News for hackers. Stuff that matters.
Re:NSO hacked WhatsApp to spy on top government officials at... by rshnotsecure on Thursday October 31, 2019 @02:30PM (#21412052)
Dozens of tech companies around the world that were established in the last 4-5 years were done so entirely for the purpose of being fronts for spy agencies to engage in the vast collection of data.

This extends also to shipping, licensing, and auditing companies.

One example is https://www.pacificbasin.com/en/fleet/fleet.php

Somehow they’ve managed to assemble the worlds 2nd largest cargo fleet in terms of dry weight tonnage, all verifiable on https://marinetraffic.com btw, and yet they appear on NO LISTING ANYWHERE for the top 100 cargo companies.

That company is a front for the Chinese military, because if you do a reverse WHOIS search you will see http://pacbasin.com was also registered by the same organization...it is an autonomous drone hardware and extended flight operations firm. There is more to say there, but I will leave it at that.

Other firms that have been espionage operations since day one, or were acquired at some point and repurposed as spy outfits. This list includes both Western and Eastern powers:

NSFOCUS Global

psychz.net

mimecast.com

terra.net

protonmail.com

creditkarma.com

ipvm.com

ClearDDOS

Neuvector

Multacom

HighWinds

Black Oak Computers

IT7 Networks

Ramnode

Gorilla Servers

Digital Core

InMotion Hosting

Choopa

LeaseWeb

StackPath

Voxility

Perfect International

Re:NSO hacked WhatsApp to spy on top government officials at... by godelski on Thursday October 31, 2019 @02:34PM (#21412112)
Wait, can you expand on some of these? Like ProtonMail and CreditKarma?
Re:NSO hacked WhatsApp to spy on top government officials at... by teekert on Thursday October 31, 2019 @03:02PM (#21412388)
Wait, what?! This invalidates the entire list for me if there is no further proof...
Re:NSO hacked WhatsApp to spy on top government officials at... by godelski on Thursday October 31, 2019 @03:40PM (#21412791)
Same. But they said they'd make a post on it in a few days, so we'll see.
Re:NSO hacked WhatsApp to spy on top government officials at... by teekert on Friday November 01, 2019 @12:44PM (#21420821)
What do you mean by "it"?
Re:NSO hacked WhatsApp to spy on top government officials at... by jacquesm on Thursday October 31, 2019 @05:40PM (#21413983)
Ditto leaseweb. From what I know about them there is no way they would cooperate with something like that. If this is true it is major league news.
Re:NSO hacked WhatsApp to spy on top government officials at... by yorwba on Thursday October 31, 2019 @03:51PM (#21412946)
> That company is a front for the Chinese military, because if you do a reverse WHOIS search you will see http://pacbasin.com was also registered by the same organization...it is an autonomous drone hardware and extended flight operations firm.

Alternative explanation: Pacific Basin decided at some point that they needed an internet presence, and in addition to their main site pacificbasin.com they also registered pacbasin.com to prevent typo-squatting. Some time later, they decided that was no longer necessary and let the domain lapse. Subsequently, it was picked up for cheap to host the glossy marketing website of what appears to be a drone company.

Problems with that website: the social media icons are just for show; the contact email is for the likely unrelated startech.com; I can't find any way to buy their product; the company is called "星彩网平台航拍无人机系统", "星彩" evoking associations to lotteries. It's also completely unrelated to the domain name.

My personal interpretation: the website is intended to scam Chinese investors with a gambling mentality into throwing their money at a fake "high-tech company."

Do you have any data that would be able to distinguish between your hypothesis and my alternative?

Re:NSO hacked WhatsApp to spy on top government officials at... by sparkywolf on Thursday October 31, 2019 @02:41PM (#21412190)
Yeah, gonna need a source on Proton and Credit Karma
Re:NSO hacked WhatsApp to spy on top government officials at... by stjohnswarts on Thursday October 31, 2019 @02:44PM (#21412224)
Consider it a conspiracy theory. Extraordinary claims require extraordinary evidence.
Re:NSO hacked WhatsApp to spy on top government officials at... by mistermann on Thursday October 31, 2019 @02:56PM (#21412328)
> Extraordinary claims require extraordinary evidence.

To be considered "proven", sure, maybe. But no such thing is needed to merely consider an idea. Look at all the "facts" that have widespread belief, look at all the "not exactly accurate" various organizations broadcast, that turn into very strongly believed "facts" in the public mind.

There's so much obvious lying going on nowadays, and so many perfectly reasonable concerns dismissed as conspiracy theories, that that phrase no longer has any negative connotations for me. In fact, anything remotely complex that doesn't have an air of a conspiracy to it makes me at least as suspicious, kind of in the "which part of this story is untrue, and why" sense.

But hey, each to his own. If you choose to consider only authorized truths, that's your prerogative.

Re:NSO hacked WhatsApp to spy on top government officials at... by opkr on Thursday October 31, 2019 @06:30PM (#21414449)
The rise in shipping company fronts may potentially be attributed to miniature nuclear weapons payloads within shipping containers for rapid and unstoppable payload delivery at close proximity to enemy lines.

Btw intelligence agencies are using invisible image watermarking technologies to track users.

Re:NSO hacked WhatsApp to spy on top government officials at... by rshnotsecure on Thursday October 31, 2019 @07:31PM (#21414880)
Can we talk? One concern we had was that these cargo ships, some subset of the 220, have nuclear weapons onboard that the crew isn’t even aware of. Much like how the soviets used to hide their ICBMs in train cars that move around, this makes tracking these things really hard.

[email address redacted]

Re:NSO hacked WhatsApp to spy on top government officials at... by pnako on Friday November 01, 2019 @03:12AM (#21416791)
I think it's more likely to be a front for the black market in UFO parts being traded between US, Russia and China.
Re:NSO hacked WhatsApp to spy on top government officials at... by galazzah on Thursday October 31, 2019 @02:33PM (#21412100)
Can you provide any sources? Surprised to see Credit Karma on here...
Re:NSO hacked WhatsApp to spy on top government officials at... by sergiomattei on Thursday October 31, 2019 @02:41PM (#21412200)
This. It's easy to come on places and spew conspiracy theories, but this is a really heavy accusation to many reputable companies.

Back it up or nothin'.

Re:NSO hacked WhatsApp to spy on top government officials at... by rshnotsecure on Thursday October 31, 2019 @02:42PM (#21412208)
It comes mainly from mapping the subdomains over time and analysis of the ASNs. This is key. You will often see a company with perhaps 200 or so subdomains, that only does business in the United States.

But then you will see one subdomain that maps to ASN 4803 or whatever, which then leads to “China Telecom xinjiang”. In fact I encourage you to type:

org:”China Telecom xinjiang” “NSFOCUS” into Shodan.

Also look at the capital expenditures psychz.net claims on their about page. There is no IaaS company in the world that can afford to lay down as much hardware as they are claiming.

Another thing btw is these sites never seem to have job openings. That is common pattern that applies to perhaps 60% of the firms listed.

Re:NSO hacked WhatsApp to spy on top government officials at... by ChuckMcM on Thursday October 31, 2019 @02:51PM (#21412289)
So you're saying "typical intelligence analyst stuff" is the reasoning here?

Generally analysts produce questions which operations runs down to figure out if what they think is going on, is actually going on.

Correct me if I'm wrong here but you're basically saying that you have done the first part and found some suspicious links but not the second part do develop actual evidence one way or the other, is that a fair assessment?

Re:NSO hacked WhatsApp to spy on top government officials at... by rshnotsecure on Thursday October 31, 2019 @02:58PM (#21412354)
I am writing this all on a phone and I am more than happy to produce a 5000 word report which will be posted in 96 hours. I will follow up via a comment here and also send to Michael Forsythe at the New York Times for additional review.

You have my word.

EDIT: 5000 words not pages

Re:NSO hacked WhatsApp to spy on top government officials at... by godelski on Thursday October 31, 2019 @03:09PM (#21412456)
If you make a post (assuming I see it, because I want to) I'll gladly read (and upvote) it. I think this is exactly the kind of thing HN wants to see.
Re:NSO hacked WhatsApp to spy on top government officials at... by ChuckMcM on Thursday October 31, 2019 @03:06PM (#21412420)
Awesome, looking forward to it.
Re:NSO hacked WhatsApp to spy on top government officials at... by lowtto on Friday November 01, 2019 @02:58AM (#21416726)
That's the spirit. I've always loved a good challenge accepted attitude.
Re:NSO hacked WhatsApp to spy on top government officials at... by sergiomattei on Friday November 01, 2019 @12:30AM (#21416289)
I'm very interested. Commenting as reminder to check this later.
Re:NSO hacked WhatsApp to spy on top government officials at... by jacquesm on Thursday November 07, 2019 @02:55AM (#21471309)
So, where is that post?
Re:NSO hacked WhatsApp to spy on top government officials at... by rshnotsecure on Tuesday November 12, 2019 @10:35AM (#21514870)
Check below for latest update. Wanted to comment so you got notification. My real name is in my profile with my email address so you’ve got me dead to rights on this one.
Re:NSO hacked WhatsApp to spy on top government officials at... by J_cst on Friday November 01, 2019 @03:16AM (#21416803)
That's a bookmark
Re:NSO hacked WhatsApp to spy on top government officials at... by sergiomattei on Tuesday November 05, 2019 @09:52PM (#21459306)
???
Re:NSO hacked WhatsApp to spy on top government officials at... by rshnotsecure on Tuesday November 12, 2019 @10:34AM (#21514865)
It’s coming. I’ve got butcher paper on the floor mapping out 2000 ASNs. My wife says I look like one of the detectives tracking down a serial killer with red string. I run my own consulting company, and actually lost my main client due to the above post being interpreted as “anti-China”. That has been an enormous setback.

Anyone can do this research I want to emphasize. Look at any suspicious VPN company. Now look at 10 of them. Now plug some of those names into Shodan.

Bear with me here, but if you then simply Ctrl-F for ASNs with the same name with the same LLCs, you will construct a perfect circle of peering that is an “internet within an internet”. What it seems to be is a poor man’s TOR. While the US gov built a Tor, this is an alternate Dark Web built by someone...you can pass through 1,000 servers on 500 different hosting companies none of which do legitimate business.

(Hope this counts as a mini blog post for now this must be 250 words).

Re:NSO hacked WhatsApp to spy on top government officials at... by mmazing on Friday November 22, 2019 @11:15AM (#21606903)
How's that coming along?
Re:NSO hacked WhatsApp to spy on top government officials at... by rshnotsecure on Tuesday November 12, 2019 @10:36AM (#21514871)
See above and below.
Re:NSO hacked WhatsApp to spy on top government officials at... by gspd on Saturday November 02, 2019 @03:02PM (#21429352)
They subcontract their support to India. William Lu is a scammer and a well known liar. He pays people on web hosting forums to keep it quiet about how he scams his customers. The guy has cockroaches in his data center. He has no money and has lost more than half his ip space in the past year. He even got recorded a few months back in a big conference call admitting he lies about everything and charges his customers for services he doesn't even provide. https://www.youtube.com/watch?v=PzHS4E2e8Bg there's also a dope ass diss track about how garbage their service is on there too. https://www.youtube.com/watch?v=mZBWd1Z2yY0
Re:NSO hacked WhatsApp to spy on top government officials at... by zer0tonin on Thursday October 31, 2019 @03:08PM (#21412445)
> org:”China Telecom xinjiang” “NSFOCUS” into Shodan.

I'm going to admit I didn't try putting this into Shodan because for whatever reason I don't have access to it right now. But won't this just show a list of servers running a NSFOCUS WAF? How do you connect that to ProtonMail or LeaseWeb?

Re:NSO hacked WhatsApp to spy on top government officials at... by modwest on Thursday October 31, 2019 @02:47PM (#21412248)
These claims are not credible. Publish your analysis techniques & results.
Re:NSO hacked WhatsApp to spy on top government officials at... by GhettoMaestro on Thursday October 31, 2019 @02:53PM (#21412303)
Never heard of psychz.net.

Are you suggesting they are an "open secret"? EG, They are not "covert", but they are secretive in that they only sell to maybe western intelligence agencies, etc. Could be why they never have real "openings", they got a hot pipeline constantly exiting from the intelligence community looking to make some real money.

Re:NSO hacked WhatsApp to spy on top government officials at... by Apofis on Thursday October 31, 2019 @02:57PM (#21412334)
Wait... you're basing this based on who the domain is registered with?
Re:NSO hacked WhatsApp to spy on top government officials at... by ryanlol on Thursday October 31, 2019 @09:19PM (#21415477)
>org:”China Telecom xinjiang” “NSFOCUS” into Shodan.

No results found

Re:NSO hacked WhatsApp to spy on top government officials at... by rshnotsecure on Sunday November 03, 2019 @06:25AM (#21433257)
Check your double quotes. Also do you have a registered / paid account? Lowest level of paid is fine.
Re:NSO hacked WhatsApp to spy on top government officials at... by notyourday on Thursday October 31, 2019 @02:47PM (#21412251)
Umm.. That's some fun tale.

Highwinds - a software company that sold usenet server. 1995 or so. Really high performance one. Later went into usenet hosting.

Choopa - a hosting company that started as a porn DVD ripper. When you provide lots of porn, you get lots of connectivity. At which point someone goes "Why don't we sell the excess? We already paying for it" Sounds familiar?

LeaseWeb - a really old hosting company. Predates Amazon.

Re:NSO hacked WhatsApp to spy on top government officials at... by rshnotsecure on Thursday October 31, 2019 @02:53PM (#21412302)
Look into something called Reverse Mergers btw.

Old dying hosting companies were the perfect cover to be acquired by spy agencies.

You’ll notice a large posting of press releases and apparent spending in the last 4-5 years though still for all.

http://dcsmanage.com out of Los Angeles is another one btw...

Re:NSO hacked WhatsApp to spy on top government officials at... by notyourday on Thursday October 31, 2019 @04:10PM (#21413177)
Extraordinary claims require extraordinary evidence.
Re:NSO hacked WhatsApp to spy on top government officials at... by EquallyJust on Thursday October 31, 2019 @02:34PM (#21412108)
Do you have a source on protonmail and creditkarma?