8 ms·

> but four other students who did not appear to be Zoom bombers were also listed as having Malachi’s public IP address, an impossibility since they were not in

by ratww 5y ago

> but four other students who did not appear to be Zoom bombers were also listed as having Malachi’s public IP address, an impossibility since they were not in the same house Could be Zoom messing up their logs, but could also be NAT from the provider. A few years ago, me and my sister noticed we had the same IPv4 address, despite not living in the same household. We had different IPv6, though. It seems to be becoming more and more prevalent due to IPv4 exhaustion.

valleyer 5y ago
Yeah, sounds possibly like: https://en.wikipedia.org/wiki/Carrier-grade_NAT https://en.wikipedia.org/wiki/Carrier-grade_NAT
- dreamcompiler 5y ago
  That was my first thought. I wonder what software reported the IP address? If it's the Zoom client then it's obviously meaningless because it's guaranteed to be in a private IP address range (if it's IPv4). If it's the Zoom server and CGN is being used by the student's ISP, then it's equally meaningless because while that will be a public IP address, it could be shared by 100 households. I'm also assuming the "experts" didn't make the bone-headed mistake of failing to verify the IP address was in a public range, but I've seen dumber errors.
matja 5y ago
This is DS-Lite (Dual Stack). Entire regions of ISP users may share a single IPv4 address. There are some IPv4-only websites I visit that show a CloudFlare captcha on every single visit (for 30 mins), presumably because they see a huge number of requests from this one NAT IP.
- ratww 5y ago
  Interesting! I was not familiar with the term DS-Lite! https://techmusa.com/dual-stack-lite/ https://techmusa.com/dual-stack-lite/
  - m463 5y ago
    or https://en.wikipedia.org/wiki/IPv6_transition_mechanism#Dual-Stack_Lite_.28DS-Lite.29 https://en.wikipedia.org/wiki/IPv6_transition_mechanism#Dual...
danellis 5y ago
You missed the worst part: > ... said Scott Moulton, a Woodstock-based forensics expert hired by the attorney working on Malachi’s case. This forensics "expert" should know this.
- jumelles 5y ago
  Where does it say he doesn't? We have no idea what the logs say or how obviously wrong they may or may not appear.
- nrmitchi 5y ago
  There is a linked follow up article that is a bit clearer: > Moulton, who owns Forensic Strategy Services in Woodstock, also said the Zoom bombers’ local IP addresses, which pinpoint the device being used, did not match the configuration of Malachi’s router. > > Lotito said he did not think the Gwinnett County Board of Education considered Moulton’s report. It sounds like their expert did know, and explicitly pointed it out, but the findings were apparently ignored.
  - cyberpunk 5y ago
    Why? Who are these people accountable to? This has real world consequences to this child, is it as simple as they're fucking bastards or what?
    - shadowgovt 5y ago
      > Who are these people accountable to? In every place in the US I'm aware of, the school board ultimately oversees administrators, and the school board is made of elected officials. > is it as simple as they're fucking bastards or what? The most charitable explanation is that they're in way over their heads technologically and concerned that incompetence will cost them their jobs if they try to do nothing. But I'm having difficulty finding a charitable explanation that respects the harm being wrong here can do to the 6th grader.
      - deleted 5y ago
PurpleFoxy 5y ago
This is possible. Many users can be sharing the same IPv4 using CG-NAT. I have found that when using mobile internet, every site that uses IP bans has already banned me for a previous users actions. It’s incredibly irresponsible to take action against someone based on their IP address alone.
- olyjohn 5y ago
  Starlink uses CG NAT for IPv4 and just recently started dishing out IPv6 addresses.
  - kaliszad 5y ago
    Probably didn't want to go the AWS route of just buying a pile of IPv4 space from established organizations.
- floatingatoll 5y ago
  From an IT operator perspective, IPv4 bans are essentially the only recourse available for many — if not most — abuse/attack scenarios. They're unfair and unjust, but this is the price we pay of making tracing identities inaccessible to online abuse enforcement. If you have an idea on how abusive actors behind CG-NAT can be identified and blocked without blocking the entire CG-NAT, and that idea is not morally unacceptable to the hacker community (as captchas, fingerprinting, and IP bans are), then you can make a billion dollars on that idea. But it's been twenty years now that we've needed that idea, and I'm not holding my breath. Tech continues to insist that anonymity is more important than accountability. Our users pay the price of our insistence to this day.
  - MathCodeLove 5y ago
    Instead of a permanent IPv4 ban consider issuing a temporary one just long enough to dissuade the aggressor from continuing their behavior. This would be just as effective, and is far less likely to impact others down the road.
    - 5y ago
jcomis 5y ago
also: >Teachers also said Malachi’s camera was on and he did not appear to be doing anything unusual So he was supposedly doing this while on camera and in class? This case seems so absurd.
- wearywanderer 5y ago
  While I agree the case is obviously absurd, I'm a bit confused what sort of evidence you think the webcam would give. In the hypothetical scenario where he did what he's accused of, and did it while on webcam, what would the webcam show? Probably just him looking at his screen, with maybe some typing noises? That wouldn't be evidence of anything, neither innocence nor guilt.
  - spoonalious 5y ago
    One of the things he’s accused of of shouting racial slurs
    - wearywanderer 5y ago
      Malichi (the accused) reported hearing somebody yelling racial slurs. But the school's allegations are about him joining the channel with abusive screen-names. One of his teachers says that it wasn't Malichi's voice yelling the slurs.
      - mynameisvlad 5y ago
        Malichi and an independent teacher both corroborated that there was someone shouting racial slurs, so by taking this side that actually the school is only going after the abusive screen names, are you saying that there were two separate people Zoom bombing this class, Malichi and someone else? The school clearly knows they can't go after him for the racial slurs because he was on camera that whole time, so they chose not to focus on that. But it doesn't mean it didn't happen.
  - dragonwriter 5y ago
Spooky23 5y ago
Wireless carriers use proxies and cgnat. Had a colleague who discovered some of the edge case failures with an app he was building.
sp332 5y ago
The ISP should be able to tell you which customer was using a particular port at a particular time. It's required for abuse moderation and forwarding DMCA notices, so I'm 99% sure they can do this if you bring a subpoena. Source: I worked on part of a system for this at an ISP.
- cyberpunk 5y ago
  Something that blew my mind recently; a teenage child of a friend of ours stayed with us recently and used our wifi to torrent some pron.. How do I know this? I got a letter in the mail telling me to pay <some amount of euros, over 1000> or deal with a whole legal shitshow.. And ok, I paid it.. I didn't tell the parents, but I'm now thinking.. How do these people have the ability to match a date time, ip to my identity without my permission? I did intend to pwn the legal firm and find out but I'm too busy, heh. edit: the guest wifi now goes via a vpn...
  - neither_color 5y ago
    Uhm... what? You're paying 1000 euros and not telling his parents? I get that maybe you don't want to get the kid in trouble, but that's a LOT of money. I wouldn't even pay $100 if my guests did that.
    - cyberpunk 5y ago
      Yeah well, it was a total shakedown, fighting it would have cost more. I spoke to the lad, explained it, and how to cover his tracks better, and he's gonna saw a whole load of wood for me over the summer.. It worked out.. His parents aren't the type to really understand it, and I'm not the kinda guy to release that on him (and them) -- he's still the wunderkind... ;) edit: I also probably get paid too much.. :/
      - cyberpunk 5y ago
        Interestingly though, it gave me a lot of ideas... I mean, lets say you crack the wifi password of someone, whose wife pays the 'internet' bill... You torrent 'teenage sluts 9' or whatever and you are guaranteed a 'result'... All it really did was inspire me to work out how this process works, and I will find that out once I'm free from some various work requirements as it seems a terrifying amount of power has been transferred without our knowledge heh... Some random dickheads turned my ip into my identity and I want to know how, I don't care much about the bill...
Black101 5y ago
Either way, Zoom messed up. But of course the school did too.
swiley 5y ago
This is very common in the US. If IP address is what they're basing the expulsion on they probably shouldn't be left in charge of people's kids.

by ratww 5y ago

valleyer 5y ago

Yeah, sounds possibly like: https://en.wikipedia.org/wiki/Carrier-grade_NAT https://en.wikipedia.org/wiki/Carrier-grade_NAT

dreamcompiler 5y ago
That was my first thought. I wonder what software reported the IP address? If it's the Zoom client then it's obviously meaningless because it's guaranteed to be in a private IP address range (if it's IPv4). If it's the Zoom server and CGN is being used by the student's ISP, then it's equally meaningless because while that will be a public IP address, it could be shared by 100 households. I'm also assuming the "experts" didn't make the bone-headed mistake of failing to verify the IP address was in a public range, but I've seen dumber errors.

matja 5y ago

This is DS-Lite (Dual Stack). Entire regions of ISP users may share a single IPv4 address. There are some IPv4-only websites I visit that show a CloudFlare captcha on every single visit (for 30 mins), presumably because they see a huge number of requests from this one NAT IP.

ratww 5y ago
Interesting! I was not familiar with the term DS-Lite! https://techmusa.com/dual-stack-lite/ https://techmusa.com/dual-stack-lite/
- m463 5y ago
  or https://en.wikipedia.org/wiki/IPv6_transition_mechanism#Dual-Stack_Lite_.28DS-Lite.29 https://en.wikipedia.org/wiki/IPv6_transition_mechanism#Dual...

danellis 5y ago

You missed the worst part: > ... said Scott Moulton, a Woodstock-based forensics expert hired by the attorney working on Malachi’s case. This forensics "expert" should know this.

jumelles 5y ago
Where does it say he doesn't? We have no idea what the logs say or how obviously wrong they may or may not appear.
nrmitchi 5y ago
There is a linked follow up article that is a bit clearer: > Moulton, who owns Forensic Strategy Services in Woodstock, also said the Zoom bombers’ local IP addresses, which pinpoint the device being used, did not match the configuration of Malachi’s router. > > Lotito said he did not think the Gwinnett County Board of Education considered Moulton’s report. It sounds like their expert did know, and explicitly pointed it out, but the findings were apparently ignored.
- cyberpunk 5y ago
  Why? Who are these people accountable to? This has real world consequences to this child, is it as simple as they're fucking bastards or what?
  - shadowgovt 5y ago
    > Who are these people accountable to? In every place in the US I'm aware of, the school board ultimately oversees administrators, and the school board is made of elected officials. > is it as simple as they're fucking bastards or what? The most charitable explanation is that they're in way over their heads technologically and concerned that incompetence will cost them their jobs if they try to do nothing. But I'm having difficulty finding a charitable explanation that respects the harm being wrong here can do to the 6th grader.
    - deleted 5y ago

PurpleFoxy 5y ago

This is possible. Many users can be sharing the same IPv4 using CG-NAT. I have found that when using mobile internet, every site that uses IP bans has already banned me for a previous users actions. It’s incredibly irresponsible to take action against someone based on their IP address alone.

olyjohn 5y ago
Starlink uses CG NAT for IPv4 and just recently started dishing out IPv6 addresses.
- kaliszad 5y ago
  Probably didn't want to go the AWS route of just buying a pile of IPv4 space from established organizations.
floatingatoll 5y ago
From an IT operator perspective, IPv4 bans are essentially the only recourse available for many — if not most — abuse/attack scenarios. They're unfair and unjust, but this is the price we pay of making tracing identities inaccessible to online abuse enforcement. If you have an idea on how abusive actors behind CG-NAT can be identified and blocked without blocking the entire CG-NAT, and that idea is not morally unacceptable to the hacker community (as captchas, fingerprinting, and IP bans are), then you can make a billion dollars on that idea. But it's been twenty years now that we've needed that idea, and I'm not holding my breath. Tech continues to insist that anonymity is more important than accountability. Our users pay the price of our insistence to this day.
- MathCodeLove 5y ago
  Instead of a permanent IPv4 ban consider issuing a temporary one just long enough to dissuade the aggressor from continuing their behavior. This would be just as effective, and is far less likely to impact others down the road.
  - 5y ago

jcomis 5y ago

also: >Teachers also said Malachi’s camera was on and he did not appear to be doing anything unusual So he was supposedly doing this while on camera and in class? This case seems so absurd.

wearywanderer 5y ago
While I agree the case is obviously absurd, I'm a bit confused what sort of evidence you think the webcam would give. In the hypothetical scenario where he did what he's accused of, and did it while on webcam, what would the webcam show? Probably just him looking at his screen, with maybe some typing noises? That wouldn't be evidence of anything, neither innocence nor guilt.
- spoonalious 5y ago
  One of the things he’s accused of of shouting racial slurs
  - wearywanderer 5y ago
    Malichi (the accused) reported hearing somebody yelling racial slurs. But the school's allegations are about him joining the channel with abusive screen-names. One of his teachers says that it wasn't Malichi's voice yelling the slurs.
    - mynameisvlad 5y ago
      Malichi and an independent teacher both corroborated that there was someone shouting racial slurs, so by taking this side that actually the school is only going after the abusive screen names, are you saying that there were two separate people Zoom bombing this class, Malichi and someone else? The school clearly knows they can't go after him for the racial slurs because he was on camera that whole time, so they chose not to focus on that. But it doesn't mean it didn't happen.
- dragonwriter 5y ago

Spooky23 5y ago

Wireless carriers use proxies and cgnat. Had a colleague who discovered some of the edge case failures with an app he was building.

sp332 5y ago

The ISP should be able to tell you which customer was using a particular port at a particular time. It's required for abuse moderation and forwarding DMCA notices, so I'm 99% sure they can do this if you bring a subpoena. Source: I worked on part of a system for this at an ISP.

cyberpunk 5y ago
Something that blew my mind recently; a teenage child of a friend of ours stayed with us recently and used our wifi to torrent some pron.. How do I know this? I got a letter in the mail telling me to pay <some amount of euros, over 1000> or deal with a whole legal shitshow.. And ok, I paid it.. I didn't tell the parents, but I'm now thinking.. How do these people have the ability to match a date time, ip to my identity without my permission? I did intend to pwn the legal firm and find out but I'm too busy, heh. edit: the guest wifi now goes via a vpn...
- neither_color 5y ago
  Uhm... what? You're paying 1000 euros and not telling his parents? I get that maybe you don't want to get the kid in trouble, but that's a LOT of money. I wouldn't even pay $100 if my guests did that.
  - cyberpunk 5y ago
    Yeah well, it was a total shakedown, fighting it would have cost more. I spoke to the lad, explained it, and how to cover his tracks better, and he's gonna saw a whole load of wood for me over the summer.. It worked out.. His parents aren't the type to really understand it, and I'm not the kinda guy to release that on him (and them) -- he's still the wunderkind... ;) edit: I also probably get paid too much.. :/
    - cyberpunk 5y ago
      Interestingly though, it gave me a lot of ideas... I mean, lets say you crack the wifi password of someone, whose wife pays the 'internet' bill... You torrent 'teenage sluts 9' or whatever and you are guaranteed a 'result'... All it really did was inspire me to work out how this process works, and I will find that out once I'm free from some various work requirements as it seems a terrifying amount of power has been transferred without our knowledge heh... Some random dickheads turned my ip into my identity and I want to know how, I don't care much about the bill...

Black101 5y ago

Either way, Zoom messed up. But of course the school did too.

swiley 5y ago

This is very common in the US. If IP address is what they're basing the expulsion on they probably shouldn't be left in charge of people's kids.