Administrators · Legacy archive
The CIA, Nsa and other culprits.
-
The CIA, Nsa and other culprits.
#1Three months ago I applied for a job as the CISO for an arms vendor.
A CISO is a chief information security officer, head of cyber security.
I was highly recommended by former colleagues and they were interested.
Then nothing.
I did not get the job, the trailer just went cold. Their secretary sounding weird, refusing any information.
Then I enter my gmail logs, and someone had accessed my email, but not me.
They used the IP of a carrier I stopped using 1 month earlier.
Then I noticed 2 IPs reading all my Bleak Wood stuff here at Strolen.com. Unusual IPs. Not Caesar193, not Murometz, not EchoMirage, but Barbarian Horde.
I am a surveillance expert. I have spent 3 years of my life designing surveillance computer systems, 15 years studying hacking.
So in 1 minute I had geolocated the IPs.
Langley, Virginia.
To find me here they would have to check the gmail I gave at the job application, find the linked Yahoo.se account, find Strolen.com email with my nick and start reading.
wow!
All that for little me.
I am:
- flattered to have a two person team checking me out (did you see the fine Ibiza pics, lads?)
- disappointed the western security agencies leave such obvious tracks
- disappointed they didn't check out my server. I need some visitors, damnit!
- wondering what they thought about that Angus + Wionna Coke snort scene in Bleak Wood. Cool huh?
- Somewhat afraid I will be flagged for an anal probe the next time I visit the US.
Just routine checks due to numerous alerts going off I guess (surveillance hacker applying for arms factory job), but still. That one account to rule them all thing... They found all my online stuff like 1, 2, 3.
Hot damn. -
Re: The CIA, Nsa and other culprits.
#2My country is full of graceless and idiotic people -
Re: The CIA, Nsa and other culprits.
#3I guess it is a necessary system.
Go through 99.9% common folk to get at the 0.1% bad guys.
A lot of observations though:
- The fact that Google's logs revealed them suggests that Google did not warrant the investigation.
- The fact that they have totally revealed my online presence suggests backdoors into every major online company.
- The low level of skill while perusing my stuff here suggests that in spite of powerful Tools, they have a lack of basic security training. rule #1: always use proxies and #2: never hack from home.
My country is full of graceless and idiotic people
-
Re: The CIA, Nsa and other culprits.
#4I was going to hit on those points too.
The fact they are so clumsy about it proves they need somebody who has a clue.
And the fact that google is that unsecure is scary.
Almost want to throw all that data back in their face and ask them if hacking accounts in such an obvious way is a normal practice of the company. If so, it might not be a place you want to work after all...even though they definitely need you.
-
Re: The CIA, Nsa and other culprits.
#5
I was going to hit on those points too.
The fact they are so clumsy about it proves they need somebody who has a clue.
And the fact that google is that unsecure is scary.
Almost want to throw all that data back in their face and ask them if hacking accounts in such an obvious way is a normal practice of the company. If so, it might not be a place you want to work after all...even though they definitely need you.
I hate it when I hit the modify button and not the quote button, my bad
But very well said -
Re: The CIA, Nsa and other culprits.
#6I dunno about Google.
Norway is a member of NATO, and that arms factory is an important vendor for NATO aircraft, hummers (automated targeting turrets) and ships. Lots of missiles and stuff. Also they have a lot of offshore civilian sector items.
Seems to me like they somehow dumped my profile to NATO, and from there guys at Langley checked me out.
Why else would the Langley IP's appear?
All the Langley IP's emananted from a building a short distance away from the main CIA building.
So now I guess I know where their cybercommand is... :p
When it comes to computer surveillance, NSA are the big boys.
CIA is outdated and outmatched in that regard. At least that is what they keep telling us at the security conferences.
I dunno if NSA have some facilities in Langley. I thought just CIA operated from that location. -
Re: The CIA, Nsa and other culprits.
#7I think you are getting to the 7 levels or Ra at this point. :) -
Re: The CIA, Nsa and other culprits.
#8Yeah. That is the usual reaction. :)
It is what it is. -
Re: The CIA, Nsa and other culprits.
#9Fun stuff, totally off topic, but since I have reached the level of Ra, I can do what I want with threads:
Sitting on top of telecom services is fun!
Being able to send SMS messages as whoever to whoever can be great fun. Here is a couple of pranks I played with such services:
1) Two young secretaries sat across each other, typing in orders and talking to customers. So I sent one of the girls a message... from the other. "Excuse me, but have you not showered lately? You kinda smell like a skank". The one getting the text just stared at it, with an open mouth, then began glaring hatefully at the other girl. So we sent her a message as well: "Who do you think you are, bitch?". Being girls they said nothing. They just stared angrily at each other. Great fun!
2) I sent the pretties girls at work a message from my boss. Each message was sent individually to that girl. "Come to my office, quick. There is an important matter I need to discuss with you!". And 1-2-3, all the girls stood up and walked towards his office. As they drew closer, it seemed like a small school of fish, aiming right for the big kahuna. It was so fun, they all babbled and stood there, looking confused. In the end he screamed my name, and demanded my presence in his office. His cheeks were burning red and shaking, anger in his eyes. That was a kodiak and popcorn moment right there :D
3) I sent one of my friends a message from his wife. "I know you've been cheating. We need to talk, now!". That one was kinda dangerous, though, for he had written a long message, fessing up, when I patted him on the shoulders and wondered how his pulse was at the moment. He was just 30 seconds away from sending the text, so kinda glad I didn't wait any longer. -
Re: The CIA, Nsa and other culprits.
#10And no worries about me sounding cryptical and silly like Ra.
When you do computer security stuff you get used to sceptism and disbelief (when you explain security to non-security people).
As for me: Paranoia comes with the territory, because you've seen so much.
Actually it is quite difficult to sell computer security, because of reactions such as yours.
I can show them, and get subpoenaed in the process, or I can wait until someone else hacks them and come to the rescue.
Anyhow...
Can't prove anything except my mail getting accessed illegally and two separate IPs from the same building in Langley, Virginia going through all my stuff.
What do I know? Might just be two office clerks that love roleplaying, who just happens to work with the government, always reading my stuff at the same time. :)
-
Re: The CIA, Nsa and other culprits.
#11I was teasing. I don't want to be on your bad side.
Nice AG.....niiiiiiiccccccce. -
Re: The CIA, Nsa and other culprits.
#12*inhale, kill, exhale*
:P -
Re: The CIA, Nsa and other culprits.
#13 -
Re: The CIA, Nsa and other culprits.
#14 -
Re: The CIA, Nsa and other culprits.
#15Considering the unfortunate nature of password re-use, we'd be a bit reckless not to do so if we've got the capability. Setting up the server to use SSL is trivial, though it does cause issues with any virtualhosting you might be doing (i.e. only a single site can be served with SSL on any particular IP). -
Re: The CIA, Nsa and other culprits.
#16Yes. Yes. Yes. -
Re: The CIA, Nsa and other culprits.
#17I do have two IPs. So once I put SSL on the one IP then xxxx.strolen.com won't work or will they just have SSL too?
And your site for instance, Chaos, currently uses the same IP as strolen.com. I would have to move you to another? -
Re: The CIA, Nsa and other culprits.
#18Just put SSL on the one Chaos doesn't use, and use straight vanilla HTTP on the other one.
SSL is one of the easiest, most efficient methods of securing data under transport.
Of course, nation states are not stopped in the least by SSL.
Yes, I can back that claim with articles. -
Re: The CIA, Nsa and other culprits.
#19The key point is that you can only have a single virtualhost listening on port 443 (with SSL enabled) per IP. So if you're using wildcard IP listening in your virtualhosts, you might end up with configuration issues.
Short version: Make a separate virtualhost entry for Strolen's, then have it listen explicitly on the IP you want, for port 443. Keep the other virtualhosts listening on the other IP, for port 80. -
Re: The CIA, Nsa and other culprits.
#20Oh...
Google should watch out... They are playing with fire.
http://wikileaks.org/Op-ed-Google-and-the-NSA-Who-s.html -
Paranoia Uber Alles!
#21Ever since I got the paranoia chill from those langley IPs, I have been watching the online IP register.
No more Langley addresses, but there ARE some addresses I find interesting.
To illustrate what I mean:
[img width=400 height=49]http://rag596-07.stwserver.net/bitcloud/Capture.PNG
Like Amazon Web Services that ALWAYS fricken log on at the exact same time, and intensly read my Bleak Wood threads. Whats up with that?
If you study the picture, you will see those EC2 (Amazon Elastic Compute Cloud) IPs that have logged on at precisely the same second, and ALL read the same thread. That ONLY happens to Bleak Wood.
All these IPs come from Ashbury, Virginia. While geographically close to Langley, that is just a coincidence. Ashbury is like one of the major hubs of the net in the US, and also where Amazon has one of their server farms. The Amazon service availability page confirms that: (Look for Amazon Elastic Compute Cloud (N.Virginia)
http://status.aws.amazon.com/
So... I am thinking... Strolen's provider? Is this Big Brains provider perhaps using Amazon, and they sync the last threads on the forum using replicating bots, or something?
Other IPs I have found interesting is this Sirius Ltd IPs (never the same) from London, England. It is never the same IP, but it often logs on, just to look at Bleak Wood. I am thinking... Dark_dragon?
94.228.34.211 - The Runtime Collective Customer Network - 4D Sirius Ii United Kingdom, London, London
Lastly there is these Kiyv, Ukraine IPs, like this one:
213.186.119.133 - Utel Datacenter Networks. Colocation - Ukraine
Just to wrap it up:
Northern Virginia (US Intelligence Services)
London, UK (GCHQ anyone)
Kiev, Ukraine (Them Ukrainian fuckers are kings of the hacks)
Perhaps I have a wide and interested audience.
For sure I am somewhat paranoid.
But... Four bots crawling my threads, and mine alone, never using the same IP.
Pardon me if I am a bit suspicious.
Conspiracy hour is over for today.
-
Re: The CIA, Nsa and other culprits.
#22I don't mean to be so brief, but I had the same thing happen to me with 2 different rp's...kiev, china, and umm, somewhere else in my case. -
Re: The CIA, Nsa and other culprits.
#23It might be search engines.
They make new ones all the time.
I don't mean to be so brief, but I had the same thing happen to me with 2 different rp's...kiev, china, and umm, somewhere else in my case.
-
Paranoia Hour part 2
#24Alright. Watched Jacob Appelbaum's review of NSA capabilities on the Chaos Communication conference in Hamburg, Germany.
Pretty interesting stuff!
Jacob Applebaum: To Protect And Infect, Part 2