BrianKrebs

Was reading this Substack post about US gov cloud servers being pointed at AI companies. It observed that a number of US gov cloud servers on AWS are now pointing to IPs at a company called inventry.ai

https://cyberintel.substack.com/p/doge-exposes-once-secret-government

I checked on a few of the IPs mentioned in this writeup, and it checks out. E.g., the IP address 18.253.166.131 from 2020-2024 was tied to us-gov-east-1.compute.amazonaws.com and is part of the gov cloud infrastructure at AWS. Loading that IP into DomainTools Iris, we can see the SSL cert assigned to them is for inventry.ai.

Methinks we need to know more about Inventry.

DOGE Exposes Once-Secret Government Networks, Making Cyber-Espionage Easier than Ever

A new investigation shows nuclear secrets and government servers are dangerously exposed to nation-state hackers.

Cyber-Intelligence Brief
Feb 9, 2025 at 7:37pmWeb
Show threadBrianKrebsFeb 9, 2025

"We do whatever it takes to gather the necessary data." Also, good thing it's passwordless.

According to their documentation, their product basically sucks in all your data and builds and AI driven high level representation of structures, connections, etc. Could be useful for seeing where money is flowing, which organizations connect to which, etc.

https://www.inventry.ai/how-it-works

How it works — Inventry.ai

Inventry.ai
Show threadAvi Rappoport (avirr)Feb 10, 2025
@briankrebs So no security or even accountability, oy vey!
Show threadDMTomFeb 10, 2025
@briankrebs 🤞🤞 it’ll work like math, when hallucinating man meets hallucination machine… maybe just maybe it will be a double negative type of thing… Or we are indeed living in “interesting times” (of the Chinese curse fame;)
Show threadyesthatkarimFeb 10, 2025

@briankrebs I only looked down the rabbit hole a little and 😱 HOLY SHIT. They not only brag about not needing usernames and passwords (security just holds back innovation?) but they brag that Neanderthal suppliers don’t even need tech skills.

Like, sure, let’s have random people weighing in on things that have a huge effect on supply chains. Authentication will be by…(??? The super-secure email protocol that has never been spoofed??) What could go wrong

Show threadyesthatkarimFeb 10, 2025

@briankrebs Their list of clients at the bottom includes 1) Stoke Space, who competes with SpaceX and employs former top SpaceX engineers (???) 2) An Indian tool & die maker and 3) A small American company that’s a subsidiary of 2).

I guess it’s possible # 3 machines sensitive parts for things that go boom, and thus has ITAR compliance to worry about, which would justify GovCloud.

Show threadyesthatkarimFeb 10, 2025

@briankrebs but if you have 35 employees, how is your supply chain such a nightmare you need (presumably not cheap) AI to run it? And with $6 million in revenue, how are you even afloat?

Nobody cares about the web sites too much — the $6 million in revenue was in 2014, and the company history for # 2 grinds to a halt in 2016.

Hoping for a benign explanation for it all…

Show threadBrianKrebsFeb 9, 2025

Looks like Inventry is a VC project of Michael Fertik, a venture capitalist and ceo of the AI company modelcode.ai.

https://heroicvc.com/

Fertik's website says he is also the chairman and founder of reputation.com.

https://www.michaelfertik.com/

Seems like a nice guy.

Heroic Ventures

Heroic Ventures is an early stage venture capital studio focused on first-money-in and formation opportunities in Silicon Valley, Colorado, and Israel.

Heroic Ventures
Show threadDarth Sandwich 🏳️‍🌈Feb 9, 2025
@briankrebs
Kinda sad
Show threadInterpipes 💙Feb 9, 2025
@briankrebs tell me your business ideas are shit without telling me your business ideas are shit
Show threadtheHastyOneFeb 9, 2025
@briankrebs
See my previous comments about linked in
Show threaddavid jon furbishFeb 9, 2025

@briankrebs
wow. Is this sort of thing typical of LinkedIn?

Maybe I’m insulated as an academic, but that’s some weird shit.

Show threadTofuTheSquirrelFeb 9, 2025
@PhilSciProf @briankrebs well... LinkedIn is weird as fuck. But I would not say it's a typical post. He sounds way to much like a human being for that. Arguably a terrible one, being mad that someone was not immediately available to talk to a Big Boy Hardcore Entrepreneur like himself, but a real one.
Show threadtatiFeb 9, 2025
@PhilSciProf linkedin is almost entirely made up of naked psychopathy and saccharine corporate word salad.
Show threadGraham Sutherland / PolynomialFeb 9, 2025
@briankrebs absolute twat
Show threadTofuTheSquirrelFeb 9, 2025
@briankrebs They were not really in vacation Michael. They made that up to avoid talking to you.
Show threadKevin Ashworth ☑️Feb 9, 2025
@briankrebs Oh, goodie. A broken man, addicted to devices and work. A workaholic who is on the look-out, nay, the war-path for future addicts to be his also-addicted friends.
Show threadSeppo HelavaFeb 9, 2025
@briankrebs https://m.youtube.com/watch?v=NGJu6kViRG8 feels very apt.
Don't spend time with your kids??

YouTube
Show thread(rainynight65) has movedFeb 9, 2025

@briankrebs Every bet that he's on a 'phones down' holiday at least once a quarter.

Every bet.

Show threadIanFeb 10, 2025
@briankrebs Convenient of people to self-report like this in public.
Show threadDon WhitesideFeb 10, 2025
@briankrebs In any other circumstance (not involving him) he would call it out (correctly) as turkey-gobble-gobble insane for the person seeking someone’s money to be that snotty and entitled. Shit, this guy reeks of “I demand you fire that barista because they didn’t kiss my ass hard enough”
Show threadProto Himbo EuropeanFeb 10, 2025
@briankrebs I'm so very happy I didn't end up in an industry like that. Yeesh.
Show threadstux⚡️Feb 10, 2025

@briankrebs He should be fired I guess

Like I said earlier, it's getting worse every day

Least we can do is make them (in)famous

Show threadJeff ClemmonsFeb 10, 2025
@briankrebs

Same people want to normalize that in every industry. They can just f**k right off. There's always someone else to fill in if the company is competent. If not, maybe you shouldn't do business with them. Not sure why this is so hard.
Show threadm271Feb 10, 2025

@briankrebs

I bet he hasn’t gotten a birthday card from his kids since they were six

Show threadgrechawFeb 10, 2025
@briankrebs cause jobs are only for the HARDCORE
Show threadTony YarussoFeb 10, 2025
@briankrebs “My ideas and business practices are so godawful that I need you to give me money within the next six hours before the truth about them and my company inevitably comes out”?
Show threadSraarsFeb 9, 2025
@briankrebs seems bad brother.
Show threadcrispy branzino ☭ (sold out forever)Feb 9, 2025
@briankrebs hypothesis:

this is a cloud broker or cloud management provider that facilitates compliance and audit for aws as well as a saml portal for government users to federate their on prem auth with as well as comply with poorly defined zero trust mandates.
Show threadAlisonW ♿🏳️‍🌈♾️Feb 9, 2025
@briankrebs
Always.
Show threadBillFeb 9, 2025

@briankrebs

I look forward to your reporting on this.

Show threadRobbie Coleman Feb 9, 2025
@briankrebs JFC that article is loaded with OMFG incidents.
Show threadvicashFeb 9, 2025
@briankrebs someone misspelled “inventory”. No spelling bee kids in DOGE
Show threadDraconis NeurocamFeb 9, 2025
@briankrebs https://www.inventry.ai/book-a-demo-1
Our story — Inventry.ai

Inventry.ai
Show threadwhiskey jackFeb 9, 2025
@Neurocam @briankrebs funded by Heroic Ventures
Show threadWolfgang Spreicer ☑️Feb 9, 2025
@briankrebs
😬
Show threadJargogglesFeb 10, 2025

@wolfgang_spr @briankrebs
"...dynamically involves internal and external collaborators..."

Yeah, sure sounds like it does.

Show threadAlgoCompSynth by znmeb 🇺🇦Feb 9, 2025

@briankrebs Indeed we ^do* need to know more about Inventry. We *especially* need to know if it's being used to violate EU, US state or US federal laws.

Because that sort of thing takes planning, and planning is done by people, and people have names. 😡

Show threadDemiurgFeb 9, 2025
@briankrebs The homepage of them has no imprint, which already violates some laws of EU countries...
Show threadJasmine🍁🧡💛 💚💜 💙 🤎 🖤 🤍Feb 9, 2025
@briankrebs Registered in CA - that might help with getting some support when investigating. https://opencorporates.com/companies/us_ca/4791395
Why would a shipping/inventory logistics optimization system be used to audit the DOE? I don't care for the implications.
Show threadJennaFeb 10, 2025
@briankrebs This is really interesting. Have there been any known cases of similar gov cloud server activity in the past? Would love to learn more about how these connections are usually investigated 🤔
Show threadEhay2kFeb 10, 2025

@briankrebs

If that cloud infrastructure is NOT #fedramp certified, it is ILLEGAL to house government data on it .

Show threadFalseMyrmidonFeb 10, 2025
@briankrebs AWS Govcloud is usable by entities other than the US Government. It just guarantees certain regulatory requirements (such as only US citizens having access) are met.
Show threadAndrewFeb 10, 2025
@briankrebs Sent this to my house rep, hopefully this can lead somewhere
Show threadsupriseme24Feb 11, 2025
@briankrebs You can sign up for free at https://app.inventry.ai
And it is shockingly bad
Inventry.ai Application

Inventry.ai application