25 July 2010

A2 sends:

Cesium.clock.org and the IP it resides aren't owned by any government agency. The IP range is registered with ARIN by Shimomura under the name "Los Alamos National Laboratory". Somehow that slipped through ARIN QA. It's not a legitimate LANL net handle. Cesium.clock.org is a popular shell box for Bay Area hackers.

A3 sends:

This is not as cloak & dagger as it seems. That network is used/operated by UC San Diego (that is their address in the registration info).

24 July 2010

A sends:

Adrian Lamo hangs out all the time on a server called cesium.clock.org, with IP address [192.5.16.65]. This IP space is registered with ARIN to a network called "LANLLAND" belonging to the Los Alamos National Laboratory. Strangely, and unlike all other LANL networks, reverse DNS mapping for this network is provided by ARPA.NET -- an official-sounding network which is really the private domain of Tsutomu Shimomura. You'll remember Shimomura as the dork who "took down" hacker Kevin Mitnick, leading to an extensive campaign by 2600 Magazine for his release, and a later campaign to halt production of the "Takedown" movie aggrandizing Shimomura. Lamo works for 2600 and maintains their Facebook group.

Why is Adrian Lamo hanging out on the network of the Los Alamos National Laboratory if he has no affiliation with the government?

Is Lamo accessing 2600 servers from a computer or network controlled by Tsutomu Shimomura? Good question for 2600's Emmanuel Goldstein.

https://ws.arin.net/whois/?queryinput=192.5.16.65

OrgName:    Los Alamos National Laboratory 
OrgID:      LANL-1
Address:    9500 Gilman Drive MC 0505
City:       La Jolla
StateProv:  CA
PostalCode: 92093-0505
Country:    US

NetRange:   192.5.16.0 - 192.5.16.255 
CIDR:       192.5.16.0/24 
NetName:    LANLLAND
NetHandle:  NET-192-5-16-0-1
Parent:     NET-192-0-0-0-0
NetType:    Direct Assignment
NameServer: SRI-NIC.ARPA.NET
NameServer: NS1.ARPA.NET
NameServer: NS4.ARPA.NET
Comment:    
RegDate:    1983-05-09
Updated:    2000-05-23

RTechHandle: ARPA-HM-ARIN
RTechName:   American Regional Providers Association 
RTechPhone:  +1-858-534-5050
RTechEmail:  hostmaster[at]arpa.net 

OrgTechHandle: ARPA-HM-ARIN
OrgTechName:   American Regional Providers Association 
OrgTechPhone:  +1-858-534-5050
OrgTechEmail:  hostmaster[at]arpa.net



http://www.robtex.com/dns/arpa.net.html#whois

Registrant:
American Regional Providers Association
9500 Gilman Drive, MC 0505
La Jolla, CA 92093-0505
US

Domain Name: ARPA.NET

Administrative Contact, Technical Contact, Zone Contact:
American Regional Providers Association
Shimomura, Tsutomu
9500 Gilman Drive, MC 0505
La Jolla, CA 92093-0505
US
858-534-5050
tsutomu[at]sdsc.edu