Pentagon Explains Odd Transfer of 175 Million IP Addresses To Obscure Company (arstechnica.com) 48
An anonymous reader quotes a report from Ars Technica: The US Department of Defense puzzled Internet experts by apparently transferring control of tens of millions of dormant IP addresses to an obscure Florida company just before President Donald Trump left the White House, but the Pentagon has finally offered a partial explanation for why it happened. The Defense Department says it still owns the addresses but that it is using a third-party company in a "pilot" project to conduct security research. "Minutes before Trump left office, millions of the Pentagon's dormant IP addresses sprang to life" was the title of a Washington Post article on Saturday. Literally three minutes before Joe Biden became president, a company called Global Resource Systems LLC "discreetly announced to the world's computer networks a startling development: It now was managing a huge unused swath of the Internet that, for several decades, had been owned by the US military," the Post said.
The number of Pentagon-owned IP addresses announced by the company rose to 56 million by late January and 175 million by April, making it the world's largest announcer of IP addresses in the IPv4 global routing table. The Post said it got an answer from the Defense Department on Friday in the form of a statement from the director of "an elite Pentagon unit known as the Defense Digital Service." The Post wrote: "'Brett Goldstein, the DDS's director, said in a statement that his unit had authorized a 'pilot effort' publicizing the IP space owned by the Pentagon. 'This pilot will assess, evaluate, and prevent unauthorized use of DoD IP address space,' Goldstein said. 'Additionally, this pilot may identify potential vulnerabilities.' Goldstein described the project as one of the Defense Department's 'many efforts focused on continually improving our cyber posture and defense in response to advanced persistent threats. We are partnering throughout DoD to ensure potential vulnerabilities are mitigated.'"
The number of Pentagon-owned IP addresses announced by the company rose to 56 million by late January and 175 million by April, making it the world's largest announcer of IP addresses in the IPv4 global routing table. The Post said it got an answer from the Defense Department on Friday in the form of a statement from the director of "an elite Pentagon unit known as the Defense Digital Service." The Post wrote: "'Brett Goldstein, the DDS's director, said in a statement that his unit had authorized a 'pilot effort' publicizing the IP space owned by the Pentagon. 'This pilot will assess, evaluate, and prevent unauthorized use of DoD IP address space,' Goldstein said. 'Additionally, this pilot may identify potential vulnerabilities.' Goldstein described the project as one of the Defense Department's 'many efforts focused on continually improving our cyber posture and defense in response to advanced persistent threats. We are partnering throughout DoD to ensure potential vulnerabilities are mitigated.'"
Re: (Score:1)
Re:Hacks or Profitering (Score:4, Informative)
The IPv4 allocation policy of all internet registries including ARIN is "use it or lose it". If Pentagon was Joe Average Internet user he would have lost them by now - I surrendered a class C 14 years ago under that rule, because it was not routed and announced. As Pentagon is not Joe Average Internet user, it took 15 years for the rules to catch up with.
They are having a clown announce them without actual usage so they can continue to hoard them. All of this is despite not having any need or use for them. At the very least sell them ffs. Jerks.
Re: (Score:3)
> All of this is despite not having any need or use for them.
Maybe they were forced to discuss whether to hand the adresses back but are afraid that they actually used them somewhere, internally.
So they are making sure that the adresses are (not really) used.
Re:Hacks or Profitering (Score:5, Informative)
At a guess, the DOD knows they're going to have to give up their unused
While yes, the DOD does nefarious stuff here and there, the overwhelming majority of the time it's just boring bureaucratic stuff. I am not claiming this couldn't be a nefarious project, just that statistically it's a thousand times more likely to be something boring than something nefarious.
Sauce: I worked for the DOD, worked as a DOD contractor, etc. I haven't done clearance work in a decade, thank the fluffy bunnies, and I don't intend to again.
Re: (Score:1)
Re: Hacks or Profitering (Score:2)
+1 funny troll
Re: (Score:2)
At the very least sell them ffs. Jerks.
Why? So we can fragment routing tables even more as they are distributed in small chunks to people all the while giving yet more justification to not fix the problem by moving off IPv4?
Honestly at this point I think everyone who has a Class C or larger should be forced to pay a large fee per class they own and not be given the option to give up individual or small blocks of IPs. Maybe then the industry will get off their arse and adopt a replacement standard which was ratified 25 fucking years ago.
Re:Hacks or Profitering (Score:5, Informative)
Nope.
The IPv4 allocation policy of all internet registries including ARIN is "use it or lose it". If Pentagon was Joe Average Internet user he would have lost them by now - I surrendered a class C 14 years ago under that rule, because it was not routed and announced. As Pentagon is not Joe Average Internet user, it took 15 years for the rules to catch up with.
Legacy allocations that predate the existence of ARIN can only be voluntarily surrendered. Even if you don't pay fees for LSA your numbers cannot be revoked.
The RSA service agreement explicitly states revocation for non-use does not happen quoting section 6 "ARIN will take no action to reduce the Services currently provided for Included Number Resources due to lack of utilization by the Holder"
People lose their existing allocations by not paying their bills. The consequence of not using and properly documenting space you have is additional grants would be denied back when there were addresses to allocate.
Re: Hacks or Profitering (Score:2)
This is dumb.
Re: (Score:2)
FYI:n Just like IPv4... IPv6... DoD can build MIC-style Internet/W3 weapon systems. A face to the field ain't a backbone of anything.
LOA by dod (Score:2)
Re: LOA by dod (Score:2)
Re:LOA by dod (Score:5, Insightful)
They use AS8003 and they don't seem to know how to optimize routes [he.net]. They advertise 29.0.0.0/8 and 29.0.0.0/18, 29.0.0.0/20, /22, /23 and 24. They do the same for 7/8 22/8.
If they aren't doing any transit, there are a bunch of addresses that should go back to the global pools. They are advertising 9 class A in their entirety 7, 11, 21, 22, 26, 28, 29, 30, 33 for 150 million addresses.
Re: (Score:2)
What is of concern is the company it was awarded is in a shared work space, with on principle, of the same name of another company in the same shared work space that dispersed years ago.
What is of concern is the listed principle only other business is a box at a UPS store. I understand cost cutting and remote work, Ute we are awarding military contracts to people who for all we know live in Cu
Configure Your Linksys!! (Score:5, Funny)
At least we know a range of addresses to block.
Re: (Score:2)
Re: (Score:2)
Basking in all the packets!
Re: (Score:2)
Re: (Score:2)
Up until last year, when I moved house, I had a couple of local servers and a static subnet and I had internet crypto things going on.
With the encrappening of my internet service that came with a new house, I moved stuff to a cloud server and quit serving my entropy service.
Re: (Score:1)
At least we know a range of addresses to block.
The IP blocks have been publicly listed with ARIN since at last 1985.
If you didn't care for the last 35 years, why on earth would you start to care today?
Or put another way, why did you willingly *allow* connections to these IP blocks for 35 years?
Why did you choose to let that happen?
Re:Configure Your Linksys!! (Score:5, Insightful)
The IP blocks have been publicly listed with ARIN since at last 1985.
If you didn't care for the last 35 years, why on earth would you start to care today?
Or put another way, why did you willingly *allow* connections to these IP blocks for 35 years?
Why did you choose to let that happen?
People care now because a private entity is announcing these blocks instead of the U.S. Government. Who knows what this private entity is doing with these blocks. What data are they collecting? What will they do with said data? Are they subject to the same privacy laws as the U.S. Government? Can I FOIA this private entity to find out? Probably not.
Re: (Score:3)
What threat are you worried about? That your router allows your computer to send your personal information to random IP addresses? That your router spontaneously forwards packets to strange netblocks, but won't if you bought them somehow?
Private government contractors generally have to follow the same behavioral rules as government itself with respect to work they do for the government. They can't collect private information or PII in situations that the government cannot, to answer one of your specific
Re: (Score:2)
What data are they collecting?
Presumably all the data you're not giving them? I mean I own an IP address. Want to take a guess as to how much I know about you as a result? I'll happily comply with a FOIA request you send. Hell I'll save you some time and give you the content. It will be a formal letter with a single line on it: "None. IP addresses don't work like that. Go take your meds."
Re: (Score:2)
Re: (Score:2)
Before we just looked for "Pentagon" in the whois, now they've gone off to Crapco Inc, it'll be *impossible* for us to figure out who's pinging our firewalls ;-)
Honestly, I wouldn't be surprised if indeed the block was going to be subdivided down for a handful of troll farms (to go live in probably 2-3 years). In the meantime, one small subnet will be used for innocuous looking Internet browsing, and maybe some port scanning. Other blocks may end up getting used for "ddos prevention" to analyse the traffic
I grew up in an era (Score:2)
Where if the Pentagon makes a press release, the only thing you can be sure of is that is not how it happened at all.
Re: (Score:2)
How do you feel when the FBI or CIA makes a press release?
But done by an obscure private company (Score:2)
that can be liquidated anytime.
What a brilliant cover!
Re: (Score:2)
What possible motive could the Pentagon have for undermining P2P systems? That doesn't have anything to do with what the DoD does.
Did you miss the scheduled maintenance on your tinfoil hat?
What? (Score:1)
This pilot will assess, evaluate, and prevent unauthorized use of DoD [unused] IP address space
Additionally, this pilot may identify potential vulnerabilities
Typically, you need to have some software using the IP address to be vulnerable...
Re: (Score:2)
Oh, you thought they meant it was their own vulnerabilities they were gonna hunt for, didn't you? That's cute.
Re: (Score:2)
How many more are there? (Score:2)
If 175m is a "pilot", what does the full roll-out look like?
Re: (Score:2)
If 175m is a "pilot", what does the full roll-out look like?
176m
Re:How many more are there? (Score:5, Insightful)
In practice, I think the use of "Pilot" here is meant as "first stage of a process" rather than "limited rollout" as I'm assuming actual usage of the IP ranges in question on the publically routed Internet is probably the ultimate goal of this effort. We've seen this before when previously "dormant" IP ranges were suddenly advertised with huge amounts of traffic being re-routed from people who should have known better but throught that because a given IP range wasn't actively being routed it was fair game to use as an extension to the RFC1918 IP blocks. (Which, it has to be said, doesn't bode well for their handling of actual RFC1918 blocks since if they'd configured things properly the introduction of a route should NOT have broken things because people with clue explicity block RFC1918 IP space from routing onto the Internet, right?)
The next phase for the DoD is basically to sit back and enjoy the fun (and probably do some large scale traffic analysis since a lot of IP space squatting is often done by criminals), since there is inevitably going to be some turmoil for those who were actually dumb enough to think they could freely use this space without issue. There might also be a lot of snark from the DoD if they complain about the breakage (which some already have!), or maybe even some legal repercussions since the IP ranges in question are ultimately the property of the US taxpayer after all. Once the bogus traffic drops back to noise - likely in a several months time - we'll see the next phase; most likely some combination of public usage of the ranges by the DoD, transfer to other US government institutions, sale to third parties, or release back to ARIN for inclusion in the free IPv4 pool.
Re: (Score:2)
they have 208 million addresses by the looks of it, it's not a secret who owns IP blocks.
https://en.wikipedia.org/wiki/... [wikipedia.org]
IMO now would be a very good time to start cutting down on the ranges they have, I bet they only use less than 10% of all they addresses they have.
If they don't sell them now then they risk not getting a good price once the transition to ipv6 happens.
Sticking 'Trump' in to stories sells papers (Score:2)
That's it, that's all.
Not advertised doesn't mean not used (Score:2)
There are reasons you might need (or want I suppose) globally unique IP addresses while not publishing said IP addresses to the global public internet. An operation on the scale of the US Department of Defense would easily find itself in such a situation. If you have private interconnections with multiple third party organizations (which may be other government agencies, even), private address space is not sufficient. Eventually you either run out of private address space or it becomes impossible to coordin
Transferred for "Research" (Score:2)
For Trump's Florida US Capitol (Score:1)
So this is why we need to convert to IPV6? (Score:2)