4 ms·

Yep. If he had real people or real companies buying these IP addresses (even if they are shell companies) he would be fine. Apparently he started like that but

by tlogan 3y ago

Yep. If he had real people or real companies buying these IP addresses (even if they are shell companies) he would be fine. Apparently he started like that but then he got greedy and said: fuck I will just invent some fake people. The actual criminal activity (fradulent affidavits, forged signatures) started in 2017.

itchyouch 3y ago
I worked for a dial-up ISP that was going out of business and their last hurrah was selling renting servers doling out clean IPs from their /16 blocks so the clients could spam like crazy. Then we encountered these spammers were willing to forge BGP LOA stating that they could announce certain, defunct and unused blocks on BGP. I left there in a hurry, but it seems like they got away with it for a while. It would've been pretty catastrophic if their upstream ISPs decided to cut them off because they were announcing blocks they should not have been.
- tialaramex 3y ago
  Of course if the transit providers did a better job (to be fair you're talking about years ago when this wasn't close to practical) they'd reject the announcements as bogus, no need for administrative punishment if it just doesn't work so nobody tries it. Today RPKI means that machines can in effect authenticate the LOA, the same way your web server is able to prove it's itchyouch.example (or whatever) to a web browser, the real owners of 203.0.113.0/24 can prove to a machine they're the real deal and you aren't. Unfortunately there are still transit providers who don't do that, or have it set just to bring the discrepancy to the attention of a human.
  - icedchai 3y ago
    Last I checked, RPKI was still not in use for the majority of prefixes: https://rpki-monitor.antd.nist.gov/ROV https://rpki-monitor.antd.nist.gov/ROV This is likely true for much of the legacy space in the US, since ARIN requires you sign their registry agreement and actually pay fees to enable RPKI. It's not grandfathered.
nodesocket 3y ago
I'm not clear why he needed to use fake names and forged signatures? Couldn't he just create legal LLC's in various states (Nevada is a good one) which don't expose the entities owners and use those to purchase the IPs from ARIN? Rinse and repeat.
- tlogan 3y ago
  I assume that he just run out of friends/colleagues/bodies who will run these companies. I do not know how many companies he created but 10 of them were fradulently incorporated.
  - nodesocket 3y ago
    You don't need friends/bodies. A single person can create as many LLCs as they want is my understanding.
klipt 3y ago
At what point does using a fake name turn into a felony? How about creating an email address using a pseudonym? Or does it have to involve money? If someone uses a fake name to order a sex toy delivered (out of embarrassment) is that wire fraud?
- kstrauser 3y ago
  I'm not a lawyer, but: it becomes a crime when you use it to commit fraud. If you fake a name to buy something embarrassing, then pay the other person as agreed, nothing illegal happened. My understanding is that using an alias to commit a fraud is an aggravating factor, like it means you went out of your way to deliberately hide your crime. It'd be awfully hard to convince a court that you made an honest mistake if you lied about your identity during the process.
- anonymfus 3y ago
  "Whoever, having devised or intending to devise any scheme or artifice to defraud, or for obtaining money or property by means of false or fraudulent pretenses, representations, or promises, transmits or causes to be transmitted by means of wire, radio, or television communication in interstate or foreign commerce, any writings, signs, signals, pictures, or sounds for the purpose of executing such scheme or artifice, shall be fined under this title or imprisoned not more than 20 years, or both. If the violation occurs in relation to, or involving any benefit authorized, transported, transmitted, transferred, disbursed, or paid in connection with, a presidentially declared major disaster or emergency (as those terms are defined in section 102 of the Robert T. Stafford Disaster Relief and Emergency Assistance Act ( 42 U.S.C. 5122 )), or affects a financial institution, such person shall be fined not more than $1,000,000 or imprisoned not more than 30 years, or both." So if you are doing things purely for anonymity it's OK, but if you are registering many email addresses to overcome email service's per account free storage limit, or if you order sex toy delivery for new identity to get a first buyer's discount multiple times, then as I understand that could be a wire fraud.
  - hattmall 3y ago
    Sounds like using an Adblocker could technically constitute wire fraud. Especially if the service offers a paid version without ads.
broknbottle 3y ago
Nah he was doing the forging way before that as I had left my previous role in NOC back in 2017. I dealt with this guy probably around 2015-2016 and after we got a complaint about announcement we suspected forgery as the rightful owner shared more than this guy could except for some docs which apparently the other party never signed but magically there was a signature.

by tlogan 3y ago

itchyouch 3y ago

I worked for a dial-up ISP that was going out of business and their last hurrah was selling renting servers doling out clean IPs from their /16 blocks so the clients could spam like crazy. Then we encountered these spammers were willing to forge BGP LOA stating that they could announce certain, defunct and unused blocks on BGP. I left there in a hurry, but it seems like they got away with it for a while. It would've been pretty catastrophic if their upstream ISPs decided to cut them off because they were announcing blocks they should not have been.

tialaramex 3y ago
Of course if the transit providers did a better job (to be fair you're talking about years ago when this wasn't close to practical) they'd reject the announcements as bogus, no need for administrative punishment if it just doesn't work so nobody tries it. Today RPKI means that machines can in effect authenticate the LOA, the same way your web server is able to prove it's itchyouch.example (or whatever) to a web browser, the real owners of 203.0.113.0/24 can prove to a machine they're the real deal and you aren't. Unfortunately there are still transit providers who don't do that, or have it set just to bring the discrepancy to the attention of a human.
- icedchai 3y ago
  Last I checked, RPKI was still not in use for the majority of prefixes: https://rpki-monitor.antd.nist.gov/ROV https://rpki-monitor.antd.nist.gov/ROV This is likely true for much of the legacy space in the US, since ARIN requires you sign their registry agreement and actually pay fees to enable RPKI. It's not grandfathered.

nodesocket 3y ago

I'm not clear why he needed to use fake names and forged signatures? Couldn't he just create legal LLC's in various states (Nevada is a good one) which don't expose the entities owners and use those to purchase the IPs from ARIN? Rinse and repeat.

tlogan 3y ago
I assume that he just run out of friends/colleagues/bodies who will run these companies. I do not know how many companies he created but 10 of them were fradulently incorporated.
- nodesocket 3y ago
  You don't need friends/bodies. A single person can create as many LLCs as they want is my understanding.

klipt 3y ago

At what point does using a fake name turn into a felony? How about creating an email address using a pseudonym? Or does it have to involve money? If someone uses a fake name to order a sex toy delivered (out of embarrassment) is that wire fraud?

kstrauser 3y ago
I'm not a lawyer, but: it becomes a crime when you use it to commit fraud. If you fake a name to buy something embarrassing, then pay the other person as agreed, nothing illegal happened. My understanding is that using an alias to commit a fraud is an aggravating factor, like it means you went out of your way to deliberately hide your crime. It'd be awfully hard to convince a court that you made an honest mistake if you lied about your identity during the process.
anonymfus 3y ago
"Whoever, having devised or intending to devise any scheme or artifice to defraud, or for obtaining money or property by means of false or fraudulent pretenses, representations, or promises, transmits or causes to be transmitted by means of wire, radio, or television communication in interstate or foreign commerce, any writings, signs, signals, pictures, or sounds for the purpose of executing such scheme or artifice, shall be fined under this title or imprisoned not more than 20 years, or both. If the violation occurs in relation to, or involving any benefit authorized, transported, transmitted, transferred, disbursed, or paid in connection with, a presidentially declared major disaster or emergency (as those terms are defined in section 102 of the Robert T. Stafford Disaster Relief and Emergency Assistance Act ( 42 U.S.C. 5122 )), or affects a financial institution, such person shall be fined not more than $1,000,000 or imprisoned not more than 30 years, or both." So if you are doing things purely for anonymity it's OK, but if you are registering many email addresses to overcome email service's per account free storage limit, or if you order sex toy delivery for new identity to get a first buyer's discount multiple times, then as I understand that could be a wire fraud.
- hattmall 3y ago
  Sounds like using an Adblocker could technically constitute wire fraud. Especially if the service offers a paid version without ads.

broknbottle 3y ago

Nah he was doing the forging way before that as I had left my previous role in NOC back in 2017. I dealt with this guy probably around 2015-2016 and after we got a complaint about announcement we suspected forgery as the rightful owner shared more than this guy could except for some docs which apparently the other party never signed but magically there was a signature.