rshnotsecure

Facebook has fundamentally lost control of their infrastructure. It is insanity. There are now VPNs out of Hong Kong operating output of FB ASN space. I truly have never seen anything like this in my life.

At FB the morale has collapsed. The support forums and bug bounty submissions are piling up and have been for weeks.

FB cannot and will not act. It is a problem of leadership not engineering and I have tremendous respect for nearly all of the staff there.

That being said the fact that Facebook continues to ignore that servers in Vietnam are hosting what appears to be all 71 million records of the Vietnamese ppl is shocking. If you are a Muslim in Vietnam the information is shockingly detailed.

http://125.212.244.27:9200/_cat/indices

So much of the modern corporation has been outsourced...including nearly all research. Most animal research today and Phase II trials are done...in China/India.

The evidence that these studies are largely faked due to the pressure put on the staff and management there has been piling up for years. I would recommend “Science Mart: Privatizing American Science” by Philip Mirowski for more on this.

Quick question, has anyone here heard of a very odd company in Kansas City called...https://joesdatacenter.com.

All of the staff on LinkedIn exist...but there are only 3 of them and apparently the founder and CEO just got out of community college?

They claim to have at least a few ten thousands of floor space, so that must be minimum $25 million in server capital assuming all are used.

They also for some reason broadcast incredibly interesting weather data from the top of the building: https://joesdatacenter.com/hvac/

I currently work in San Antonio as a short term contractor for a SOC (many military bases and sizeable banks here) and last night an incident was raised and a breach somewhat close to being declared and we are getting pinged is it Tsinghua? is it APT 17? to which we have to respond seriously on Slack...no it’s “Joes Datacenter” ASN 19969 out of Kansas City.

Here's the Vietnam server: http://125.212.244.27:9200/_cat/indices

This is the indice you are looking for. 71,000,000 records.

yellow open fb_vietnam ChkUhOlHQpO_RozynrZdXA 1 1 71839979 11829285 10.1gb 10.1gb

You are right on the 96 hours vs 42 days thing though. It's a lot of work man. No one has volunteered to help. There are a ton of ASNs what can I say lol. I will post about CreditKarma today. Not ProtonMail.

Type in "openvpn.creditkarma.com" to Spyse.com please. What do you see? It says it points to a server in Tunisia right? And that server has 10,000 other host names on it almost all from...hnagroup.com? China's really really big private conglomerate correct?

Anyway again you are right, but I'm tired, I posted the Vietnam server (at least enough data to confirm amounts although we can debate purpose of cluster which is fascinating).

EDIT: Damn it I just realized your account was created new a few hours ago. Can't you use your real name like I do? Maybe email me?

NOTE: To your credit I finally posted. Like 1250 words but we'll get there. My wife wants me to move the butcher paper after all :) https://blog.12security.com/

Look in my profile for email.

Do you want to email me? You can find it if you have SecurityTrails subscription, but that is like $500 a month also. I assume you mean the CNAME record right??

Over the last 2 months, I've noticed Facebook has almost completely stopped responding to any vulnerability finds or bug bounty tickets submitted. It's gotten really bad.

For instance, right now all 70,000,000 of the Facebook users in Vietnam have their information posted online on an open web server. I am not going to post it just yet in the last hope that someone from FB will reach out to me, but the info is their along with their IMEI number, cell phone number, information on what ads they've seen and clicked on, etc. For some users there are absolutely private messages, it appears to be only for Muslims in Vietnam though (so not all nor am I saying all).

Until yesterday, the S3 bucket https://whatsapp-messages.s3.amazonaws.com was open. You can search CNAME records if you have a SecurityTrails subscription, and this bucket belongs to a certain FB contractor. In fairness it could have been something known as "Domain Shadowing" whereby you secretly hack a groups subdomain records for evading firewall purposes, but in that case the argument still stands.

It had over 13,000 pictures from various Latin American police departments that change every few days while I tracked it.

NOTE: FB Security ppl, my email is in my profile.

EDIT: This is a very good paper from Tsinghua University in 2016 on Domain Shadowing, which more people should be aware of. Check your subdomains, and make sure you use the free option in SecurityTrails to do it. Passive DNS checks aren't enough here: https://faculty.sites.uci.edu/zhouli/files/2018/09/ccs17.pdf

Signal has an option to send as an SMS message. To me this is preposterous. No one who uses Signal should want that option to be as easily set as it is at least on Android phones.

Also maybe she copied and pasted the term within Signal, but still left it on her keyboard?

Also it’s pretty much not a good idea at all to enable 3rd Party keyboards. Does she have one of those, for instance like with TextExpander?

SiteGround, along with Singlehop, is a Chinese front company for the military. I don’t necessarily blame them for buying out the world’s registrars and hosting services...the rollout of Tor was a giant wake up call to the CCP that can theoretically run almost anywhere as it is software. The only way to compete with such a high level software solution is to make absolute sure you have as much of the hardware boxed in and squatted on as possible.

The proof btw is the fact that some of Siteground’s servers are using banners that are only used by a specific set of companies in China...the “sinister 6” I once heard them called. Venus, TOP-SEC, SANGFOR, NSFOCUS, and Hillstone Networks were all formed in the early 1990’s (some under different names) by the MSS, the Ministry of State Security. It is like a combination of the CIA and the FBI. As for the last of the 6, that would fascinatingly need H3C, formed out of a partial merger between Huawei and 3Com.

All of these companies sell exclusively defensive firewall, DDOS and NG-WAF-like products. At one time there mission was more defensive, the Chinese were paranoid, rightly IMO, that they were running entirely on American software and thus very vulnerable (with the exception of the Titan Rain attack in 2003). However after the GFC in 2008, as hacking became more aggressive, China would start leveraging these firms for surveillance and DDOS on an extraordinary level. Now they have grown so bold as to do things that are frankly somewhat humorously obvious if the situation was not so serious and the political leadership of most countries devoid (purely due to birth years and what they were exposed to) technical experience.

EDIT: because the Alexa Top 1 Million is pretty well sanitized, best resource I recommend is a book from the Naval Institute Press that came out two weeks ago: https://www.usni.org/press/books/chinese-communist-espionage

Also would like to add that a few “.su”, for Soviet Union, TLDs are still out there. I believe the TLD was available for something like 12-18 months before the dissolution on December 31st, 1991. The sites still work. Would love if someone could post some examples.

It is associated with name. A domain held by them had a link record that pointed to this bucket. Also previous acquisitions of TikTok have buckets, currently open, and those have metadata which shows ownership.

Either way, TikTok won’t even respond, which is very sad and absolutely deserves a response so the few researchers don’t have to waste time following up.

NOTE: Your point makes sense though and I’ve run into this before. 100% agree with you and I should have mentioned the anchor link found.

I think this says all we need to know: http://pro-tiktok.s3.amazonaws.com

Notice the file left in there by a previous explorer of the internet. This gentleman has even found RCE exploits with TikTok, and they simply do not and will not respond to their security line. Olivia Newton at NBC I believe even reached out, and she could not get them to get back to her. I forwarded this (really another bucket of equal content still lurking out there) several times to Brian Krebs but he never responded. I only mention his name because it has happened before and find it somewhat damaging to the community and it needs to be called out (with fill acknowledgement that journalists get hit up by PR ppl all the time and it’s a tough job).

Yes please see Stephen Schneider’s book talked about in The NY Times in 1976. He worked at NASA at one point: https://realclimatescience.com/wp-content/uploads/2018/05/20...

This is what I came to say. There were very definite beliefs and they were pretty reasonable (although the evidence did not bear out) about global freezing in the early 1970s.

Interestingly, we might compare this with the popular idea of Nuclear Winter at the time. Essentially, a nuclear war was supposed to ignite a global conflagration that would incinerate the skies and burn so much smoke to block out the earth. But 1). The calculations were excessive in terms of the number of smoke supposedly produced and 2). Bombs became so powerful and caused such a shockwave as to almost extinguish their own fires.

I would also like to add signing up for an AWS Gov account was at least 12 months ago...a completely automated process where I was approved in no more than 15 mins. The account had a credit card but otherwise was 100% still in free tier mode, and in fact was being used by an open source team so it included ppl from around the world.

The CIA has stated multiple times in court documents (typically they have emerged in cases where the FBI attaché that all embassies have post-911 or someone similar is testifying) concerns about this and why they demanded and got “AWS secret”, a level higher than gov, that was opened in 2017.

Keep in mind though that many governments at state and local still use the TLD of “.us”. For instance Texas has widely used, until within the last year, “https:<subdomain>state.tx.us”. Many states have this legacy naming convention left over, and of course the restrictions are about as somewhat paper thin and avoided on .us as they are on .gov but more. There are changes in the works for this though.

More concerningly though is that the recent issue with the .org TLD clearly, and this can be proven in a straightforward manner, involves a group with unlimited funding by the People’s Liberation Army making this purchase. Ethol Capital is a joke of a firm. They’ve already sanitized the Google Search Results about them, which lol should be obvious when you realize they have taken out a Google Ad for “keypointsabout.org” when you Google them. The proof though is that if you look at court documents from 2015 you will find mention of a firm...SharkTech. Another front company that the PLA loans out from time to time to the Middle East and even as I recall Israel. Anyway as I’ve stated before in comments if you do the reverse Whois searches and dns subdomain enumeration you can find the trail back to No 31 Jin-rong Street. I’ve been asked before to write a post about this always elaborating and Christ I finally took out a domain https://blog.12security.com ... it has nothing on it but Jesus just look at the DNS records it took forever to get that DMARC record to the strictest level involving no 3rd parties and also to split that DKIM key across 3 txt records...which you have to do sometimes for the 2048 keys.

EDIT: forgot to mention there is obviously a connection between SharkTech and Ethol Capital. That will be proven in the blog and it is on me and my very tardy credibility to do it :) look at http://dcsmanage.com out of Los Angeles though if you want to get a head start, and if anyone claims that’s a real IT firm...

Not VPNGO. It’s one of the many fake VPNs that China either builds or acquires.

My proof is me staring at their Elasticsearch logging server right now, which has no authentication on Port 9200.

Have been trying to reach them for weeks. They are doing some less than honorable things on their network as well that you can if you spend a few minutes studying the logging system.

http://164.52.33.19:9200

EDIT: for those not familiar with Elasticsearch, try expanding the URI paths... http://164.52.33.19:9200/_cat/indices

I would make sure to use Google Cloud Print, and restrict all local access to your printer (e.g. can only print via Chrome via Google Cloud Print).

Typically printers will expose more security settings via SNMPv3 and you should take advantage of these (absolutely amazing learning opportunity for up and coming sysadmins/cloud engineers too).

I think HP is highly underrated for their printer security currently. Yes, it’s probably hackable in 5 mins like everything else in that space, but it has signed firmware! And they are the first printer company to be participating in a big bounty saas platform! Good things all around.

Also go with a monochrome black and white printer laser toner to really get costs down. You don’t need color as much as is thought...

Did anyone else find Jeff’s first sentence terribly unoriginal and somewhat wimpy?

“We live in a data-intensive, data-driven world!”

I know these blog posts are turned out fast, but especially for such a sensitive issue as a world awash in data that no one understands and no one - yet - controls...it seemed like it was “whistling past the graveyard”.

I have been going back and forth on this heavily, but two weeks ago I reached out to ISC2 and ISACA’s ethics boards to begin exploring the process of terminating the certifications of several FB employees that potentially (let me emphasize 110% blameless until proven otherwise) have been in violation of the ethics code for both of those orgs.

I asked ISC2 in particular that if a certain employee was shown to be on XYZ team that handled XYZ task, if they had say ignored multiple outreaches from the community, and then also (this is key) not raised concerns internally to a reasonable degree that a single individual can in a megacorp...could their say CISSP be revoked. The answer I got was a strong yes in the hypothetical stories I proposed.

I also emphasized that I would be writing an apology to said employee, and offer to resign / terminate my CISSP/CCSP if wrong because we have to prevent this process from becoming a no-lose vindictive game.

Spoofed phone alerts are the new leaflet propaganda. They will be used to generate a significant amount of confusion and some terror abroad by whoever just decides to do it first: https://en.m.wikipedia.org/wiki/Airborne_leaflet_propaganda

Has anyone looked into data blockers such as “PortaPow” on Amazon.com? If they’re a scam that’s fine, but I will never forgive myself if they turn out to be loaded with exploits...

Also can anyone comment on how feasible defenses are against outlet power hacking at say a hotel? Is there any tool under $100 available to the masses? $200?

See above and below.

Check below for latest update. Wanted to comment so you got notification. My real name is in my profile with my email address so you’ve got me dead to rights on this one.

It’s coming. I’ve got butcher paper on the floor mapping out 2000 ASNs. My wife says I look like one of the detectives tracking down a serial killer with red string. I run my own consulting company, and actually lost my main client due to the above post being interpreted as “anti-China”. That has been an enormous setback.

Anyone can do this research I want to emphasize. Look at any suspicious VPN company. Now look at 10 of them. Now plug some of those names into Shodan.

Bear with me here, but if you then simply Ctrl-F for ASNs with the same name with the same LLCs, you will construct a perfect circle of peering that is an “internet within an internet”. What it seems to be is a poor man’s TOR. While the US gov built a Tor, this is an alternate Dark Web built by someone...you can pass through 1,000 servers on 500 different hosting companies none of which do legitimate business.

(Hope this counts as a mini blog post for now this must be 250 words).

They were hitting their limits by the mid 70’s.

The mid 70’s was golden era of supersonic research. Supersonic engines are just regular jet engines with a Turbofan. Add in wings swept further back in a Delta pattern like the Concorde and you have...supersonic aircraft that comfortably can do Mach 1.5-Mach 2.0.

Today, I think there is just 1 functioning wind tunnel in the US that can do supersonic research, so sad. If you live in the Bay Area you pass it, just look at Moffet Field on your way north of San Jose.

The Japanese and Australians, due to their remote location in part, have done most of the significant research of any last few years.

Why did SuperSonics not go anywhere with essentially every major civilian project being mothballed?

1. Materials Science: we simply don’t have reliable data for how long XYZ Metal lasts at extreme temperatures of supersonic flight. If you read Michael Crichton’s Airframe from 1996 (great novel), they mention that aircraft are designed with a lifespan of a human. 80 years. It’s insane how long these things fly. The heat is so extreme, the Concorde would fully extend 1 foot (it was made in part of titanium) during flight. Many crashes have occurred, such as Alaska Airlines Flight 261 in 1999 from Mexico to California, because the maintenance time frames of these parts is still not fully understood. And that’s for subsonics!

2. Noise: No way around it. The decision to build aircraft close to cities was essentially finalized in preparation for World War II. You can dampen significantly, but it is painfully loud. Landing outside the city with fast train back is best solution.

3. Fuel costs and burn. Supersonic research got underway right as Earth Day started. Lots of supersonic tech relies on afterburners, terrible mileage. It was bad timing.

4. 2003 Concorde crash where a tire was hit on the runway, and the entire aircraft exploded. This should have not happened for a tire collision. SuperSonics are fragile because of all the design tradeoffs one has to make (currently).

I suggest looking into the work of Peter Turchin.

Turchin, following up on many precious writers who’ve noticed certain cycles or repeating themes in history, has posited that there is an ebb-flow to history that is about 80 years, about the lifespan of a human.

What drives this flow, in this theory, is majority one force. The rise in birth rates during good times, followed by the trouble of environments and economies to absorb the new individuals, eventually leading to some sort of new adjustment among all players.

Check your double quotes. Also do you have a registered / paid account? Lowest level of paid is fine.

There copyright page hasn’t been updated since 2003...

https://news.ycombinator.com is run by M5 Hosting out of San Diego.

M5 Hosting is also known as M5 Computer Security out of San Diego.

These firms are a strange choice for a place like YCombinator to host I think.

Can we talk? One concern we had was that these cargo ships, some subset of the 220, have nuclear weapons onboard that the crew isn’t even aware of. Much like how the soviets used to hide their ICBMs in train cars that move around, this makes tracking these things really hard.

[email address redacted]