524 stories
·
2 followers

We spent $20 to achieve RCE and accidentally became the admins of .mobi

1 Comment

Welcome back to another watchTowr Labs blog. Brace yourselves, this is one of our most astounding discoveries.

Summary

What started out as a bit of fun between colleagues while avoiding the Vegas heat and $20 bottles of water in our Black Hat hotel rooms - has now seemingly become a major incident.

alt

We recently performed research that started off "well-intentioned" (or as well-intentioned as we ever are) - to make vulnerabilities in WHOIS clients and how they parse responses from WHOIS servers exploitable in the real world (i.e. without needing to MITM etc).

As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023.

Putting thoughts aside, and actions first, we punched credit card details as quickly as possible into our domain registrar to acquire dotmobiregistry.net - representing much better value than the similarly priced bottle of water that sat next to us.

Our view was that as a legacy WHOIS server domain, it was likely only used by old WHOIS tools (such as phpWHOIS, which conveniently has an Remote Code Execution (RCE) CVE from 2015 for the parsing of WHOIS server responses – thus fitting our aim quite nicely).

Throwing caution into the wind and following what we internally affectionately refer to as our 'ill-advised sense of adventure' - on Friday 30th August 2024 we deployed a WHOIS server behind the whois.dotmobiregistry.net hostname, just to see if anything would actually speak to it actively.

The results have been fairly stunning since - we have identified 135000+ unique systems speaking to us, and as of 4th September 2024 we had 2.5 million queries. A brief analysis of the results showed queries from (but certainly not limited to):

  • Various mail servers for .GOV and .MIL entities using this WHOIS server to presumably query for domains they are receiving email from,
  • Various cyber security tools and companies still using this WHOIS server as authoritative (VirusTotal, URLSCAN, Group-IB as examples)

However, significant concern appeared on 1st September 2024 when we realised that numerous Certificate Authorities responsible for issuing TLS/SSL certificates for domains like 'google.mobi' and 'microsoft.mobi', via the 'Domain Email Validation' mechanism for verifying ownership of a domain, were using our WHOIS server to determine the owners of a domain and where verification details should be sent.

We PoC'd this with GlobalSign and were able to demonstrate that for 'microsoft.mobi', GlobalSign would parse responses provided by our WHOIS server and present 'whois@watchtowr.com' as an authoritative email address.

Effectively, we had inadvertently undermined the CA process for the entire .mobi TLD.

As is common knowledge, this is an incredibly important process that underscores the security and integrity of communications that a significant amount of the Internet relies upon. This process has been targeted numerous times before by well-resourced nation-states:

While this has been interesting to document and research, we are a little exasperated. Something-something-hopefully-an-LLM-will-solve-all-of-these-problems-something-something.

As always, we remind everyone - if we could do this, anyone can.

Onto the full story...

Setting The Scene

We're sure you’re familiar with the old adage, ‘it never rains but it pours’. That was definitely the case here, where we set out with the intention of just getting some RCE’s to fling around, and ended up watching the foundation of secure Internet communication crumble before our eyes.

Before we get ahead of ourselves, though, let’s start at the beginning, in which we decided to take a quick look at a WHOIS client. The protocol being some 50+ years old, we expected WHOIS clients to be constructed with the same brand of string as an enterprise-grade SSL VPN appliance, and so we took a naive shot and served up some A’s.

# python3 -c "printf( 'Domain Name: ' + 'A' * 3000)" | nc -w1 -l whois
alt

Haha, we were right. Funny.

This, at first glance, looks like an easily-exploitable crash. We were keen to find more bugs, and keenly started examining some other client implementations - but we were soon interrupted by some vocal killjoys naysayers.

They were quick to remind us that, to get to this state in our lab environment, we’d impersonated a WHOIS server, redirecting traffic from the usual server to our test server via iptables.

How realistic was this attack scenario, the naysayers asked?

alt

We tried to silence the killjoy's naysayers and convince them our attack was plausible - we could find a registrar that allows us to set a Referral WHOIS value, or buy an IP range and control the range ourselves - but they suggested we spend more time doing, and less time playing academia.

The reality was that in order for an attacker to carry out an attack against a WHOIS client, they’d need one of the following:

  • A Man-In-The-Middle (MiTM) attack, which requires the ability to hijack WHOIS traffic at the network layer - out of reach for all but the most advanced of APTs,
  • Access to the WHOIS servers themselves, which is plausible but unlikely, or
  • A WHOIS referral to a server they control.

These are effectively the preconditions of a nation-state or someone who is very comfortable compromising global TLD WHOIS servers in pursuit of exploiting clients.

You would, at this point, be forgiven for thinking that this class of attack - controlling WHOIS server responses to exploit parsing implementations within WHOIS clients - isn’t a tangible threat in the real world.

We were left unsatisfied. We had located some shoddy code, but declaring it out of reach sounded like something you might bill a day rate for.

Perhaps there was another avenue for attack?

Collateral Damage In Pursuit Of RCE

The key to turning this theoretical RCE into a tangible reality is rooted in the tangled mess of the WHOIS system.

One of the biggest ‘kludges’ in the WHOIS system is the means of locating the authoritative WHOIS server for a given TLD in the first place.

Each TLD (the bit at the end of the domain), you see, has a separate WHOIS server, and there’s no real standard to locating them - the only ‘real’ method being examining a textual list published by IANA. This list denotes the hostname of a server for each TLD, which is where WHOIS queries should be directed.

As you can imagine, maintainers of WHOIS tooling are reluctant to scrape such a textual list at runtime, and so it has become the norm to simply hardcode server addresses, populating them at development time by referring to IANA’s list manually. Since the WHOIS server addresses change so infrequently, this is usually an acceptable solution.

However, it falls down in an ungraceful manner when server addresses change. With a little bit of legwork, we found that the WHOIS server for a particular TLD - .mobi - had been changed some years ago from the old domain whois.dotmobiregistry.net to a new server, at whois.nic.mobi.

Of course though, because the Internet is joined together by literal string and hopes/wishes at this stage, somebody had neglected to renew the old domain at dotmobiregistry.net meaning it was up for grabs by anyone with $20 and an ill-advised sense of exploration.

alt

We registered the domain, working on the theory that, while most client tooling would be updated to use whois.nic.mobi, most of the Internet population is still surprised when their 2011 SAP deployment gets popped, and thus WHOIS applications in production had a fairly decent chance of still referencing whois.dotmobiregistry.net.

Of course, this being the Internet, we got a little more than we bargained for.

alt

So What? It's Old

We soon realized the threat model for this attack had just changed.

Now that we control a WHOIS server, we were in the position to ‘respond’ to traffic sent by anyone who hadn’t updated their client to use the new address (auto updates are bad, turn them off).

No longer do we require a Man-In-The-Middle attack, or some exotic WHOIS referral, to exploit a WHOIS client vulnerability - all we need to do is wait for queries to come in, and theoretically respond with whatever we want.

The pre-requisites for real-world exploitation now sat within what we deemed ‘rough reality’.

alt

Things were beginning to escalate.

We had set out to find some simple bugs in WHOIS client tooling, file for some CVEs, get them fixed.. but then we realised that once again we’d probably chewed off more than we intended and things were about to become worse - much worse.

Never Update, Auto-Updates And Change Are Bad

Unfortunately, there is a lot of Internet infrastructure which depends on the antiquated WHOIS protocol.

Starting off slow, we’re now in a position to attack the many websites that run a WHOIS client and echo the results back to the user, injecting XSS or PHP eval payloads. Ethical (and legal) concerns prevent us from doing so, however - and we did not spend $20 to get an XSS.

Of course, our original goal was to find and exploit some 0day in WHOIS clients, or some other system that embeds a WHOIS client (such as a spam filter), similar to the trivial memory corruption we found earlier.

Our biggest hurdle here - as alluded to above - was the simplicity of the WHOIS protocol itself, which is a simple text-based TCP data stream. With so little complexity, there seemed very little room for developers to make errors.

Ha.

Prior Art

To fully understand and look to leverage our new capability and adjusted threat model, we decided to examine the area’s ‘prior art’ in exploitation, looking at historic attacks on WHOIS clients.

We were somewhat surprised that a search for relevant CVE data yielded relatively few results, which we attributed to the area being under-researched - the search return 26 CVE records.

Once we discount the irrelevant results, we are left with only three bugs that are triggered by malformed WHOIS responses.

This small number - three bugs since 1999 - makes it obvious to us that very little research has been done - likely due to the perception that any real-world exploitation comes with difficult prerequisites, such as control of a TLD WHOIS server.

But, there have been some interesting cases - just to give you a taste of where this is going.

phpWHOIS (CVE-2015-5243)

The first bug that our retrospective found was CVE-2015-5243. This is a monster of a bug, in which the prolific phpWhois library simply executes data obtained from the WHOIS server via the PHP ‘eval’ function, allowing instant RCE from any malicious WHOIS server.

The vulnerable code snippet:

foreach ($items as $match => $field) {
    $pos = strpos($val, $match);

    if ($pos !== false) {
        if ($field != '') {
            $var = '$r' . getvarname($field);
            $itm = trim(substr($val, $pos + strlen($match)));

            if ($itm != '')
                eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";');
        }

        if (!$scanall)
            break;
    }
}

What’s going on here?

The important item is the juicy eval statement in the middle of the snippet, which is fed data returned from the WHOIS server.

While it attempts to escape this data before it evaluates it, it does so imperfectly, only replacing " with the escaped form, \\\\" . Because of this, we can sneak in our own PHP code, which is then executed for us.

Netitude’s blogpost lays out all the details, and even provides us with exploitation code - ”;phpinfo();// - is enough to spawn a phpinfo page.

We tried this out on an application that uses phpWhois, purely to demonstrate, and it worked swimmingly:

alt

https://labs.watchtowr.com/content/images/2024/08/image-5.png

Clearly this is a powerful bug - the best part being that phpWhois hardcodes our newly found whois.dotmobiregistry.net in vulnerable versions (it's old, but at a cursory glance no-one appears to have ever updated phpWhois).

What other historic artefacts could we find, though?

Fail2Ban (CVE-2021-32749)

As we continued to examine historic client-side bugs, we came across CVE-2021-32749. This one is again a pretty nasty bug, this time in the ever-popular fail2ban package. It’s a command injection vulnerability, a vulnerability class keenly sought by attackers due to its power and ease of exploitation.

As you may know, if you have administered a fail2ban server, the purpose of fail2ban is to monitor failed login attempts, and prevent bruteforce or password-guessing attacks by blocking hosts which repeatedly fail to log in.

Being the polished package it is, it also includes the ability to email an administrator when an IP address is banned, and - very helpfully - when it does so, it will enrich the email with information about who owns the banned IP address.

This information is gleaned from - yeah, you guessed it! - our friend WHOIS.

Unfortunately, for some time, the output of the WHOIS client wasn’t correctly sanitized before being passed to the mail tool, and so a command injection bug was possible.

alt

Fortunately - or unfortunately, if you’re an attacker - because fail2ban runs a WHOIS query on the IP address rather than, for example, a domain name specified in the PTR record of an IP address of blocked hosts - this attack is not within reach still based on our newly found capability.

For those that control a WHOIS server that is queried for IP addresses, though, exploitation is simple - simply attempt to unsuccessfully authenticate to a server via SSH a few times to trigger a ban, and once fail2ban queries the WHOIS server for information on your IP address - serve a payload wrapped in backticks.

Reality check

So, the burning question on our minds - can we actually exploit these bugs, right now?

Well, at this stage, our view was fairly pessimistic in terms of achieving real-world impact. We saw the following pre-requisites:

  • The WHOIS client must be querying an old authoritative .MOBI WHOIS server and thus by definition, has not been working for quite a while
  • To achieve client-side code execution (i.e. compromise) via a WHOIS client vuln - the only public option available to us was disclosed in 2015 and appears to have been rectified in 2018 - likely due to the perceived lack of real-world exploitation mechanisms.

Meh. Our gut feeling remained that most of the Internet and those in the sane world would logically be querying the new .mobi authoritative WHOIS server whois.nic.mobi, rather than the decommissioned dotmobiregistry.net (which we now controlled).

“Surely no large organisations would still reference the old domain”, we thought to ourselves.

Kill WHOIS With Fire

Without skipping a beat and really not considering the consequences, we set up a WHOIS server beneath our new domain at whois.dotmobiregistry.net, and logged incoming requests. We specifically focused on two things:

  • Source IPs (so we can perhaps begin to work out who exactly was querying an outdated server), and,
  • The queried domain (because again, this may give off some clues).

We threw together the lglass server to respond to WHOIS requests that found their way to our WHOIS server, and returned:

  • ASCII art (we were relatively refrained here, but it was a priority)
  • Fake WHOIS details indicating watchTowr as the owner for every queried entity.

As this was our private server, we included a request for queries to cease (after all, they were unauthorised).

A quick test directly to our new WHOIS server showed that all was working as expected, with the following response provided for a query about google.mobi:

alt

Nice.

Uh…..

Well, it’s 2024 - absolutely no one has the ability to exercise patience, including ourselves.

So, we began just looking around the Internet for obvious locations that could be sending queries our way. Surely, we thought - surely! - the broken clients using an outdated server address wouldn’t be in anything major, that we use every day?

  • A significant number of domain registrars and WHOIS-function websites

etc (you get the idea)

alt

A screenshot of each WHOIS tool would become repetitive, but you get the idea.

  • urlscan.io - “A sandbox for the web” - used our WHOIS server for .mobi, too. You can see the results by browsing to a page representing any .mobi domain (like this one).
alt
  • VirusTotal, the popular malware-analysis site, was querying us! A tool dedicated to the analysis of hostile code seemed like an opportunity for enjoyment.
alt

Sadly, VirusTotal doesn't render our ASCII art properly, but as you can see - VirusTotal is querying our makeshift WHOIS server for this global .TLD and presenting back the results. We were also pleased to see that VirusTotal updated their records of who owns bbc.mobi:

alt

For anyone that has ever worked in offensive security, you occasionally get a sinking feeling where you realize something may be a little larger than expected, and you begin to wonder.. “what have we broken?”.

(Editors note: Technically, this should be ‘what was broken’, because people were querying our WHOIS server without authorisation and we’re very upset - get off our lawn!).

Well, with our WHOIS server clearly working - we figured we’d come back in a few days and see if anything at all reached out to us - giving us us a good excuse to stare at a separate PSIRT response indicating a 2 year lead time to resolve a vulnerability.

Being insatiable and generally finding it hard to focus on anything longer than a TikTok video of a dog in a hat, we took a look to see how many unique IPs had queried our new WHOIS server after a few hours:

$ sqlite3 whois-log-copy.db "select source from queries"|sort|uniq|wc -l
76085

Uh. Yes, that’s correct - this is 76,000+ unique source IP addresses that have sent queries to our WHOIS server in just a couple of hours.

We were somewhat dismayed when, after leaving our server running for around two days, the poor little SQLite DB containing the logs ballooned to some 1.3 million queries! Clearly, we’d stumbled into something more major than we’d anticipated.

We threw the list of IPs at ZDNS and just sat back, as a relatively feeble way of doing attribution:

$ cat whois-src.txt|./zdns PTR > ptr.txt

Anyway, the results were curious.

$ grep gov ptr.txt |{magic}|sort|uniq
.gov-east-1.compute.amazonaws.com."
.gov.ar."
.gov.bd."
.gov.br."
.gov.il."
.gov.in."
.gov.ph."
.gov"

Great. We’d inadvertently done a thing.

Some other highlights of source hosts (not exhaustive, but just to give you some idea of just how bad this trash fire appeared to be):

  • Mail servers! Lots and lots of mail servers.

    Spam filters will often do WHOIS lookups on sender domains. We saw a bunch of these, ranging from the aptly-named cheapsender.email through to mail.bdcustoms.gov.bd - which appears to be part of the Bangladeshi government's infrastructure. Yikes! Theoretically, we could cause mayhem by serving responses indicating that the sending domain was a known spammer - and even more mayhem-worthy to start fuzzing the WHOIS parsing code to pop RCE on the mail servers themselves.

    (We didn’t)

  • Leading on from that thought, what other .gov apparatus have we been queried by?
    Well, we found Brazil in our logs multiple times - for example, antispam.ap.gov.br and master.aneel.gov.br , and Brazil was not alone. We also found .gov addresses belonging to (but again not limited to):
    • Argentina,
    • Pakistan,
    • India,
    • Bangladesh,
    • Indonesia,
    • Bhutan,
    • Philippines,
    • Israel,
    • Ethiopia,
    • Ukraine,
    • USA.

Neat.

  • Militaries (.mil)
    • Swedish Armed Forces, for example
  • Universities (.edu)
    • All of them
  • We even saw cyber security companies - hey Group-IB, Detectify! - query our WHOIS server (presumably doing threat intel things for .mobi domains).
    • We saw Censys query us for ‘google.com’ and wondered if we’d get an APT number and a threat intel report shout-out if we’d been actively delivering payloads. Maybe we did? Check your boxen. (We didn't. Or did we?)

We’re still trying to determine what software solutions are in play here/configured to query this WHOIS server for .mobi - let us know if you have any ideas.

Those who are nefariously minded likely realised what we saw as well - with .gov and other mail servers querying us each time they received an email from a .mobi domain - we could begin to passively determine who may be in communication.

This is not ideal. How do we fix this? Well, hold that thought - IT GETS WORSE.

Tales of TLS

TLS/SSL. Everyone knows it - it’s that friendly little padlock icon in the address bar that assures you that your connection is secure. It’s powered by the concept of certificates - sometimes used for HTTPS, sometimes used for signing your malware.

For example, say you’re the owner of watchTowr.mobi. You want to secure communications to your web server by speaking TLS/SSL , so you go off to your favourite Certificate Authority and request a certificate (let’s also pretend you haven’t heard of LetsEncrypt).

The Certificate Authority will verify that you own the domain in question - watchTowr.mobi - and will then sign a private certificate, attesting to your identity as the owner of that domain. This is then used by the browser to ensure your communications are secure.

Speaking of LetsEncrypt, this thread is interesting - https://community.letsencrypt.org/t/why-doesnt-lets-encrypt-use-whois-information-for-domain-validation/46287). In this thread, forum posters detail why LetsEncrypt doesn’t validate domains via WHOIS. Seems paranoid.

Anyway, what does this have to do with WHOIS, and what does it have to do with us?!

Well, it turns out that a number of TLS/SSL authorities will verify ownership of a domain by parsing WHOIS data for your domain - say watchTowr.mobi- and pulling out email addresses defined as the ‘administrative contact’.

The process is to then send that email address a verification link - once clicked, the Certificate Authority is convinced that you control the domain that you are requesting a TLS/SSL cert for and they will happily mint you a certificate.

For example:

alt

Perhaps you can see where we’re going with this? sobs

If a TLS/SSL certificate authority is using our WHOIS server for .mobi domains, we can likely provide our own email address for this “Email Domain Control Validation” method.

alt

Uh-oh. Is this a fringe feature supported only by two-bit, poor-quality certificate authorities?

No! Here’s a sample of large TLS/SSL Certificate Authorities/resellers that support WHOIS-based ownership verification:

  • Trustico
  • Comodo
  • SSLS
  • GoGetSSL
  • GlobalSign
  • DigiSign
  • Sectigo

Going through the normal order flow, we began cautiously - by generating a CSR (Certificate Signing Request) for the fictitious domain watchTowr.mobi - the logic being that as long as our WHOIS server was queried, whether or not the domain was real was irrelevant because we respond positively to absolutely every request including domains that don’t actually exist.

# sudo openssl req -new -key custom.key -out csr.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:SG
State or Province Name (full name) [Some-State]:Singapore
Locality Name (eg, city) []:Singapore
Organization Name (eg, company) [Internet Widgits Pty Ltd]:watchTowr 
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:watchtowr.mobi
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

We’re not going to walk through each provider - for the purposes of illustration, we’ll use GoGetSSL.

Once we upload our watchTowr.mobi CSR to GoGetSSL, it is parsed, and we continue. The indication of these placeholder email addresses indicates that WHOIS was not successful - instead of the email address that our WHOIS server is configured to respond with (whois@watchtowr.com), we’re presented with only @watchtowr.mobi domains.

alt

That’s something of a relief.

The Certificate Authority has correctly determined that the domain watchTowr.mobi does not exist and thus if WHOIS is working as expected, no email addresses will be returned. We concluded that our newly set up WHOIS server was not being queried by the provider.

At least the world isn’t ending. Right? (spoiler: it actually was)

We carried on trying a few other providers until a thought occurred.

The WHOIS protocol is extremely simple. Essentially it is a string blob returned in various formats depending on the TLD serving it. Each provider implements parsing in their own way. Perhaps, before we write off our theory, we should make sure this verification mechanism is actually working as it is supposed to.

So, we began again - choosing microsoft.mobi as a .mobi domain that appeared to follow a fairly typical WHOIS format (when using the current .mobi WHOIS server).

The screenshot below shows that the legitimate WHOIS record for microsoft.mobi was correctly parsed at Entrust, as the only email addresses available for validation were at the microsoft.com domain:

alt

While the WHOIS record for watchTowr.mobi was not being parsed at all (indicating that Entrust was using the correct WHOIS server, and not ours):

alt

Looks good you think?

alt

WRONG.

We skipped and hopped over to the next provider, GlobalSign. GlobalSign reported that they were unable to parse the WHOIS record of microsoft.mobi:

alt

At this point, something clicked in our minds. Perhaps GlobalSign WAS querying our new WHOIS server - but the string returned by our WHOIS server was incompatible with GlobalSign’s parsing?

We copied the microsoft.mobi output from the legitimate WHOIS server, made it our own, and loaded it into our own WHOIS server - updated to look like the following:

alt

Holding our breath, we then re-triggered GlobalSign with a CSR for microsoft.mobi

alt
We want to be explicitly clear that we stopped at this point and did not issue any rogue TLS/SSL certificates to ourselves. This would undoubtedly create an incident, and require significant amounts of work by many parties to revoke and roll back this action.

Success!

The GlobalSign TLS/SSL certificate WHOIS domain verification system had queried our WHOIS server, parsed whois@watchTowr.com from the result, and presented it as a valid email address to send a verification email to, allowing us to complete verification and obtain a valid TLS/SSL certificate.

This is then blindingly simple:

  • Set up a rogue WHOIS server on our previously authoritative hostname, responding with our own email address as an ‘administrative contact’
  • Attempt to purchase a TLS/SSL certificate for a .mobi domain we want to target (say, microsoft.mobi)
  • A Certificate Authority will then perform a WHOIS lookup, and email us instead of the real domain owners [theory]
  • We click the link, and.. [theory]
  • … receive an TLS/SSL cert for the target domain! [theory]

Now that we have the ability to issue a TLS/SSL cert for a .mobi domain, we can, in theory, do all sorts of horrible things - ranging from intercepting traffic to impersonating the target server. It’s game over for all sorts of threat models at this point.

While we are sure some may say we didn’t ‘prove’ we could obtain the certificate, we feel this would’ve been a step too far — so whatever.

One Last Thing

Please stop emailing us..

alt

Here We Go Again..

We hope you’ve enjoyed (and/or been terrified by) today’s post, in which we took control of a chunk of the Internet’s infrastructure, opened up a big slab of juicy attack surface, and found a neat way of undermining TLS/SSL - the fundamental protocol that allows for secure communication on the web.

We want to thank the UK's NCSC and the ShadowServer Foundation for rapidly working with us ahead of the release of this research to ensure that the 'dotmobiregistry.net' domain is suitably handled going forwards, and that a process is put in place to notify affected parties.

The dotmobiregistry.net domain, and whois.dotmobiregisry.net hostname, has been pointed to sinkhole systems provided by ShadowServer that now proxy the legitimate WHOIS response for .mobi domains.

We released this blog post to initially share our process around making the unexploitable exploitable and highlight the state of legacy infrastructure and increasing problems associated with abandoned domains - but inadvertently, we have shone a spotlight on the continuing trivial loopholes in one of the Internet’s most vital encryption processes and structures - TLS/SSL Certificate Authorities. Our research has demonstrated that trust placed in this process by governments and authorities worldwide should be considered misplaced at this stage, in our opinion.

We continue to hold concern around the basic reality - we found this on a whim in a hotel room while escaping the Vegas heat surrounding Black Hat, while well-resourced and focused nation-states look for loopholes like this every day. In our opinion, we are not likely to be the last to find inexcusable flaws in such a crucial process. 

Although subverting the CA verification process was by far the most devastating of impacts that we uncovered, it was by no means the limit of the opportunity available to us as we also found everything from memory corruptions to command injections. Our ‘honeypot’ WHOIS server gave us some interesting statistics, revealing just how serious the issue is, and a large amount of Internet infrastructure continues to query us instead of the legitimate WHOIS servers.

We do not intend to call out any specific organization or maintainer here - the prevalence of this issue and the statistics on hand show that this is not a pure-negligence or competence related issue - but a fundamental flaw in how these processes work together.

It’s worth noting that all the above attacks that we were able to orchestrate given our takeover are also possible by any entity that is able to carry out MITM attacks - such as entities that control or can influence transit backbones. It would be very easy for an attacker with such access to fake WHOIS data for any domain, and thus obtain valid TLS/SSL certificates. Of course, there has been an insurmountable level of effort by major players to add transparency to this process over the years, and thus, 'pulling off' a heist of this scale has its operational hurdles.

At watchTowr, we passionately believe that continuous security testing is the future and that rapid reaction to emerging threats single-handedly prevents inevitable breaches.

With the watchTowr Platform, we deliver this capability to our clients every single day - it is our job to understand how emerging threats, vulnerabilities, and TTPs could impact their organizations, with precision.

If you'd like to learn more about the watchTowr Platform, our Attack Surface Management and Continuous Automated Red Teaming solution, please get in touch.

Adblock test (Why?)

Read the whole story
GaryBIshop
5 days ago
reply
Fun and scary reading.
Share this story
Delete

FBI busts musician’s elaborate AI-powered $10M streaming-royalty heist

1 Comment
trucks forming piano keys in front of warehouse - isometric projection

Enlarge (credit: anilyanik via Getty Images)

On Wednesday, federal prosecutors charged a North Carolina musician with defrauding streaming services of $10 million through an elaborate scheme involving AI, as reported by The New York Times. Michael Smith, 52, allegedly used AI to create hundreds of thousands of fake songs by nonexistent bands, then streamed them using bots to collect royalties from platforms like Spotify, Apple Music, and Amazon Music.

While the AI-generated element of this story is novel, Smith allegedly broke the law by setting up an elaborate fake listener scheme. The US Attorney for the Southern District of New York, Damian Williams, announced the charges, which include wire fraud and money laundering conspiracy. If convicted, Smith could face up to 20 years in prison for each charge.

Smith's scheme, which prosecutors say ran for seven years, involved creating thousands of fake streaming accounts using purchased email addresses. He developed software to play his AI-generated music on repeat from various computers, mimicking individual listeners from different locations. In an industry where success is measured by digital listens, Smith's fabricated catalog reportedly managed to rack up billions of streams.

Read 4 remaining paragraphs | Comments

Read the whole story
GaryBIshop
11 days ago
reply
Wow!
jgbishop
10 days ago
Such a nice illustration with this story.
Share this story
Delete

They don't make 'em like that any more: the 3.5mm headphone jack socket

1 Comment

“It it ain’t broke, replace it with something that is.”

About five years ago I was suddenly, unexpectedly taken ill. Not just ‘that’s a bit nasty’ ill, but ‘prepare for the worst’ ill. One thing that kept my spirits up in hospital, in the long watches of the night, was listening to comedy shows and audiobooks. I used my smartphone for this, since I had it with me, and a pair of old, wired headphones that I just had time to grab on my way to the ambulance.

I survived, of course, as evidenced by my continued ramblings on this site. But it was an unpleasant experience, made just a little better by a simple piece of technology: the 3.5mm headphone jack.

Now, of course, I do own wireless headphones and earbuds – I think almost everybody does. I also own several of those irritating USB dongles, that provide a 3.5mm port for devices that don’t have one. But here’s the problem: I can’t use my Bluetooth earbuds while they’re charging. And I can’t easily charge my phone whilst it’s connected to the USB dongle. In a critical-care facility, it’s hard enough to find one free mains socket to connect a charger to, let alone two.

In the debate about the benefits of wired and wireless headphones, I doubt anybody is thinking “What if I get sick?” It certainly wasn’t something I was thinking, either, until I actually did. Still, that experience made me think about all the advantages of having a headphone jack, some of which I’d thought about before, and some I hadn’t.

  • Sound quality is better. Maybe that won’t always be the case, but it is now. All decent headphones have an analog jack.
  • Almost any headphone or earphone will work with almost anything with a standard jack socket. That isn’t the case for USB dongles. Maybe that won’t always be the case, but it is now.
  • I can use the headphone jack to connect my phone or tablet to an amplifier, should the need arise. For certain headphones, that need does arise.
  • I can charge my phone whilst listening to music, which I do all day.
  • I don’t have to carry around a stupid dongle, which I will invariably lose.
  • Ordinary wired earbuds can be small enough to wear whilst sleeping. I’ve never seen Bluetooth earbuds that are.

The headphone jack is a “just works” kind of technology: there’s nothing complicated about it, and its not encumbered by patents, so anybody can make compatible equipment.

So, although “What if I get sick?” probably isn’t at the top of the list of questions that will guide your buying decision, we have to wonder what other things we lose, by replacing a well-established, robust technology with a complicated, flaky one.

On the other hand, the advantages of doing away with the headphone jack are:

  • Your cellphone is about ten pence cheaper.
  • Er… that’s it.

What makes the loss of the headphone jack so hard to bear is that it wasn’t done for the consumer’s benefit. To be sure, manufacturers made certain claims about the alleged benefits of losing the jack, but few of them stand up to much logical scrutiny.

The first manufacturer to make a point of dropping the headphone jack (I believe) was not Apple – as is commonly believed – but Oppo, and back in 2014. Their reason for doing so was at least a credible technical one: they said it made their phones about half a millimetre thinner. Maybe that was a selling point, maybe it wasn’t. But Apple couldn’t fall back even on this claim, because people found ways to fit a 3.5mm jack socket into the iPhones that lacked one, and even posted videos on Youtube showing how they did it. It wasn’t easy, but it was clearly possible. If Apple genuinely thought that omitting the jack would leave more room for other features, they didn’t actually provide any.

It’s notable that a number of companies mocked Apple’s decision to drop the headphone jack, before quietly doing the same themselves: Samsung and Google in particular. Samsung even cynically tried to withdraw all the advertising in which they had mocked Apple. Of course, nothing is ever really gone on the Internet, so we can continue to marvel at Samsung’s barefaced duplicity.

Some manufacturers claimed that the presence of the headphone jack made it difficult to keep their phones waterproof; but there’s a whole range of good-quality phones from around 2019-2020 that are waterproof to a reasonable degree, without sacrificing the jack.

No. All of these weak excuses are simply distractions from the real reason Apple, Samsung, and Google dropped the headphone jack: they all have a substantial investment in the manufacture of wireless headphones.

Apple owns Beats – this was a multi-billion dollar investment, in a company that manufactures Bluetooth headphones.

Samsung owns Harmon, which is know for the Harmon-Kardon and JBL audio brands. Again, these were multi-billion dollar acquisitions for Samsung, in companies with a strong interest in wireless audio.

Google owns Synaptics, Dysonics, RevX, and Tempow, all of which are active in the development of wireless audio. Google also hired Peter Liu from Bose, who was one of the original developers of the Bluetooth Low Energy specification.

It is very much in the interest of companies like Apple, Samsung, and Google to encourage their customers to buy into wireless Bluetooth headphones. Or, better yet, to force them to do so, by taking away the means to do anything else. After all, their executives have to justify the billions of dollars they’ve spent, acquiring suppliers and developers of wireless audio equipment.

The 3.5mm headphone jack has almost nothing to recommend it, technically speaking. It was criticized by hi-fi enthusiasts almost from its inception. The only things it has going for it are its simplicity, and the fact that everybody uses it. Well, everybody outside the world of mobile gadgets, anyway. This simplicity and ubiquity is a great benefit to consumers, which is why Apple, et al., don’t want to provide it – they have nothing to gain if consumers spend less money on their products.

The loss of the headphone jack would have hurt even if there were good technical reasons for it. As it turns out, there are none – it’s just another cynical way for big businesses to gouge consumers. A side effect of their strategy is that wired headphones themselves are becoming less available, as cellphone users were until recently major purchasers of these devices. It’s not difficult to get top-quality headphones with a jack – they all have one; but there are fewer and fewer mid-priced wired earbuds on the market.

The way to discourage companies behaving this way is for us all to take our business elsewhere. It’s still possible to get decent cellphones from Motorola, Asus, and Sony that retain the 3.5mm jack. I don’t believe that anything recent from Apple, Samsung, or Google has one, for reasons I explained earlier. Still, there are older cellphone models from these suppliers that do have a jack, and which are still good phones. I own the Samsung S10+, S10e, and Note 9, for example. They’re a few years old, but they still do everything I want and more.

If you’re a fan of the 3.5mm jack, it’s time to vote with your wallet.

Adblock test (Why?)

Read the whole story
GaryBIshop
14 days ago
reply
I want my headphone jack!
Share this story
Delete

My fake job in Y2K preparedness

1 Comment

In rare moments within the history of capitalism, too few workers exist. Not as an absolute, of course: in total, workers always outnumber paid possibilities for work; that’s how our economy functions. But in a specific industry, a shortage may emerge, if only for a brief time. In 1998, on my first day of work as an analyst with the accounting and consulting firm Arthur Andersen LLP, it was clear that some aberration in accumulation had placed me in the twenty-fourth-floor conference room of a Manhattan skyscraper, overlooking the Museum of Modern Art’s sculpture garden, staring at a PowerPoint presentation for new hires. On one slide was a cartoon duck, bespectacled and presented in profile, standing on the tiptoes of its webbed feet. In its hands was a sledgehammer, held overhead, ready to smash a desktop computer.

I would learn soon enough that this—my first professional and only corporate work experience—was a fake job. It was fake because although I worked with Arthur Andersen, I never worked for them. (Their shade of blue-chip firm would never have hired the likes of me: they recruited from places like Harvard; I’d recently graduated from Hampshire College. They required new hires to have impeccable GPAs; my school didn’t confer grades.) Instead, I was employed by a global advertising conglomerate that had hired Andersen on a consultancy project and then placed me alongside the Andersen team—the result of a confluence of staffing shortages.

It was, moreover, a fake job because Andersen was faking it. The firm spent the late 1990s certifying fraudulent financial statements from Enron, the Texas-based energy company that made financial derivatives a household phrase, until that company went bankrupt in a cloud of scandal and suicide and Andersen was convicted of obstruction of justice, surrendered its accounting licenses, and shuttered. But that was later.

Finally, it was a fake job because the problem that the Conglomerate had hired Andersen to solve was not real, at least not in the sense that it needed to be solved or that Andersen could solve it. The problem was known variously as Y2K, or the Year 2000, or the Y2K Bug, and it prophesied that on January 1, 2000, computers the world over would be unable to process the thousandth-digit change from 19 to 20 as 1999 rolled into 2000 and would crash, taking with them whatever technology they were operating, from email to television to air-traffic control to, really, the entire technological infrastructure of global modernity. Hospitals might have emergency power generators to stave off the worst effects (unless the generators, too, succumbed to the Y2K Bug), but not advertising firms.

With a world-ending scenario on the horizon, employment standards were being relaxed. The end of the millennium had produced a tight labor market in knowledge workers, and new kinds of companies, called dot-coms, were angling to dominate the emergent world of e-commerce. Flush with cash, these companies were hoovering up any possessors of knowledge they could find. Friends from my gradeless college whose only experience in business had been parking-lot drug deals were talking stock options.

The employment agency through which I got my fake job made no epistemological distinction between knowing something and knowing about something. JavaScript, for example, a computer programming language: I knew about it but did not know it. Fine. Was I aware that the modern world might go on a catastrophic hiatus of unknown duration at the end of 1999? I had heard of something to that effect, although if pressed I couldn’t have explained. The Conglomerate was not much more stringent. My interview consisted of about twelve minutes with a laconic, mustachioed, middle-aged Arthur Andersen manager named Dick. (One of the services Andersen had been asked to provide was to help hire the Conglomerate’s Y2K team.) “On a scale of one to ten, what’s your knowledge of computer software?” he began. I paused for a moment, unsure of whether our interview would include a demonstrative component, as had so many previous interviews for jobs I had not gotten. But his office was empty. I couldn’t see how he would test me. I said eight.

At a certain point all that had happened yesterday was our documenting, so then we documented that.

Tweet

“And what’s your knowledge of computer hardware, on a scale of one to ten?” Dick continued. The moment called for both boldness and modesty. I felt committed to eight, a number I had long appreciated for its intimations of infinity when turned sideways. So I repeated myself: “Eight.” It was true that one of my campus work-study jobs had been as a computer lab monitor. I could restart a PC or refill a printer’s paper tray if the situation demanded it, although it rarely did. I’d had the weekend evening shifts.

Dick’s next question would determine the development of my nascent career. “And what’s your level of problem-solving, on a scale of one to ten?” I sensed, suddenly, an opportunity to pass through a corporate loophole, to surmount my lack of credentials, training, and touch-typing skills and lean into my historical moment. “Nine,” I replied.

“That was it?” my girlfriend chirped when I reported to her the climax of my interview. The Conglomerate had hired me on the spot.


I was placed on the quality assurance team, assisting with work the Conglomerate had contracted to be carried out exclusively by the Arthur Andersen contingent. They weren’t called “a contingent” around the Y2K office. The consultants were referred to as the Andersen people, a term that exaggerated the partition between them and other Conglomerate employees, from whom they commanded both bewilderment and respect and, as often follows from the first two, a certain amount of resentment. These contradictory feelings stemmed from the fact that management consultants constituted then—and still do now—the vanguard of corporate work. They flit between companies and industries, parachuting in to diagnose problems and suggest, although rarely implement, “best-practice” solutions. It’s management consulting lingo, best-practice, and it indicates that the good is not enough: this isn’t Winnicott’s consulting room. Instead, management consultants aim for superlatives. They hire the best. They practice the best. They claim Pete Buttigieg among their alumni ranks. At the Conglomerate they had their own offices, their own meetings, their own schedules. They worked from the Conglomerate’s office space while they were on its project, but when they “rolled off” (they had their own terminology, too) they would take up residence within the ambit of another Andersen client.

“You’ve been selected because you’re Andersen quality but not Andersen price,” explained Cindy, the chipper data-warehousing expert who served as the quality assurance team’s Andersen-employed leader, on my second day of work. I felt like a piece of organic fruit found in the conventional produce bin. Cindy also told me that, as with wolves, pack solidarity was intense within Andersen groupings. So was a wariness toward intruders.

In the first meeting with my lupine team, I did stand out, though not for lack of credentials. In fact I was the only person not massaging a fistful of Play-Doh. The Conglomerate’s office was beige, the carpet beige, the people beige, too. But from each of the four quality assurance team members’ hands exploded a most brilliant collection of colors: neon greens and yellows, hot pink, siren red, an almost psychedelic scene. Team members twirled and juggled their own handfuls, separated their globs and recombined them. “It’s a new management technique,” Cindy said, before I could ask. “It helps relieve stress.”

Most team members had their own Y2K doomsday clock on their desk, tracking the years, months, days, hours, minutes, seconds, and milliseconds until techno-rapture.

Tweet

Cindy herself did not seem stressed, but the situation she laid out for our team was certainly overwhelming. The Conglomerate held more than a thousand advertising, public relations, and communication companies worldwide, with possessions in both emerging markets and well-established ones. These cumulatively raked in billions of dollars per year. But any or all of these “shops,” in industry lexicon, might collapse as one millennium ended and another began, preventing the Conglomerate from executing its global advertising operations and compromising its earnings and thus its stock price. Perhaps a radio station in Finland would go haywire and be unable to run a Conglomerate-booked spot; conceivably, a television station in Western Australia could disappear and, along with it, a Conglomerate-produced commercial; maybe a billboard would tumble off a highway in Rio de Janeiro amid social chaos, destroying a Conglomerate-created visual. If such events were to transpire, revenue loss would be a best-case scenario; one could imagine far worse. There had been a slide in the new-hire presentation, the one with the duck, that spelled out the possibilities: a stick figure with a thought bubble hovering above its perfectly circular head wondered: “On Jan. 1, 2000 will I still have: electricity, food, telephone, transportation... ?” Each life-sustaining noun was contained in its own thought bubble, and the final thought bubble offered only a series of anxiety-producing question marks (“?????”).

That same tremulous atmosphere permeated the office, where a thumbtacked photocopy of a Computerworld article entitled “Economist Predicts Y2K-Based Recession” greeted team members on their daily arrival at the elevator bay. In the windowless kitchenette, several copies of the book Time Bomb 2000 were available for employees to peruse while they warmed their instant coffee or selected a Pepsi product—Pepsi being a client—from the mini fridge. Most team members had their own Y2K doomsday clock on their desk, tracking the years, months, days, hours, minutes, seconds, and milliseconds until techno-rapture.

The first segment of the Conglomerate’s Y2K project, “Phase I: Inventory,” involved retrieving technological inventories from the Conglomerate’s various agencies and recording them in a database. The lesser, non-Andersen network analysts entered data about the number of PCs, routers, fax machines, and printers any given Conglomerate shop had in its possession, copying the material from a spreadsheet said shop had emailed them. The superior Andersen quality assurance analysts (and I) provided the oversight, identifying the mistakes our colleagues had made. Someone had hit the 0 instead of its keyboard neighbor, the 9; another team member, her mind wandering perhaps, had neglected to check the “entry completed” box. Little errors, but the general sense was that history would not judge them kindly. My team set out to rectify them before it had the chance.

The verb under whose sign the quality assurance team labored was a new one for me: to QA, past tense QAed. All mistakes our QAing located were recorded by hand; all handwritten records of our QAing were photocopied; the copies were kept in Cindy’s office while the originals were bound for a secure document warehouse in New Jersey. Necessarily, our records would be kept on paper. If the predicted Doomsday 2000 did arrive, the digital world would be inaccessible, maybe gone forever. Computer technology had gotten us into this millennial quagmire and could not be trusted to extricate us from it. Perhaps that’s why my problem-solving abilities had mattered more than my knowledge of computer software and hardware on Dick’s scale of one to ten. The fact that the scale itself remained undefined, and that neither interviewer nor interviewee agreed to its coordinates, suggested both the fake nature of the whole endeavor as well as the desperation the Conglomerate felt, its keen awareness that it was running out of time.


The Andersen position was that “Y2K is a documentation problem, not a technology problem.” One could not know the magnitude of the technical problems we would face on January 1, 2000, with complete certainty until that revelatory day arrived, and so 1/1/2000 functioned as a kind of horizon of contingency: would we all be launched, Back to the Future–like, into a new stone age, or would a few rest-area vending machines conk out and everyone get on with it? To contend with this range of possible futures, we focused on the past. Instead of fixing things with the hope that they would function later, we would document the anti-Y2K efforts the Conglomerate had already undertaken, necessarily more knowable than those events not yet in existence. We would not, for legal reasons, promise things to come; we would certify that things that had already transpired had been appropriately recorded. To the alarming claim of the Y2K town criers—modern life after 12/31/1999 cannot be guaranteed—the quality assurance team responded retrospectively: whatever happened yesterday would be consigned to a database. At a certain point all that had happened yesterday was our documenting, so then we documented that. Then, exponentially, we had to document ourselves documenting our own documentation.

Months of reading and populating spreadsheets turned me spreadsheet-like myself.

Tweet

These efforts—designed to avoid the liabilities of selling a project that offered a Y2K fix, because what if Y2K wasn’t “fixable”?—were part of a floating corporate-compliance rubric referred to only as the Process. Proprietary, capitalized, and always prefaced with that exclusive definite article, the Process could only be implemented by Arthur Andersen LLP. When a business engaged Andersen in a consultancy project, they purchased the Process. The Process seemed to have no printed home. To the extent that it existed, it passed between the minds and speech of Cindy and Dick. It was both accessible enough to be constantly appealed to—“the Process says,” “How would we apply the Process here?” “I’m not sure this syncs with the Process”—and inaccessible enough never to be grasped with Play-Doh–like tangibility. In keeping with the Process, the quality assurance team scoured hundreds of thousands, millions even, of Excel spreadsheet lines. My day began and ended with comparing database entry to inventory spreadsheet and writing in my own script Column 4, row 14: “18 routers” should be corrected to read “8 routers.” Column 9, row 10, empty. Indicate yes or no. This was dissociative, diminutive work, and time passed vertiginously, minutes and seconds overlapping on my teammates’ unsynchronized doomsday clocks until the day concluded with a final collective effort at preservation. All quality assurance analysts—not Cindy, for hierarchical reasons—would convene in the photocopy room to ensure that, come what may on December 31, 1999, the deliverables from our day’s labor would be archived, in print, in perpetuity. The only times we really spoke to each other in an uncurated fashion were over the blinding flashes and tray clicks of the Minolta copy machine. There we would discuss our commuting woes, roommate dramas, awkward dates, student loan repayment plans, as well as a rather unarticulated feeling of: What?


Who managed the management consultants? Cindy, shepherd of the Process, conducted random checks of all QAed spreadsheets and kept the results in her own spreadsheet. Dick and an elusive cabal of Andersen upper-tier management QAed Cindy. Once a rotund Andersen partner named Benjamin, outfitted in a yarmulke, a three-piece suit, and those unfortunate slipper-like Merrell suede shoes just making their way into the world in the late 1990s, spent an hour in the office, presumably to QA Dick.

The Conglomerate’s Y2K managing director, Justin, had constructed a makeshift smoking lounge in the utility closet across the hall from my cubicle. It was there that Justin and Dick would liaise and swap status updates, and Justin often hosted other visitors in his windowless, walk-in humidor. Invariably these were older, suited white men, a world of Dicks. I’d try to eavesdrop, to pry bits of information from the clouds of secondhand smoke that escaped under the door and hovered momentarily about my cubicle before being absorbed into the carpet. A few gems did waft out. I learned, for example, that I wasn’t the only team member to whom Cindy had described Arthur Andersen LLP as a pack of wolves: slender, agile, fangs bared, lips curled, marking their territory with urine (complimentary). When Justin heard this interspecies analogy, he balked. “More like bloodsucking leeches. They overcharge. Bullshit their billable hours. They want my employees to fuck up so I’ll fire them and they can bring in more Andersen people.... Of course they’re part of our team.”

But what, really, was there to hear? That the Process was vertically integrated apocrypha? That Dick had knowledge of his firm’s various fraudulent endeavors at Enron and was up to something similar here? In fact, Dick and Cindy could not have been more devoted, insistent as they were on evangelizing the Process to the Conglomerate’s office. “Y2K is a documentation problem, not a technology problem,” Cindy repeated at our weekly analyst meetings, and she invited us to say it with her.

Several months into my employment, in November 1998, a group of Andersen and Conglomerate elite visited our Y2K office to see what the $4 million Andersen project had produced in terms of Y2K preparedness. CEOs, COOs, CFOs, CTOs, an alphabet of executives, all men and some with aides-de-camp, filed through our office into a closed meeting. After their departure, Justin invited all team members into the conference room, where a Roman banquet of muffins and fruit pyramids, a well-appointed coffee cart, and the usual assortment of Pepsi products greeted us. None of these provisions had been touched, and team members were invited to pick through the refuse. “We just had over one hundred million dollars’ worth of executives in here,” Justin began. “They wanted updates.”

We were encouraged to review for ourselves a paper copy of the executive council presentation, many of which lay scattered about the oblong conference table. I was perplexed to see that it was essentially a rehash of the new-hire presentation. The cartoon duck holding the sledgehammer. The stick figure wondering, “On Jan. 1, 2000 will I still have... ?” The floating text box, conceptual art–like in display, “Y2K is a documentation” et cetera. But the mood in the conference room was ebullient and self-assured. Even the always starched and monogrammed Dick looked pleased. The man seldom spoke outside of closed-door klatches, but as a measure of the morning’s importance, he was invited by Justin to address the team. He rose and delivered a brief, litigious soliloquy:

“When January first of the year 2000 hits and a floodgate of Y2K lawsuits descends, and [we’re] being sued by everyone, and the firms who aren’t suing us, we’re suing, the indemnification issues, the claims of fiduciary responsibility and accusations of abandonment thereof. What are we going to need? Proof. They’re going to want to know what we did and how we did it. So that’s what this Council is concerned with, proof, paper, documentation. And that’s why our battle plan is simple: keep documenting, team.”


Months of reading and populating spreadsheets turned me spreadsheet-like myself: capacious but conceptless, able to record, to list, and to organize and sort, but according to an unthought, unthinkable orientation. After six weeks or so, and without much consideration, I began producing my own documentation, a kind of casual corporate ethnography. I noted the distribution of titles and nicknames at the Conglomerate. All the managers were men; all the analysts were women. Cindy was referred to as “the den mother.” Dick had an alliterative title that recognized his central place: “Dick, the documentation expert.” Justin, our commander, was hailed as “the general.” I, along with another young woman and quality assurance analyst, an engineer by training who shared my hair color, were given the clunky moniker “the blond QA twins.”

My favorite team member was a Viennese network analyst named Magdalena, who went by the German diminutive Leni. Tall and thin, accented and bespectacled, she hailed from fallen Austrian nobility. Her family had lost seven-eighths of their estate in World War I, but they nonetheless remained comfortable enough not to have to concern themselves with bourgeois trifles like work or mortgages. Had her father been a Nazi? Indeed, he had. Imagine a Captain von Trapp–like personality who had never softened under the melodious ensorcellment of a Fraulein Maria. Leni had fled her father’s eastern Reich not by yodeling her way over the Alps but through an American husband who got her a green card, then a transnational law firm that got her experience, and then, finally, an analyst position at the Conglomerate. When she interviewed with Dick, she had been asked to rate her foreign language abilities on his mysterious scale. Fluent in German, English, and French, proficient in Spanish, she had given herself a ten.

Each Wednesday we gathered for a general meeting with all team members: the database programmers, who never spoke; the disheveled but crucial IT coterie; all the Andersen people; Conglomerate managers; Dick. Sometimes the receptionist even set the phone to an automated answer function and popped by. By January 1999, after five months on the job, I’d come to find some comfort in the routine coordinates of the general meeting. At 2 PM, everyone except Justin would be seated in the conference room, Pepsi product in one hand, Cindy-authored agenda in the other, waiting for the meeting’s commencement, at which point Justin would announce through the all-office intercom that the meeting would begin five minutes late. Those minutes would pass and he would trudge in, a cloud of smoke all but trailing him.

General meetings involved an anonymous all-team exercise called “What’s Good? What Needs Improving?” Team members were instructed to rip a piece off some desolate corner of their 8 x 11 agenda and compose two reflections on these stated questions. The compositions were then passed to the table’s head for Justin to read.

Justin read aloud one Wednesday from the shrinking pile of anonymous comments. “What’s good: getting a lot done. Needs improving: kitchen out of Sweet’n Low.” And then: “What’s good: enjoyed my office Secret Santa gift. Needs improving: I don’t understand what the media team does and I will not accept ‘ask a member of the media team’ for an answer.” As he read, Justin’s countenance shifted from curiosity to uncertain disdain. He became aware—as did all team members—that his managerial style, his habit of punting, was being subtly mocked. Not only that: his antagonist was sitting among us. With a sly smile, somewhere between intrigued and embarrassed, he asked: “Who wrote this?” This query caused a swift reaction in Cindy, who responded, “This is an anonymous exercise.” Justin interrupted with Thank you, Cindy, who, so chastened, let Justin continue: “I asked—who wrote this?”

Dead silence of the urban kind only a skyscraper can provide, where a soft machinic din emits from the building itself. Team members, careful to avoid potentially implicating eye contact with each other, fixed their downcast stares on their Pepsi beverages. “You don’t want to tell me?” said Justin. “Fine. We’ll sit here all goddamn day. We’ll sit here till Y2K. Because I’m going to find out who wrote this fucking note.”

Sitting to the right of Cindy, an Andersen analyst named Tracy reached over, took the offending paper scrap, and meekly announced to the nervous audience, “It’s a girl’s handwriting.” I couldn’t have felt more relieved. My script is scraggly and angular, the furthest thing from that of a girl. Tracy too must have felt some relief, having just exculpated herself. And Cindy—who would suspect her? As team members began scanning the conference table, privately searching for someone whose handwriting was bubbly and who menstruated, the silence broke.

“I did it—I wrote the note.” Leni! Daughter of a Nazi. “It’s just that you never answer questions and I thought—well, I thought: You’re the boss, you will know.”

Justin ended the meeting by ordering her to stay alone with him in the conference room. Later I asked what Justin had said to her in private. “That I’m ‘on his shit list,’” she told me. And what did she say? “Fine.”


In February, with ten months left until the possible techno-finale of modernity, the Conglomerate decided to expand its Y2K preparedness operations and bring more Andersen people into the office. The new consultants also seemed to be wondering what the media team did. Located in an office directly behind my cubicle, they appeared to occupy themselves in the same way we did: printing spreadsheets, photocopying them, faxing them, and placing them in binders. Where the media team distinguished itself was in its leadership: it was the one team in the Conglomerate’s Y2K shop run by a manager of color. Perhaps the only bit of knowledge I had of this manager was that he had somehow managed to board a plane to Brazil without having secured the necessary entrance visa. When he arrived in São Paulo he was detained, denied passage, and put on a flight back to NYC. He’d blamed the corporate travel agent, the gay and moody Carlos, and demanded his firing.

Instead, the Andersen axe fell on him. In a presentation to the Conglomerate higher-ups, Dick and a group of Andersen top brass declared that the media team was floundering. Their recommendation: the Conglomerate should fire its one Black Y2K manager, clear out any of his remaining loyalists on what came to be known as the old media team, bring yet more Andersen consultants into the office, and let them staff a new media team. Heather, the Andersen person who had conceived this coup de grâce, naturally took the reins. Her first move was into the old media team’s office; her second charge was to populate her team. She needed someone familiar with the Process, someone of Andersen quality but not Andersen price. “You’d actually be helping with critical management considerations,” Cindy said, after she’d invited me, for the first time since my hiring, into her office. “Think of it as a promotion.”

I didn’t know what the media team did, and Leni had been placed on a private shit list for even asking. And the quality assurance team was almost finished with our QA of the inventory database—we had located around 6,700 typos, many of which had been remediated and all of which had been documented as the result of our efforts. After such a collective accomplishment, it felt like an odd time to jump ship. In talking to Cindy, however, I realized that just as the offer to join the media team was to be thought of as a promotion, it was also to be thought of as a choice.

Changing teams meant learning the ways of a new Cindy, namely a Heather, whose ward I became and whose office I now shared. In contrast to Cindy’s genuine enthusiasm for everything about management consulting, from the Play-Doh to the Process, Heather had a hardened corporate cynicism about her. She daily took calls from her interior decorator, Yves, who always seemed to be fifteen blocks away selecting upholstery and end-table pairings at Upper East Side boutiques. In those days before smartphone image-sharing, Yves would engage in elaborate ekphrastic descriptions of this piece or that. Heather put these conversations on speakerphone so she could continue typing with both hands, her manicured nails dancing above the keyboard with such intensity that often she had to ask Yves to repeat himself.

It was one of those out-of-body, disassociated experiences, so often provoked by trauma but here provoked by management consulting.

Tweet

She overheard me, too, of course. Leni had learned that our Y2K office had a toll-free number that, in the case of an advertising-oriented Y2K emergency, Conglomerate employees could call to solicit expert advice: 1-800-Y2K-SAVE. But it was March—hardly time for the world’s advertisers to panic about a Time Bomb 2000 detonation—and the line was usually quiet. In the meantime, team members in the know had begun giving out the office 800 number. Friends anywhere in the world could chat with any team member toll free. For me, free long-distance telephony was an enjoyable extracurricular perk, a way to talk to my girlfriend in Massachusetts, ideally when Heather wasn’t around to listen.

The objective of the media team was to inquire into the state of Y2K preparedness for the radio stations, television stations, and newspapers that were the Conglomerate’s most important global media vending partners. We would do this by mailing them a Y2K questionnaire. Within a few weeks of our dour partnership, Heather had condensed our team’s trajectory into a single PowerPoint slide featuring so many capitalized common nouns that, looking back over my notes from the time today, I get the anachronistic sense of reading late-18th-century English.

New Media Team:

  • Media is Y2K mission critical
  • Is designing Y2K Questionnaire
  • Will be contacting Media Vendors
  • Will suggest Y2K Contingency Guidelines

The first bullet point was a bit of a non sequitur, more atmospheric than definitional, and I’m surprised it won Dick’s approval. The second? An outright fabrication—Heather downloaded our team’s generic questionnaire from a fly-by-night website called Y2K.com. The third bullet point, at least, was not entirely fake. The new media team had inherited from the old media team a bulging, imposing binder full of vendors’ mailing addresses. A data dump would transfer those addresses from the binder to a database, and those addresses would be used to send the questionnaire—but first, a QA of the media vendor database was required. Someone needed to identify the bugs and infelicities, the doubles and deletions, that even the cleanest data always seems to include. That someone would be me.

It fell to Leni to reveal what I should have already known: that mine had been a fake promotion. Perhaps I had been moved laterally, or perhaps even that was too optimistic of an assessment. Some clues were obvious: I hadn’t received a raise, for example. Others, more subtle. Quality assurance analyst has a certain corporate gravitas to it, but what would media vendor analyst mean on my resume if I wanted to leverage my Conglomerate time into a future Fortune 500 life or defect to Deloitte? She observed my simmering angst and provided a German term: Weltschmerz, or world-weariness. Leni said I was suffering from it. She advised me to open an E*TRADE account and to orient my portfolio toward biotech. She had staked out a position in Amgen and had, within some months, doubled her money.


It’s a tricky risk proposition to mail unsolicited and legally implicating requests to corporate partners all over the world, but the Process demanded it. What, the questionnaire asked, were they doing to prepare for Y2K? For example, were they contacting third-party suppliers to inquire about their Y2K readiness? We knew very well that those five thousand media vendors wouldn’t respond to our questionnaire, because the Conglomerate itself didn’t respond to the thousands of questionnaires it received from its own business partners asking basically the same question. Heather explained that the Process wouldn’t allow a response, due to the legal vulnerability created by the disclosure of such information to another company.

By summer, perhaps our final one, the Andersen people decided that in addition to documentation, personal contact with the Conglomerate agencies was needed to stress the importance of Y2K. Many team members began trotting the globe to conduct Y2K site visits, and the office took on a transient, desolate quality. The speckled dropped ceiling seemed to sag under the weight of the HVAC infrastructure. The Diet Pepsi began to leave a sour aftertaste. Leni decamped to Asia for two weeks to support a series of Y2K regional meetings. Cindy headed for Vancouver to instruct the Conglomerate’s Pacific Rim shops in the ways of the Process. Even Justin left his smoking lounge to take a pre-millennial working tour of Paris, Brussels, and London.

“This is your chance, LC,” Cindy informed me at the commencement of my own Y2K grand tour. My ambitious itinerary included cities I had long fantasized about visiting: Tokyo, Hong Kong, urban constellations along the eastern coast of Australia. There would be time for surreptitious tourism, too: the café in Buenos Aires where Marcel Duchamp played chess, the Zócalo and its murals in Mexico City. None of this is what Cindy meant, however. She told me of one team member who “earned so many frequent flier miles, he took his whole family to Sydney business class. They got a club-level suite at the harbor Hyatt.” Other team members had redeemed miles for Hawaii junkets, or converted them into points for cruise bookings, vouchers for rental-car upgrades, discounts on duty-free alcohol and tobacco purchases. Around me, I realized, had whirred an opaque economy whose currency was only now becoming apparent. Suddenly, the number of mission-critical Y2K situations throughout the Asia-Pacific region made sense: first-class tickets generate triple frequent flier miles. So did team members’ preoccupation with South Africa, a fourteen-hour flight from NYC, and not just Johannesburg: Durban and Cape Town, too, had become improbable locations of Y2K concern. Meanwhile, Canada, our proximal neighbor and English-speaking sibling, home to multiple Conglomerate shops but no long-haul flights, was judged to be fairly Y2K-prepared.

I became as greedy a reward accumulator as the next team member. But during many of my international media site visits, I felt the reliable tug of impostor syndrome. On a trip to Tokyo, in place of the usual audience of one or two media-vendor colleagues in a dingy conference room, two analysts and I were led into the agency’s unexpected auditorium to find that a sea of suited businessmen awaited us. Perhaps they had taken our intra-Conglomerate communications seriously: we had after all sent word that the world—or at least the advertising industry—might be ending in short order.

I had always taken some comfort in knowing I was speaking to people whose fluency in English could not be guaranteed. That distance in communication, real or perceived, had been crucial for me as I asked my series of absurd questions. If global technology ceased 1/1/2000, how would your agency continue its operations? The Tokyo shop, however, had arranged for a translator. In an English accent, she asked me to enunciate slowly so she could select her words with the kind of care a world-ending situation demanded.

“On January 1, 2000, will you still have...” I began. Concerns were shared about the Tokyo media market: “No Japanese media vendors responded to our Y2K preparedness questionnaire.” It was one of those out-of-body, disassociated experiences, so often provoked by trauma but here provoked by management consulting. As Leigh Claire the media-vendor analyst held forth, paused for translation, and then continued, a second, depersonalized Leigh Claire wandered off the stage, collected herself, and took notes. I was disturbed at my own ability to make millenarian pronouncements. Exponentially, like a QAer documenting her own documentation, I began to doubt my own self-doubt.

Many of my Japanese colleagues’ responses to my presentation concerned my appearance. My Conglomerate confrères noted how unusual it was to have a young woman with blond hair in their presence, the translator, a brunette woman herself, seemed somewhat embarrassed to convey. “It’s exciting for them,” she editorialized, “you know, the difference.” My blond hair color, the highlights—were these a naturally occurring phenomenon, they wondered. One male media hand after another went up: How old was I and what was my marital status? How long would I be in Tokyo and what were my plans? What were my recreational interests?

This attention to my person was not without benefit: it did distract from Y2K. If someone had asked about servers, routers, why the response rates to our questionnaire mailing in Japan were so low, what advice I had for Y2K compliance, I would have likely taken recourse to my own contingency plan, one developed just then—I would have spoken about the contingency of knowledge itself. Perhaps I had become a convert to the Process: the future could not be known until its moment arrived, and at that point it was no longer the future.


Late in that anxious August of 1999, a freak midnight flood struck New York City. Small puddles dotted the paving stones of Brooklyn’s sidewalks and the asphalt had that technicolor, water-mixed-with-gasoline slickness about it. The trains were delayed enough that I didn’t leave for Midtown until 10:30. I emerged from the damp morning into a transformed corporate world.

Cindy was perched with hawklike intensity inside a kind of bivouac she’d created between the office door and the elevator. She had a clipboard in one hand and a pen in the other. I had barely crossed the threshold when she broadcast clear across the stand of cubicles: “LC made it!” A different voice rang back: “Check.” Cindy had meant to affect a tone of relief at my arrival, but her excitement won out. The woman had spent more than a year preparing the office for a crisis, and now we had one: a flash flood. She herself had walked to work, she said. From the Upper West Side! She said this as though reporting on an alpine trek. A swift and unexpected nocturnal rain had swept through the city, Cindy related. “Some team members won’t make it,” she said, and, without any sense of her own drama, let a pause take hold before finishing her sentence: “into the office today.”

At Wednesday’s general meeting, Justin gave Cindy all kinds of commendations for her swift crisis management. The phone tree she had set up practically out of the ether. A collection of alternate transportation routes she’d compiled that team members could consult to solicit guidance on getting into the office in the event of a natural or—dare one say it—technological disaster. A buddy system she organized in which team members could locate a partner, alphabetically or by neighborhood. Already she had initiated the process of assembling the materials into a binder. Dick, her mentor and her boss, gave off a silent but approving glow. Cindy had saved the office, but the flood had exposed a striking irony: the Y2K office, so busy advising others on contingency plans, hadn’t developed its own.

“We all knew to expect the unexpected,” said Justin. It seemed like he might verge into contemplation and consider the idea of contingency in and of itself: can one really plan for something truly unknown? Instead, he took a more imperative course. “It’s balls to the wall from here on out. We’ve got four months.” His charge occasioned a flurry of activity, as team members sought to seize the day while it still existed to be seized. We had lived through a flash flood, and things had gone berserk in a dozen different ways. What would an actual millennial meltdown occasion?


By December 1999, the feeling at the Conglomerate’s Y2K office was that nothing more could really be done. This is a common enough cliché on the approach of any moment of finality, but was particularly apt in our case, since nothing really had been done. The travel diminished, and colleagues I’d last seen lounging under a shaded terrace in Milan were again denizens whom I passed in the office kitchenette, Pepsi product in hand. To mark the progress of the calendar and to demarcate our work, team members did what we did best: preside over the expenditure of large sums of corporate cash. With most air travel suspended, we trained our focus on accruing hotel reward points. A series of suites were booked at hotels around Midtown so team members could monitor the developing Y2K situation across the collection of global time zones with which so many of us had become familiar. These graveyard shifts did not require remaining awake, only sleeping within a several-block radius of the office—and with whomever one pleased. Christmas and New Year’s vacations were revoked, of course, but that meant that team members could enjoy a series of multicourse dinners on the Conglomerate’s tab, including those inflated prix fixe menus that always seem to pop up around the holidays.

Limited time remained, certainly in the office and possibly in the world. But the mood around Midtown seemed the furthest thing from that of end times, unless end times are distinguished by towering Christmas stockings and holiday wreaths the size of tractor tires. At a holiday party, we drank drinks named after 1980s financial instruments: a Poison Pill, an LBO, a Killer Bees, a Bear Hug. Not that those dated terms of corporate chicanery concerned team members: the Conglomerate’s stock price was as buoyant as the atmosphere, and team members who had taken some of their salary in options were feeling festive indeed.

Then, as in a modernist novel whose conclusion one knows will not provide an ending, our mission-critical moment, our finale—composed of the scaffolded segments of temporality that team members took such pleasure in delineating: second, minute, hour, day, week, month, year, decade, century, and, yes, millennium—came and went, as any other had and many others would. It seems both necessary and anticlimactic to state what everyone now knows: we survived, with minimal difficulties. Cindy dutifully reported that some automatic toilets in Singapore hadn’t flushed properly, stuck as they were in an expired world order. Other team members scoured news sources for tales of Y2K glitches and compiled a modest list. There was an electric garage door opener whose open and close buttons had become reversed; a selection of already-odd Sharper Image gadgets that had no discernible clock control but that had nonetheless broken down somewhere on the momentary midnight bridge between 12/31/1999 and 1/1/2000; and an industrial blender at a cattle-culling facility in Alberta whose whirl wouldn’t cease even when unplugged from a power source.

By the time team members reconvened in the conference room on the bright, crisp morning of Monday, January 3, 2000, even these millennial malfunctions seemed little more than a set of curious examples, representatives of a larger case of something whose dimensions had already begun to recede from the Conglomerate’s collective consciousness. The sensation of collapse would return, of course, with the two scandalous bankruptcies that would signal the end of the ’90s economy, the first great financial bubble of our era. Both Enron and WorldCom had had Andersen as their auditor, and on both projects, it turned out, Andersen had been operating far short of best practices. It had been systematically shredding records for Enron and faking others entirely at WorldCom—documentation problems for the ages. But in the first days of the millennium, I was surprised by how quickly Y2K disappeared from office discourse as though censored, and by how team members adopted an almost amnesiac approach to a period so many of us had let so eventfully structure our lives. There was no self-consciousness: Why did we do that? More one felt a sense of process: This happened.


If you like this article, please subscribe or leave a tax-deductible tip below to support n+1.
&&&&&&&

Adblock test (Why?)

Read the whole story
GaryBIshop
15 days ago
reply
Loved it!
Share this story
Delete

Cool Production Method: This Rotational-3D-Printed Lamp

1 Comment

This Maze Lamp is by Dutch designer Stijn van Aardenne. The fabrication process is quite novel:

"No two Maze Lamps are alike," van Aardenne writes. "They all start with a unique seamless pattern that is extruded around a rotating axis on a 3D printer."

As for the material, "plastic from shredded refrigerators [is] the main ingredient!"




He also makes a taller floorstanding version:

"As a designer I like to focus on the process as much as on the end product itself; the way of creating dictates the final form and shape of an object. Working within the boundaries of a certain technique forces you to come up with solutions and new perspectives on how to make things work. Using an industrial scale 3D printer to translate computer generated codes into a tactile and playful shape, results in an ever lasting flow of unique objects made from recycled plastics."

The tabletop model runs €250 (USD $277), and the floor lamp is €1,600 (USD $1,774).




Read the whole story
GaryBIshop
26 days ago
reply
Brings a new meaning to surface of revolution.
Share this story
Delete

Saturday Morning Breakfast Cereal - App

1 Comment and 4 Shares


Click here to go see the bonus panel!

Hovertext:
There needs to be a meta-app that just takes all the apps and converts them back into Internet.


Today's News:
Read the whole story
GaryBIshop
26 days ago
reply
So true!
Share this story
Delete
Next Page of Stories