Slashdot Mirror
Internet Traffic To Major Tech Firms Mysteriously Rerouted To Russia (securityweek.com)
wiredmikey writes: Internet traffic to some of the world's largest tech firms was briefly rerouted to Russia earlier this week in what appeared to be a Border Gateway Protocol (BGP) attack. Internet monitoring service BGPmon noticed that 80 IP prefixes for organizations such as Google, Microsoft, Apple, Facebook, NTT Communications, Twitch and Riot Games had been announced by a Russian Autonomous System (AS).
It happened twice on Tuesday and each time it only lasted for roughly three minutes. The first event took place between 04:43 and 04:46 UTC, and the second between 07:07 and 07:10 UTC. Despite being short-lived, BGPmon said the incidents were significant, including due to the fact that the announcements were picked up by several peers and some large ISPs, such as Hurricane Electric and Zayo in the U.S., Telstra in Australia, and NORDUnet, which is a joint project of several Nordic countries. The incident is rather suspicious, as the prefixes that were affected are all high profile destinations, as well as several more specific prefixes that aren't normally seen on the Internet.
It happened twice on Tuesday and each time it only lasted for roughly three minutes. The first event took place between 04:43 and 04:46 UTC, and the second between 07:07 and 07:10 UTC. Despite being short-lived, BGPmon said the incidents were significant, including due to the fact that the announcements were picked up by several peers and some large ISPs, such as Hurricane Electric and Zayo in the U.S., Telstra in Australia, and NORDUnet, which is a joint project of several Nordic countries. The incident is rather suspicious, as the prefixes that were affected are all high profile destinations, as well as several more specific prefixes that aren't normally seen on the Internet.
Seems to me you can complete quite a few MitM attacks in three minutes. Wonder how many people were compromised and/or how many websites were compromised? Or was this just a 'dry run' for a larger attack? Guess we won't know until the other shoe drops.
Their hostile behavior is only getting worse, and we can either bury our heads in the sand and allow their puppet Trump to avoid doing anything to deal with the threat they represent, or we can get adults into the government in 2018 and take this country back!
One article I read said this traffic was using IPv4. I'm not an engineer but how would using IPv6 have affected this problem? Are blocks assigned the same way in IPv6 as in 4? Wouldn't it make it harder to target a particular block?
Why is this BGP shit not properly locked down? There really is no excuse for this. BGP security issues are both well-known and quite old.
Combine this news with Russia's desire to create "their own Internet" https://www.theregister.co.uk/2017/12/01/russia_own_internet/ and I'd call this a beta test. :-(
I don't know the relationship (if any) between the two, but is it just coincidence this is happening less than a month after this:
https://uawire.org/russia-offers-to-deploy-root-name-servers-in-brics-countries
Also, is this something that can be attributed to the 'handing over' of certain services from the US to the UN?
I had a sucky sig.
I'm not sure that he is subservient to Putin. I suspect that he helps Russia commit crimes in the US not because he's a traitor, but rather because he gets flattered or bribed. That doesn't mean he isn't a traitor in common usage, though not within the definition given by the US Constitution. It just means that being a traitor isn't why he does that, it's doing that that makes him a traitor.
I think we've pushed this "anyone can grow up to be president" thing too far.
Putin!
This is normal and exactly how internet is supposed to works.
Why is everyone so shocked? All you have to do is go to Shodan or Maltego to find all the holes in these places. NTT like lots of other so called TECH companies is full of complete crap about their security. It's all hiring of friends and buddies who know the perfect catch phases and are willing to take it from behind. Our enemies will kick our asses if we don't stop this crap. Hire those who are dedicated, sink the good ol boyz clubs and quit the infantile garbage and maybe then, we may just have a chance of protecting ourselves.
It may be a coincidence, but the Tenable Network Security forums seemed to get hit on Tuesday by something. For about an hour, our account got hit with a string of forum responses from Tenable. Then it just stopped. I'm thinking that maybe if you replied to the forum message via email, it didn't go back to Tenable?
It is easier to build strong children than to repair broken men. -Frederick Douglass
Testing for exactly what, well...
Enjoy life! This is not a dress rehearsal.
Malware drops YOU!
A better title for the story: Major internet routers still inexplicably accepting unauthenticated BGP announcements
See that "Preview" button?
The BRIC nations (Russia, Brazil, China, India & South Africa) are building their own backup global DNS system.
https://www.bleepingcomputer.c...
My guess is that it's on track sooner than expected and it's likely more than the purported "backup". Especially with asshat, cabal owned, Pai killing Net Neutrality today, nobody trusts the US, nor should they. The routing should be taken as a precursor.
I prefer to drink vodka out of a 800ml glass.
Any bets on this being a dry run for a BGP attack used to steal bitcoin?
AC has shit karma -- and for damned good reason -- so nothing lost. AC is mostly just a Russian troll account.
I wonder if there is something previously considered secret in common about some of the addresses. We'd probably never know if some or all were key points of some government cyber collection or war system, but someone would be having a very, very bad day if they were.
who knows what kind of information they sucked up, and how they can sabotage the Internet in the future should they want to? Realistically, how can you protect against this, and why is it even doable in the first place?
Donald doesn't see it as treachery because they're his kind of people (he thinks). When Donald goes to Russia he's surrounded by rich and powerful men, attractive women and lots of bling and flattery and he feels comfortable. You think he'd prefer to spend time with some good ol' Alabama shitkicker or a Russian oligarch? It's a bit more naked with the likes of Flynn and Manafort. Their only ideology is money and power.
I have a throwaway Facebook account, with a deliberately useless password (easy to recover even with hash+salt) - and it was logged into yesterday from Brazil of all places. Unless Facebook allows unlimited attempts at password logins, before notifying users of failed login attempts, then nobody has tried to login to my account before - and this person appears to have gotten in first-time... So, wonder if my account as MITM'd during a BGP reroute - I didn't login since Monday or before, though.
me-too - my yahoo email account was acting up for about 2 or 3 weeks until a day or two ago... -- I would had to re-enter a password each day -- the save-password-and-auto-log-me-in on my pc wasn't working -- bgp issue or yahoo cookie bug??
Can we nuke Russia already for these high crimes?
What makes you think any Russian citizen is involved? They could be a victim as much as the companies who owned the hijacked subnets.
All we know at this time is that an AS number assigned to a Russian entity was used. Anyone can configure that on their router, just as I can send a threatening letter with your return address on the envelope.
I'm not a complete idiot... Some parts are missing.
What makes you think any Russian citizen is involved? They could be a victim as much as the companies who owned the hijacked subnets.
Wouldn't exactly call them victims. They are more in the same situation as the US population during the Iraq war.
They don't really like it but also they don't care much as long as someone they know doesn't get hurt.
I think nuking Russia is a bit over the top, but I wouldn't mind supplying Ukraine with nukes since the reason they got rid of them in the first place is kinda void at this point.
That would probably make all those non-Russians that just happen to be Russians on "vacation" suddenly decide to go back home.
I think they were talking about the network being in Russia has nothing to do with a russian citizen or government being involved.
it is much easier to rent/compromise computers and run a flase flag than it is to move thousands of troops or expensive military equipment for a flase flag operation in the "old military economy"
I think they were talking about the network being in Russia has nothing to do with a russian citizen or government being involved.
it is much easier to rent/compromise computers and run a flase flag than it is to move thousands of troops or expensive military equipment for a flase flag operation in the "old military economy"
If it came fmor outside Russia, it wasn't Russia. If it came from inside Russia, it wasn't Russia. The No True Russia argument.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.