Tech CEO pleads to wire fraud in IP address scheme

https://krebsonsecurity.com/2021/11/tech-ceo-pleads-to-wire-fraud-in-ip-address-scheme/

by sandebert • 5 years ago

188 78 5 years ago

krebsonsecurity.com

karmanyaahm2• 5 years ago

imho ARIN should let these shady companies own IPv4. Only driving up prices of v4 will promote v6 adoption.

Scoundreller• 5 years ago

If a government was smart, it would create an IPv4 tax and capture that value for itself.

Tax the inelastic and all.

onphonenow2• 5 years ago

For sure.

This has the secondary benefit of freeing up unused space.

b112• 5 years ago

This is unfair, for those waiting for ipv8.

greyface-• 5 years ago

The US DoD owns 14 /8s and appears to be preparing to sell some of that space. Value captured.

nlitened2• 5 years ago

Which country’s government and why?

iqanq• 5 years ago

CGNAT exists (and it works well).

yholio• 5 years ago

Cancer exists too, and it's effective at what it does.

throaway46546• 5 years ago

Dumpster fires exist (and are a valuable source of heating).

MertsA• 5 years ago

CGNAT exists (and well... it "works").

FTFY. CGNAT means consumers get to be behind a double NAT, no port forwarding, poor P2P support, etc. CGNAT is the IPv4 solution of last resort.

imdsm2• 5 years ago

IPv6 was poorly designed, and will never be fully adopted because of this. Unfortunately, we seem to be stuck between IPv4 and IPv6 when really, what we need is a new solution, something better designed and easier to adopt.

camkego• 5 years ago

That's a strong statement about IPv6, is there an article or paper you are referring to?

Plasmoid• 5 years ago

I've heard people complaining how hard IPv6 but I've never see a plan that is actually easier than migrating to IPv6. It's always massive CGNAT investment or making non-backwards compatible changes to IPv4 that is somehow "easier" to work with.

nativeit3• 5 years ago

Wouldn't this be the kind of thing that would be ripe for a startup to make easier/more accessible through abstraction? Maybe the risk of fracturing an already dense protocol into multiple competing approaches isn't worth it, but my personal experience with IPv6 is also that it can be intimidating and confusing for the uninitiated (of which I am).

sterwill• 5 years ago

IPv6 works fine. It's all over my house, my mobile devices use it all the time (they're probably IPv6-only over LTE at this point), and I don't have any problems when I occasionally have to type in an IPv6 address. I don't see how you'll wrench IPv6 out of the billions (?) of devices using it and make them use anything other than IPv4 at this point.

brian_cunnie• 5 years ago

IPv6 was poorly designed.

I'd like to point out some design decisions I love about IPv6:

- 128-bit addresses instead of 32-bit. I can't imagine having a shortage of routable IP addresses for a long, long time.

- I don't have to use NAT if I don't want because there are enough IP addresses to go around. We've grown so used to NAT that we take it for granted, not recognizing it for the ugly hack it is. On my home network, just about every machine has a routable IPv6 address.

- A consistent subnet: it's almost always gonna be a /64. When I lay out my networks, I don't have to regret specifying a /24 and then, as the office grows, wishing I could extend it to a /22. Every IPv6 subnet is big enough.

- A consistent subnet means that you don't need to use a subnet calculator as much.

- Not wasting .0 and .255 addresses (network & broadcast addresses). It's particularly bad with very small subnets (e.g. an IPv4 /30 wastes half its usable IP addresses).

- On that note, I like having my machines being able to have a .0 (::) address. My favorite IPv6 address? 2600::. You can ping it to see if your connectivity is working.

- ::1 is loopback. 127.0.0.1 is lookpback on IPv4, but 127 is a kinda weird number (okay, it's 2^7 - 1, but it's still weird).

- Without NAT I don't have to worry about network collisions when I VPN into corporate ("What? They're using 10.0.0.0/24? That's my home network's subnet! Dang!").

sebmellen• 5 years ago

The VPN connection here intrigues me. Do these VPN companies know how their IPs are being procured/by whom?

In a 2020 interview, Golestan told KrebsOnSecurity that Micfo was at one point responsible for brokering roughly 40 percent of the IP addresses used by the world’s largest VPN providers

This would be an interesting deep dive for a tech-focused investigative journalist.

walrus015• 5 years ago

in my opinion almost all VPN companies are shady/gray-market entities, so yes, they absolutely know.

the colocation hosts and regional ISPs that will accept VPN operators as dedicated server and 1U server colocation customers are towards the more suspicious end of the hosting segment market spectrum, in my experience.

dig hard enough on a modern vpn hosting company with a slick marketing presence and you'll find like, a cypriot corporation with a cyprus bank account run by a guy who 15 years ago was in the adult website hosting business, who currently lives and works remotely from cambodia. Or similar.

AnthonyMouse• 5 years ago

This is kind of the nature of the market.

On the one hand, it's effectively a commodity, so there is a lot of competition.

On the other hand, the entire point is to protect the privacy of the customer. So if you're doing it right and any of your customers are actually in need of that privacy protection, you're going to be taking flack from angry jerks who don't like that you're providing it. The same thing happens to people hosting adult websites, so it's the same kind of people who are willing to put up with that in exchange for money.

radicaldreamer• 5 years ago

The real scandal is the number of vpns routing traffic over random customers networks…

TedDoesntTalk• 5 years ago

None of this is accurate in the slightest for the vpn company i work for. But such vpn companies do exist.

bugbuddy2• 5 years ago

These are very broad and bold claims. Do you have any evidence to support any of these claims you made?

Also, why do you think a shady person would be likely to reside in Cambodia? Do you have any evidence to support this claim?

broknbottle• 5 years ago

I dealt with this guy at a previous role. There was always something off with the LOAs they provided. They came off as somebody that would just badger until they found somebody who’d do something to get them to go away.

loeg• 5 years ago

What does LOA stand for in this context?

RKearney• 5 years ago

Letter of Authorization

opportune• 5 years ago

Not excusing his lying or fraud but this is an excellent way to get things done even in ethical contexts.

frupert52• 5 years ago

It’s a short sighted and poor long term strategy. Eventually no one wants to work with you regardless of whether you can get things done.

Much better to build relationships which enable you to get things done by virtue of others wanting to look after you.

lkrubner• 5 years ago

As the years go by, I have found that some of people who gave me a bad feeling later turn out to be even worse than I first suspected. In my book "How To Destroy A Tech Startup" I describe this guy Milton, who is the villain of the story. He did many things that seemed vaguely creepy, most of which I didn't put in the book because it didn't seem relevant. But I just recently learned he was in prison on charges of child pornography. So, yes, wow, my instincts were right. There was something creepy about him and eventually his creepiness turned out be far worse than I first guessed. The story of Milton is the most extreme example I can give, but I've worked with others who I could tell milder stories about. I had a bad feeling about them, and 10 years later, when I learn even more, the facts justify the bad feeling I had about them.

ShamelessC• 5 years ago

Perhaps picking up on narcissistic personality disorder or something similar?

cleansingfire• 5 years ago

This is why I have a strong No Business With Bastards policy. When someone acts badly enough, they go on the Nope list. I'll work with them if I have no choice at all, but it's consistently worthwhile to avoid those I know I can't trust. For example, Norton were already incompetent, but installing cryptominers put them on the Nope list. See also Oracle. Similarly, in traffic, that guy who does something painfully dumb is likely to keep making poor decisions, so be prepared for that, and increase your space cushion.

cortesoft• 5 years ago

I wonder if this is probability based... people who do a lot of creepy things are more likely to be noticed for at least one creepy thing. If you observe enough behavior in a short period of time to think they are creepy, they are probably doing creepy things all the time.

walrus015• 5 years ago

with suspicious entities I encourage other ISPs to apply the same general principles as KYC/AML (know your client, anti money laundering) investigatory techniques to suspicious neighbor ASNs.

WalterGR• 5 years ago

vs. https://news.ycombinator.com/item?id=29844651 - “How to acquire 1,024 public IPv4 addresses which are worth $60K for $500”. Interesting.

tyingq2• 5 years ago

It is shady, but it's interesting that it's "wire fraud" to me. The laws allow for shell companies, and I assume he was paying. And the thing he was skirting feels more like a TOS, contract rule, etc. It doesn't seem much different from things large companies do for tax purposes, etc. They can sentence up to 20 years per count for wire fraud.

ChrisLomont• 5 years ago

If he's fraudulently making up people to fake ownership then it's not what companies do legally. It's fraud.

techsupporter• 5 years ago

You can set up all of the shell companies you want, but what you can't do is fake notarized statements and induce others to take actions based on them by transmitting them "over the wires." That's what he is being charged with here, because otherwise ARIN would have said "all of these companies are owned by the same person and our rules don't permit address allocations in this manner."

jrochkind1• 5 years ago

Each of those shell companies involved the production of notarized affidavits in the names of people who didn’t exist. As a result, Lydon was able to charge Golestan with 20 counts of wire fraud — one for each payment made by the phony companies that bought the IP addresses from ARIN.

That's the part that becomes wire fraud, says the OP. Faked notarizations of people who don't exist.

cm2187• 5 years ago

There is hardly anything that doesn't evolve the internet one way or another. Haven't all the frauds become wire fraud now? Does this legislation still make any sense?

andreareina2• 5 years ago

I'm not bothered. It's still fraud, and sometimes it's the only thing that sticks (c.f. the Holmes trial).

starwind• 5 years ago

LOL that picture of him is awful. The longer I look the worse it gets

shard• 5 years ago

At first I thought it was a weirdly inept clothing ad, until I realized it was actually the person being discussed in the article. Looking at that picture, I have to actively tell myself to not judge someone by just one photo.

rambambram• 5 years ago

Haha same reaction here, it's awful. When you search for another pic it gets better.

mavelikara• 5 years ago

From 2020 ("That time I was employed by a criminal organization"): https://news.ycombinator.com/item?id=22360642

nativeit3• 5 years ago

The email group thread where Ron Guilmette (security researcher cited at the end of the article) is confronting an Israeli businessman about the alleged theft of the AFRINIC IP blocks is/was available. I ran across it while looking for information related to an aggressive bot scanning ports on my Linodes that happened to be using a /20 involved with the theft. It's a riveting thread for anyone interested in that kind of thing, I'll post back if I can find it again.

nativeit3• 5 years ago

https://mailman.nanog.org/pipermail/nanog/2019-September/102...

That might drop you right into the middle of it, but that's the thread in question.

jlgaddis• 5 years ago

Here's the first message (of tha particular thread) from Ron, with all of the background info:

https://mailman.nanog.org/pipermail/nanog/2019-September/102...

wolverine8762• 5 years ago

I never thought about it this way before: Are we in a dirty industry? Perhaps we should be cleaning up the place, as a responsibility and as enlightened self-interest.

asdfasgasdgasdg• 5 years ago

It's far too big of an industry to call it dirty or clean. This guy was doing dirt, which didn't work out too well for him. And cleaning this type of fraud up is definitely squarely the responsibility of law enforcement, not random industry participants.

Most industry participants are just building things that there is market demand for. That is not necessarily enlightened, but it's also no worse than anything anyone in any other industry does.

wolverine8762• 5 years ago

cleaning this type of fraud up is definitely squarely the responsibility of law enforcement, not random industry participants

According to who? Law enforcement is a last resort, and it reports to the people. People are responsible for their own communities. We live here, we benefit from it.

hericium• 5 years ago

I wonder how large is IPv4 allocation business' impact on the stallment of IPv6 adoption.

Tech CEO pleads to wire fraud in IP address scheme

Related Stories