Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

https://www.washingtonpost.com/technology/2021/04/24/pentagon-internet-address-mystery/

by jimschley • 5 years ago

578 225 5 years ago

washingtonpost.com

jvdvegt• 5 years ago

Paywall-free link: https://archive.is/tKOOA

codeproject• 5 years ago

Thanks a lot, Appreciate. It is not I don't want to pay the washingtonpost.com. I just don't have time to read them.

pelagic_sky• 5 years ago

Thank you! Had to use Safari on mobile as the captcha did not play well with Firefox.

uptown• 5 years ago

They'll actually take your money whether you read it or not.

joezydeco• 5 years ago

If you have Amazon prime, it's half price and free for the first month.

rch• 5 years ago

I've tried subscribing to a few news sources, including WaPo, but I can't handle the political agendas (right, left, or any of it).

I've had better luck with subscription based aggregators, but nothing exciting enough to want to plug one in particular.

Always looking for new options to try.

dkdk8283• 5 years ago

It’s the principle for me. I won’t support any publication with obvious bias.

GekkePrutser5• 5 years ago

https://github.com/iamadamdev/bypass-paywalls-chrome also really works well on the desktop. Unfortunately I haven't found a way to get it working on Firefox on mobile (the chrome repo also contains the FF one now ;) ). Thanks for the archive link.

PS I understand that websites need to monetise.. But getting a subscription to read one linked article per month or so is just not going to happen. The sites I use a lot I do pay a membership for.

quakeguy• 5 years ago

Great point and totally off-topic, but I wonder if there is someone who reads the NY Times each and everyday in full.

1vuio0pswjnm72• 5 years ago

For text-only view, no Javascript or cookies:

     curl https://www.washingtonpost.com/technology/2021/04/24/pentagon-internet-address-mystery/?outputType=amp |grep -o "<p data".*</p>" > 1.htm

     firefox ./1.htm

saurik2• 5 years ago

Or just not stop after pressing reload, to prevent their paywall from loading.

dr_dshiv• 5 years ago

"large amounts of data could provide several benefits for those in a position to collect and analyze it for threat intelligence and other purposes"

smoldesu• 5 years ago

Another great example of computer literacy in the world of journalism.

LogicX• 5 years ago

pgn6742• 5 years ago

"several Chinese companies use network numbering systems that resemble the U.S. military’s IP addresses in their internal systems"

I don't think I've heard of this before. What does it mean? Does China operate a disconnected BGP network? Or do they have some modified protocol, or what?

woah• 5 years ago

These IP addresses were unused for a very long time, so using them on internal networks worked fine. Once the Floridian company in the article started announcing them, gateway routers on the Chinese internal networks may have started sending their traffic to Florida.

pgn6742• 5 years ago

Ohh, I think I see. So instead of (or in addition to) creating internal subnets inside 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, they set up subsets inside DoD's 11.0.0.0/8 etc., and it worked out because there were no external BGP announcements for those ranges. But now that there are, if they did not explicitly configure their border gateways to route those ranges inside their networks, the traffic may now leak out to DoD's pilot effort.

Havoc• 5 years ago

Why would you do that though when there are perfectly fine internal address ranges available?

Godel_unicode2• 5 years ago

There are lots of examples of this type of "squat space" being used for largely internal addressing in addition to rfc 1918 space:

https://teamarin.net/2015/11/23/to-squat-or-not-to-squat/

motohagiography• 5 years ago

If that were true, depending on path inforation, any botnet or other traffic destined to those networks would end up in this new AS8003 traffic sink, which would create a map of candidate CCP assets to target on the internet.

You could do the same with any AS. I haven't looked into bgp spoofing since about '99, but it seems to have matured since then. The idea of using it as ephemeral canary/honeynet space for tracking botnet C&C traffic seems like a reasonable play.

xwolfi2• 5 years ago

But the internet is not just CCP vs Captain America. I mean my home network has random ips and a shit network admin, so I will also send crap data to the DOD, from Hong Kong.

You imagine the work to figure out if my tcp heartbeats between my torrent server and my nginx proxy are CCP botnets or me misconfiguring my router ? From the same place kinda ? And you imagine the amount of people we are in China that are doing shit networking but not CCP-relevant things ?

And the amount of botnets we have in China that are to scam each other that even the CCP doesn't want ? :D

walrus016• 5 years ago

Lots of less clueful network operators worldwide have used the DoD /8 IP blocks internally, under the impression that they'll never show up in the global v4 routing table, essentially for the same purposes that people would use the 10/8 RFC1918 blocks.

jeroenhd• 5 years ago

Some of those less-cluefull operators include Juniper and Azure[1], Cisco[2][3], and probably many other companies. When Cloudflare put its 1.1.1.1 DNS server into use, it started receiving huge amounts of packets destined to unroutable addresses because the 1.0.0.0/8 space was (mostly?) unused.

If you configure your routers correctly, none of these IP addresses should resolve, anyway. If something in your network is intentionally dialing the department of defence, you probably have some kind of problem at hand. In theory this might become a huge problem, but in practice it probably won't.

[1] https://www.juniper.net/documentation/en_US/vmx/information-...

[2] https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2017/pdf...

[3] https://security.stackexchange.com/questions/157682/why-does...

photon-torpedo• 5 years ago

If I remember correctly, one of the large Chinese supercomputers (ex #1 in the TOP500) uses the 11.0.0.0 address space for its internal network.

TechBro8615• 5 years ago

Way back when, I was working at a startup with little clue what I was doing. Long story short, I setup a VPN network to connect 600 devices through 8 wifi routers to a VPC. I used 11.0.0.0/8 because I didn't want to bother sorting through the conflicts with 10.x, 192.168.x, and 172.x which were all used at various places throughout the chain (e.g. the routers on 192, some upstream services on 10.x and 172.)

All I had to do to make it work, IIRC, was add an ip routing rule to prioritize our internal routing for traffic on 11.0.0.0/8 instead of sending it over the default interface.

This solution worked fine, but it broke in weird ways and I remember one time I did arp -a on one of the Amazon boxes and saw some DoD registered addresses, which was a little alarming, but I just chalked it up to my not understanding the details.

twic2• 5 years ago

I did the same with 51/8 back when that was owned by the UK Department of Work and Pensions but not publicly routable.

fred256• 5 years ago

Not just Chinese companies. I know of one FAANG company that used internal IP addresses in the 11.0.0.0/8 space (in addition to, not instead of, RFC 1918 space).

walrus016• 5 years ago

Every time I've seen this it's because of inefficient and wasteful use of 10/8 internally. Like, not every tiny site or thing needs a /24. Once the wasteful use becomes entrenched as a practice, it would be very labor intensive and time-consuming to go on a renumbering plan. As compared to the effort to just use 11/8.

And then ultimately because of refusal to get over the technical hurdle of using IPv6 for internal management.

snowwrestler• 5 years ago

Well I would hope it’s not Apple since they already own all of 17.0.0.0... one of only 7 private companies that own their own /8, as far as I know.

globular-toast• 5 years ago

Why don't they use IPv6? Is there still a lot of hardware out there that doesn't support it? It seems perfect if it's internal only.

nanliu• 5 years ago

Alibaba for example use DoD address ranges for their management servers running Alicloud services. They assumed since nothing in their cloud platform would connect to those addresses they can use these them to alleviate IPv4 shortage. In Alicloud, the customer have the right to use any RFC1918 addresses, so they had to be creative since they didn’t have sufficient IPv4 addresses.

sterlind• 5 years ago

but if they're not filtering BGP announcements for those ranges (however unlikely), and the GFW isn't blocking traffic out to those addresses (even more unlikely), and the internal metrics were high (super unlikely), I guess it'd slurp out all the traffic? maybe this was a weird smash-and-grab.

tyingq3• 5 years ago

Still seems a bit odd to me. It doesn't explain why "GLOBAL RESOURCE SYSTEMS, LLC" is involved. Poking around, the individuals associated with that aren't government employees. The company was formed 9/8/2020 in Delaware.

Fnoord• 5 years ago

Means nothing. Companies can be a front for a government.

tyingq3• 5 years ago

Well, yes, but I'm interested in "for what purpose, in this specific case".

cronix• 5 years ago

If I were to guess, because private companies aren't subject to FOIA requests. It's a little trick the gov't has been doing for some time now to avoid legitimate, legal scrutiny by the public.

mattkrause• 5 years ago

Outsourcing to private companies also (somehow) appeases the "small government" folks, even when it costs more/works worse.

ttul• 5 years ago

Who are the people associated with that company? I’d like to further investigate them.

tyingq3• 5 years ago

You can look up the company name on Florida's Division of Corporations: http://search.sunbiz.org/Inquiry/CorporationSearch/ByName

The Delaware company is registered there as a an "outside of the state of Florida" entity operating in Florida. Some actual people names are listed. I'm fairly confident it's the same company, as the Plantation, FL address is there.

WarOnPrivacy3• 5 years ago

I'm posting what I find here: https://news.ycombinator.com/item?id=26929926

Patriot89• 5 years ago

There's a reason it's a Florida company. Florida is the only state that provides for "double blind" corporations whereby the people associated with it can remain completely anonymous. Look it up if you aren't familiar.

chiph2• 5 years ago

When you want to do some secret squirrel stuff, you start a small closely-held company.

Wait until you read about Air America - an actual airline started by Claire Chennault (of Flying Tigers fame), that was bought by the CIA in the post WW-II years and used to run missions in Southeast Asia up until the mid 1970's.

https://en.wikipedia.org/wiki/Air_America_(airline)

djoldman• 5 years ago

https://outline.com/3HuXPj

gumby3• 5 years ago

This is a complete side point, but what does this sentence mean?

Created in 2015, the DDS operates a Silicon Valley-like office within the Pentagon.

wslack2• 5 years ago

The office has a deliberately different type of culture.

Edit: more info at https://www.dds.mil/about

gumby3• 5 years ago

Thanks for that informative link. I had no idea.

Angostura• 5 years ago

This page suggests a really interesting way of organising things: https://www.dds.mil/team

splithalf• 5 years ago

Open office plan, ping pong and bean bag chairs. Slogans on the walls. Sit stand desks. Lots of h1b workers. Have you never silicon valley’d?

dogman1445• 5 years ago

DDS hires professional engineers at a special paygrade pegged to their civilian pay stubs for a 2 year tour of duty fixing pressing issues in DoD tech via pretty broad authority to sidestep

A) the usual senior military slow-roll* in the way of these fixes

B) the sh**y govt contractors who made the tech and usually get paid to fix their own bad tech.

DDS Hires a lot of motivated engineers who would be in civil service but for the $180k -> $90k paycuts and fear of bureaucratic hell. It is run by one of the ~founders of opentable who, post opentable riches, was flying on 9/11/01, decided to join the Chicago PD as a result, did west Chicago homicide until the PD discovered his past, he then stood up Chicago’s data-based policing technical approaches, and eventually the Obama admin heads about him asked him to take over DDS (iirc, +/- details there).

Cool stuff and I’d work for them in a second, probably need another few years in private sector though.

kingkilr• 5 years ago

I don't know Brett super well so I can't speak to the rest of his background, but it's not correct that the Obama admin asked him to take over DDS.

DDS's founding head was Chris Lynch, who served in that role until the middle of the Trump administration, when he left government service and that's when Brett got the job.

gumby3• 5 years ago

This is quite interesting — glad I asked!

kelnos2• 5 years ago

DDS hires professional engineers at a special paygrade pegged to their civilian pay stubs

I wish USDS would do this as well; I feel like they'd attract a lot more talent. Although perhaps they want to attract exactly the kind of talent who would take a big pay cut out of a sense of service/duty.

Cool stuff and I’d work for them in a second

For myself, while I recognize that military is a necessary evil in the world we live in, and I have a ton of respect for the people who put themselves in harm's way, working for an org with a .mil address would be against my values. I'm so torn, though, since (e.g.) the Internet itself came out of the DoD. It's a hard pill to swallow for me sometimes that a lot of essential civilian tech was originally developed by or for the military.

lotsofpulp• 5 years ago

More money, I assume. The government does not want to raise all programmers’ pay, so instead of adjusting the pay schedules that apply to everyone, they make a special group that the normal pay schedules don’t apply to.

I wonder if it came about because how much of a dumpster fire the first version of healthcare.gov was for the premier of the Affordable Care Act. That probably embarrassed a lot of people.

wslack2• 5 years ago

healthcare.gov's problem led to a rescue team, whose members helped to start USDS, whose members helped to start DDS!

To your first point, it'd be more accurate to say that many government offices often don't hire any programmers, which can (among other issues) make it challenging for those offices to select strong contractors.

soared• 5 years ago

The first paragraph a job description gives some context to their culture:

How do you feel about the cloud? Specifically, what are your thoughts on the cumulus clouds of Bespin? Do you believe Cloud City is composed of only cumulus clouds? Do you have any idea about what we are asking? If your answer is yes, definitely read on. If no, still read on, but we might find your lack of faith disturbing!

coderholic• 5 years ago

Some details about the ASN announcing the DoD prefixes: https://ipinfo.io/AS8003

It looks like they're not just announcing 11.0.0.0/8 but also a bunch of more specific routes, including 11.0.0.0/13 and 11.0.0.0/24

It looks like currently their only peer is Hurricane Electric: https://ipinfo.io/AS6939

cptskippy• 5 years ago

One peer? Does that mean all that traffic is flowing through Hurricane Electric?

j03b• 5 years ago

Yes, it does.

If you traceroute to any of the announced prefixes you'll see that you enter HE space (but as far as I know won't ever get a ping to the destination IP).

ThothIV• 5 years ago

Also adding 255.0/8 and 255/4 which is essentially just... IPV6. So we're finally going ipv6, I guess!

icedchai5• 5 years ago

I think you mean 240/4, which is the former "class E" space.

yftsui2• 5 years ago

Previous story in 2015: https://news.ycombinator.com/item?id=10006534 . This article is exaggerating by saying it happened overnight, which started actually 5 years ago.

frombody• 5 years ago

Global Resource Systems LLC was only created in September of last year.

It is very much worth asking who this legal entity is and why a private company is better suited to these efforts than the government.

yftsui2• 5 years ago

I read the article but I believe the key point is since when 11.x.x.x stopped being dormant addresses, instead of these IPs just transferred ownership but not “dormant”.

As an interesting fact, when searching “aliyun 11.0.0.0” which is the mentioned Chinese cloud provider I believe, they apparently has been using that as internal IPs since 2015 as well

jessriedel• 5 years ago

In practice the US government is constrained from paying market rates for tech talent. It can either hire companies to complete the entire project, or it can hire a consulting service (which skims off a massive overhead) to provide technical talent inside a government agency.

saurik2• 5 years ago

The mailing list archive for this gig reorganized for some reason, so I imagine the URL for it should now be https://mailman.nanog.org/pipermail/nanog/2015-August/078058...

tiernano2• 5 years ago

when digging though some of the IPs, i came across 22.0.0.0/8, which if you look at the DNS tab of bgp.he.net (https://bgp.he.net/net/22.0.0.0/8#_dns) shows a LOT of people are "using" those IPs... which means a LOT of people wont be happy that their sites, email, dns, etc, are now essentially being blackholed... for me (I run AS204994), the traffic hits Frankfurt (i peer with HE there) goes over their network though Paris, then to Ashburn and then is blackholed... gone after that... wondering how much traffic is being seen by he.net with this...

icedchai5• 5 years ago

If they're using them for internal networks, they'll (probably) work just like they did before. It's likely many folks are using these as like private RFC-1918 addresses.

tiernano2• 5 years ago

If they are private, which they could be, I wonder why they are showing up in public on there... Also, ripe.net has ripe stats... Checked a few of the ranges and seen people other than the dod and these lads announcing the range...

dang• 5 years ago

(via https://news.ycombinator.com/item?id=26924988, but no comments there to speak of)

client4• 5 years ago

T-mobile does the same thing.

drawkbox2• 5 years ago

Defense Digital Service (DDS) authorized a pilot effort advertising DoD Internet Protocol (IP) space using Border Gateway Protocol (BGP). This pilot will assess, evaluate and prevent unauthorized use of DoD IP address space. Additionally, this pilot may identify potential vulnerabilities. This is one of DoD’s many efforts focused on continually improving our cyber posture and defense in response to advanced persistent threats. We are partnering throughout DoD to ensure potential vulnerabilities are mitigated.

Interesting, seems an effort to find out who was abusing ranges that were exclusively allowed or disallowed based on the ranges. Malware that tries to look like something else that uses a state level IP range to evade blocking, or check for blocks.[1]

I interpret this to mean that the objectives of this effort are twofold. First, to announce this address space to scare off any would-be squatters, and secondly, to collect a massive amount of background internet traffic for threat intelligence.
On the first point, there is a vast world of fraudulent BGP routing out there. As I’ve documented over the years, various types of bad actors use unrouted address space to bypass blocklists in order to send spam and other types of malicious traffic.

Cloudflare example shows how much traffic some of these ranges that are included/excluded have when turned on.

On the second, there is a lot of background noise that can be scooped up when announcing large ranges of IPv4 address space. A recent example is Cloudflare’s announcement of 1.1.1.0/24 and 1.0.0.0/24 in 2018.
For decades, internet routing operated with a widespread assumption that ASes didn’t route these prefixes on the internet (perhaps because they were canonical examples from networking textbooks). According to their blog post soon after the launch, Cloudflare received “~10Gbps of unsolicited background traffic” on their interfaces.
And that was just for 512 IPv4 addresses! Of course, those addresses were very special, but it stands to reason that 175 million IPv4 addresses will attract orders of magnitude more traffic. More misconfigured devices and networks that mistakenly assumed that all of this DoD address space would never see the light of day.

Looks like a new cybersecurity policy/process started on inauguration day. Probably a defensive or offensive measure to combat the supply chain attacks that may well have used those ranges in evading blocking.

Why use a front company? As a honeypot.

If other scammers are using spoofing the ranges then another company does it, that doesn't raise alarm in the other entities abusing the same trick. If you announce it as DoD then it may scare off the others.

In any good investigation, you want to shroud the data/intel collection. Using a front company, or series of levels of fronts, is the way you have to go about it.

[1] https://www.kentik.com/blog/the-mystery-of-as8003/

throwaway2474• 5 years ago

Can someone explain how we know these “announcements” are real? What’s to stop me setting up a company and announcing random dormant address ranges that I don’t own?

judge20202• 5 years ago

rpki[0], but that doesn't mean fake bgp announcements, considered bgp hijacking[1], don't happen[2].

Once every t1 drops invalid prefixes, then rpki will effectively mean no T1 can turn off the internet for other ASNs, but everyone signing their prefixes is required to mean nobody can fake announce an IP.

It looks like the DOD's routes are indeed signed[3].

0: https://isbgpsafeyet.com/

1: https://www.thousandeyes.com/learning/glossary/bgp-route-hij...

2: https://hn.algolia.com/?q=bgp

3: https://bgp.he.net/AS8003#_prefixes

erinnh2• 5 years ago

The HE link doesnt mean they are signed. It just means the IRR records are correct. You would see a green key on the prefixes if they were signed (and correct)

The prefixes are in the https://www.radb.net

Somebody (as everybody can do this with radb) said to RADB that 8003 is the correct origin for these prefixes.

Considering the DoD hasnt rained hell on the RADB, Id guess theyre good as well, but its not RPKI signed.

cjhanks• 5 years ago

Hopefully not too off topic. How do people monitor these BGP announcements? Is it possible for laymen to monitor such route rules?

ta9882• 5 years ago

Have a look at that: https://github.com/nttgin/BGPalerter

WarOnPrivacy3• 5 years ago

TampaBay times has a more detailed article w/ some details from netsec researchers. They're indicating a well-known spammer is behind the company.

https://www.tampabay.com/news/military/2021/04/24/pentagon-m...

This Sunbiz record has company principals and filings from 2007-2013 - inc names (not in TBT article) and another dropbox address, this one in Chicago

http://search.sunbiz.org/Inquiry/corporationsearch/SearchRes...

That Chicago dropbox address is currently shared by:

This intellectual property law firm https://www.greengriffith.com/contact/

This venture capital firm http://www.lakecapital.com/contact_location.asp

This management company adds another name and address and is tied to the FL addresses https://floridadb.com/company/M06000002257/filinet-llc

OpenCorpWiki has an additional dropbox addy down the street

https://opencorporates.com/companies/us_fl/M20000009226

note: The BBB listing confirms reconciles FL address w/ the domain https://opencorporates.com/companies/us_fl/M20000009226

This mailing list has been following the same trail I have https://www.mail-archive.com/nanog@nanog.org/msg112229.html

paledot• 5 years ago

My reading of the Tampa Bay Times article is that the company name was copied from that of a supposedly defunct front for a spammer. The individual supposedly behind it has done DoD contracts before and has supposedly retired.

Both of these leads have a lot of "supposedly"s attached, but the one to the spam front is a lot more tenuous.

WarOnPrivacy3• 5 years ago

This is helpful. Thank you.

walrus016• 5 years ago

The CEO of ARIN has confirmed that the DoD has authorized this specific company to advertise these prefixes, so if there's any known spam or fraud involved, you might want to take that up with the federal contracting agency which issued the contract to this company.

j3th9n2• 5 years ago

My theory: apparently a lot of companies use the IP-addresses internally. And apparently the intention was to sell the IP-addresses already for a long time. But buyers would be faced with a lot of traffic coming from all those companies using the ranges internally, instant DDoS. Maybe this is an attempt to "clean" the IP-addresses before selling them. It will probably only take time before most companies using the ranges internally and having problems now (or happily continuing business now with the help of Pentagon servers), to reconfigure their networks to fix it. In the meantime the Pentagon can probably collect some interesting traffic, speeding up the whole process of reconfiguration by companies who use the ranges, to prevent their secrets from falling into exactly the right hands.

mvolfik• 5 years ago

why would somebody use public ranges (even though unused) internally?

j3th9n2• 5 years ago

This comment shows why for example: https://news.ycombinator.com/item?id=26927455

peter_retief• 5 years ago

When is everyone going to start using IPv6? If ever? I have tried but find that so many ISP's actually block IPv6 traffic.

jeffrallen• 5 years ago

Two words: network telescope. See CAIDA's papers on their network telescope.

cbar_tx• 5 years ago

are we really pretending this isn't just the mass surveillance machine roaring back to life?

SixDouble5321• 5 years ago

Are we really pretending that it ever stopped?

Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

Related Stories