Re: Russian diplomats lingering near fiber optic cables

[Brandon Vincent]

On Thu, Jun 1, 2017 at 6:07 PM, Matt Palmer  wrote:
> I think regardless of what you appear to be interested in, hanging around a
> beach with a big DSLR is likely to get you on one list or another.

"Excuse me, sir! Can you direct us to the naval base in Alameda? It's
where they keep the nuclear wessels."

Re: Russian diplomats lingering near fiber optic cables

[Brandon Vincent]

DO NOT ANCHOR OR DREDGE is a pretty good indicator.

On Thu, Jun 1, 2017 at 11:05 AM, Jared Mauch  wrote:
>
>> On Jun 1, 2017, at 2:02 PM, Sean Donelan  wrote:
>>
>>
>> There must be a perfectly logical explanation  Yes, people in the 
>> industry know where the choke points are. But the choke points aren't always 
>> the most obvious places. Its kinda a weird for diplomats to show up there.
>>
>> On the other hand, I've been a fiber optic tourist.  I've visited many 
>> critical choke points in the USA and other countries, and even took selfies 
>> :-)
>>
>>
>> http://www.politico.com/story/2017/06/01/russia-spies-espionage-trump-239003
>>
>> In the throes of the 2016 campaign, the FBI found itself with an escalating 
>> problem: Russian diplomats, whose travel was supposed to be tracked by the 
>> State Department, were going missing.
>>
>> The diplomats, widely assumed to be intelligence operatives, would 
>> eventually turn up in odd places, often in middle-of-nowhere USA. One was 
>> found on a beach, nowhere near where he was supposed to be. In one 
>> particularly bizarre case, relayed by a U.S. intelligence official, another 
>> turned up wandering around in the middle of the desert. Interestingly, both 
>> seemed to be lingering where underground fiber-optic cables tend to run.
>>
>> According to another U.S. intelligence official, “They find these guys 
>> driving around in circles in Kansas. It’s a pretty aggressive effort.”
>>
>> It’s a trend that has led intelligence officials to conclude that the 
>> Kremlin is waging a quiet effort to map the United States’ 
>> telecommunications infrastructure, perhaps preparing for an opportunity to 
>> disrupt it.
>
> Seems it would be easier to just pay for a subscription to a service like 
> FiberLocator or similar.
>
> They could just dial 811 as well and request the locates happen.
>
> - Jared

Re: NIST NTP servers

[Brandon Vincent]

GPS + a cesium or rubidium frequency standard is all you need.

Too expensive? Then time isn't important to your organization.

Re: how to deal with port scan and brute force attack from AS 8075 ?

[Brandon Vincent]

On Thu, Mar 31, 2016 at 4:41 AM, DV  wrote:
> I have noticed this and especially the strange format of the packets with a
> SYN/ECE/CWR flag combination: http://pastebin.com/jFCDAmdr
>
> This may be $whoever trying to establish network performance/congestion via
> ECN or it could be something else like a fast scan technique or OS
> fingerprinting

It's OS fingerprinting. Targeted attacks are far more productive. If
I'm trying to get into an organization, I'd much rather be interested
in Juniper ScreenOS than someone's personal *nix machine.

Brandon Vincent

Cogent Communications

[Brandon Vincent]

Does anyone have a NOC/SOC contact for Cogent? I found a improperly
secured router on the Internet and I'd like to report it.

Thank you,
Brandon Vincent