you write in the margins.
Here are the strategies that have worked for me / companies I have worked with:
Doubling down on Google Cloud. Yes they get a lot of grief that is deserved for privacy, but the reality is your infrastructure and data is extremely insecure anywhere in today’s hostile cyberspace. It is the most secure, which might not even be that much, in GCP. There are so many good secure design patterns there that I can barely use AWS in good faith now with a customer even though I owe my whole career, at least the beginning part, to them.
Duo Access - Highly recommend. Great all around. Push notifications to user phones and require location within a specific country and with biometric authorization for the push alert. Add device certs for even more security.
Okta - don’t recommend at all for one reason. To me this felt like a big thing, and that was when signing up for they made you declare answers to security questions. This is a horrible pattern that NIST has come out against for some time. Whose idea was this?
All the patterns are there. Fan out for buffering writes to increase the amount that can be cached for reads, write through cache, write back cache, etc.
First realize that these statistics are calculated via an entire field, known as “medical statistics” not surprisingly, that has enormous controversies inside of it.
Using a variety of mathematical calculations and formulas, they arrive at something called the “average death rate” that is supposed to massage out the differences between geographic regions and populations to determine the final number.
Devra Davis, Ph.D., M.P.H., wrote about this to tragic degree of detail in her book “The Secret History of the War on Cancer”. For background she was Director of the Center for Oncology at the University of Pittsburgh Cancer Institute and is still also a Professor of Epidemiology there.
The cancer death rate has not budged that much in 40 years. Survivability has extended, absolutely, and that is worth something, but not more than a few years. Compared to AIDS, a disease also without a real cure but that has extended survivability by decades this is unacceptable.
The amount of brilliant researchers driven out of the field, the failure of the Susan G Komen foundation to invest in actual research (this can be seen as more of a problem with the nonprofit industrial complex though and not per se cancer research), the null hypothesis requirement failures at NIH, and just the general climate of unethicalness and neoliberalism that began emerging in the mid 1970’s are all blamed, and there is truth in most of those arguments.
There is an old joke about how many white upper middle class cancer patients does it take to screw in a light bulb? Two, one to do it, and the other to write a book about it.
I go back and forth about whether that joke is inappropriate, and Mark Nepo is one such person who falls into that category but has written moving essays about the experience, but every time I read Barbara Ehrenreich’s “Cancerland” it makes me incredibly bitter. And I say that as a person who really likes Tony Robbins for the most part but who still is disgusted by the whole forced optimism cure through hope that the entire industry has turned into in lieu of actual breakthrough achievements. The fact that the latest and even somewhat exciting area of research in cancer treatment is the investigation on the role and use of viruses, a soviet innovation that has been investigated by the Russians since Stalin was alive even though they were mercilessly mocked for decades for this, is just tragic.
This thing is enormous. This just looks...like the whole internet. Do they fully own those undersea lines too like Google does now with theirs? Or are they leased?
I sure hope they don’t turn out to be a front company for a foreign nation’s military lol like I am always on here saying.
Regarding 610, it might exist it might not. Supposedly operating as a “CIA within a CIA”, they are kind of like a Praetorian Guard that reports to the highest levels of the CCP.
Anyway Ren Zhengfei, the founder, is a former Army Colonel in the PLA. He was a specialist in comm systems, and was “laid off” in 1983. This was the same year the MSS was founded, which wound up kind of “stealing” all the intelligence work and signals stuff that had previously been the domain of the Army.
Later the MSS would find it much more advantageous to establish front companies, and it was this wave of front companies with unlimited black budget funding that began in mid 1990s that Ren rode all the way to the top.
FUN FACT: The Green Army, one of the original Chinese hacking groups from 1996-1997, eventually all of its first members came together and established Nsfocus.com which still exists today and is quite big.
Well I posted Part 1 of Credit Karma stuff please look at https://blog.12security.com
The coverage that Skyhook claims to have for instance is extraordinary considering this is totally reliant on Wifi points and cell towers: https://www.skyhook.com/Coverage-Map
You should triple down and write another angry response. Other than this one which is a little snarky (I apologize but it had to be) I promise I will respond to that one as nicely and patiently as I have the others.
Big Hug []
IP:9200/_search?q=myName