"This Is Massive": Shadowy DARPA-Linked Company Took Over 'Chunk' Of Pentagon's Internet In Inauguration Day Mystery
"This Is Massive": Shadowy DARPA-Linked Company Took Over 'Chunk' Of Pentagon's Internet In Inauguration Day Mystery
BY TYLER DURDEN SUNDAY, APR 25, 2021 - 12:25 PM
A shadowy company set up last September linked to a DARPA / FBI
contractor who peddled a 'lawful intercept' internet spy device to government
agencies and law enforcement a decade ago, took over a massive portion of the
Pentagon's idle internet addresses on the day of President Biden's inauguration,
according to an in-depth investigation by the Associated Press.
The valuable internet real estate has since quadrupled to 175
million IP addresses which were previously owned by the US Department of
Defense - about 1/25th the size of the current internet, and over twice the
size of the internet space actually used by the Pentagon.
"It is massive. That is the biggest thing
in the history of the internet," said Doug Madory,
director of internet analysis at network operating company Kenntic.
The company, Global Resource Systems, was established by a
Beverly Hills attorney, and now resides in a shared workspace above a Florida
bank.
The company did not return phone calls or emails from The
Associated Press. It has no
web presence, though it has the domain grscorp.com. Its
name doesn’t appear on the directory of its Plantation, Florida, domicile, and a receptionist drew a blank when
an AP reporter asked for a company representative at the office earlier this
month. She found its name on a tenant list and suggested trying email. Records
show the
company has not obtained a business license in Plantation.
Incorporated in Delaware and registered by a Beverly Hills
lawyer, Global Resource Systems LLC now manages more internet space than China
Telecom, AT&T or Comcast. -Associated Press
One name
is linked to Global Resource Systems in the Florida
business registry - that of Raymond Saulino -
who as recently as 2018 was listed in Nevada corporate records as a managing
director of a cybersecurity/internet surveillance company called Packet
Forensics. According to the report, "The company had
nearly $40 million in publicly disclosed federal contracts over the past
decade, with the FBI and the Pentagon’s Defense Advanced Research Projects
Agency among its customers."
In 2011, Packet Forensics and Saulino, its spokesman, were
featured in a Wired story
because the
company was selling an appliance to government agencies and law enforcement
that let them spy on people’s web browsing using forged security certificates.
The company continues to sell “lawful
intercept” equipment, according to its website. One
of its current contracts with the Defense Advanced Research Projects Agency is
for “harnessing
autonomy for countering cyber-adversary systems.” A
contract description says it is investigating “technologies for conducting safe,
nondisruptive, and effective active defense operations in cyberspace.” Contract
language from 2019 says the program would “investigate the feasibility of
creating safe and reliable autonomous software agencies that can effectively
counter malicious botnet implants and similar large-scale malware.”
Saulino is also listed as a
principal with a company called Tidewater Laskin Associates. Incorporated in
2018 (and sharing the same Virginia Beach, VA address as Packet Forensics - a
UPS store - with different mailbox numbers), Tidewater
obtained an FCC license in April 2020 for unknown reasons.
Calls to the number listed on the Tidewater Laskin FCC filing
are answered by an automated service that offers four different options but
doesn’t connect callers with a single one, recycling all calls to the initial
voice recording.
Saulino did not return phone calls seeking comment, and a
longtime colleague at Packet Forensics, Rodney Joffe, said he believed Saulino was retired. Joffe,
a cybersecurity luminary, declined further comment. Joffe is chief technical officer at Neustar
Inc., which provides internet intelligence and services for major industries,
including telecommunications and defense. -AP
And now a company linked to Saulino, which didn't exist before
September, took control of a massive chunk of the Pentagon's internet space on
inauguration day for unknown reasons.
According to a terse and opaque explanation from the Pentagon's
Brett Goldstein - head of the Defense Digital Service which is running the
project, the military hopes to "assess, evaluate and prevent unauthorized
use of DoD IP address space" and "identify potential
vulnerabilities" in order to defend against cyber-intrusions by global
adversaries who consistently infiltrate US networks - occasionally from unused
internet blocks. What that has to do with Global Resource Systems is anyone's
guess.
Explanations for what the internet space could be used for are
purely speculative, and include "honeypots" - machines set up with
vulnerabilities laid as bait to draw hackers, "Or it could be looking to
set up dedicated infrastructure — software and servers — to scour traffic for
suspect activity."
"This greatly increases the space they could monitor,"
said Madory.
Why did
the Pentagon choose Global Resource Systems - a company linked to a 'spooky'
individual - on inauguration day? "As to why the DoD
would have done that I’m a little mystified, same as you," internet
pioneer Paul Vixie told AP.
More via AP:
Deepening the mystery is Global Resource Systems’ name. It is
identical to that of a firm that independent internet fraud researcher Ron
Guilmette says was sending out email spam using the very same internet routing
identifier. It shut down more than a decade ago. All that differs is the type
of company. This one’s a limited liability corporation. The other was a
corporation. Both used the same street address in Plantation, a suburb of Fort Lauderdale.
“It’s deeply suspicious,” said Guilmette, who unsuccessfully
sued the previous incarnation of Global Resource Systems in 2006 for unfair
business practices. Guilmette considers such masquerading, known as
slip-streaming, a ham-handed tactic in this situation. “If they wanted to be
more serious about hiding this they could have not used Ray Saulino and this
suspicious name.”
Guilmette and Madory were alerted to the mystery when network
operators began inquiring about it on an email list in mid-March. But almost
everyone involved didn’t want to talk about it. Mike Leber, who owns Hurricane
Electric, the internet backbone company handling the address blocks’ traffic,
didn’t return emails or phone messages.
Despite an internet address crunch, the Pentagon — which created
the internet — has shown no interest in selling any of its address space, and a
Defense Department spokesman, Russell Goemaere, told the AP on Saturday that
none of the newly announced space has been sold.
Comments
Post a Comment