Slashdot Mirror
Internet Traffic To Major Tech Firms Mysteriously Rerouted To Russia (securityweek.com)
wiredmikey writes: Internet traffic to some of the world's largest tech firms was briefly rerouted to Russia earlier this week in what appeared to be a Border Gateway Protocol (BGP) attack. Internet monitoring service BGPmon noticed that 80 IP prefixes for organizations such as Google, Microsoft, Apple, Facebook, NTT Communications, Twitch and Riot Games had been announced by a Russian Autonomous System (AS).
It happened twice on Tuesday and each time it only lasted for roughly three minutes. The first event took place between 04:43 and 04:46 UTC, and the second between 07:07 and 07:10 UTC. Despite being short-lived, BGPmon said the incidents were significant, including due to the fact that the announcements were picked up by several peers and some large ISPs, such as Hurricane Electric and Zayo in the U.S., Telstra in Australia, and NORDUnet, which is a joint project of several Nordic countries. The incident is rather suspicious, as the prefixes that were affected are all high profile destinations, as well as several more specific prefixes that aren't normally seen on the Internet.
It happened twice on Tuesday and each time it only lasted for roughly three minutes. The first event took place between 04:43 and 04:46 UTC, and the second between 07:07 and 07:10 UTC. Despite being short-lived, BGPmon said the incidents were significant, including due to the fact that the announcements were picked up by several peers and some large ISPs, such as Hurricane Electric and Zayo in the U.S., Telstra in Australia, and NORDUnet, which is a joint project of several Nordic countries. The incident is rather suspicious, as the prefixes that were affected are all high profile destinations, as well as several more specific prefixes that aren't normally seen on the Internet.
Seems to me you can complete quite a few MitM attacks in three minutes. Wonder how many people were compromised and/or how many websites were compromised? Or was this just a 'dry run' for a larger attack? Guess we won't know until the other shoe drops.
Their hostile behavior is only getting worse, and we can either bury our heads in the sand and allow their puppet Trump to avoid doing anything to deal with the threat they represent, or we can get adults into the government in 2018 and take this country back!
One article I read said this traffic was using IPv4. I'm not an engineer but how would using IPv6 have affected this problem? Are blocks assigned the same way in IPv6 as in 4? Wouldn't it make it harder to target a particular block?
Combine this news with Russia's desire to create "their own Internet" https://www.theregister.co.uk/2017/12/01/russia_own_internet/ and I'd call this a beta test. :-(
I don't know the relationship (if any) between the two, but is it just coincidence this is happening less than a month after this:
https://uawire.org/russia-offers-to-deploy-root-name-servers-in-brics-countries
Also, is this something that can be attributed to the 'handing over' of certain services from the US to the UN?
I had a sucky sig.
I'm not sure that he is subservient to Putin. I suspect that he helps Russia commit crimes in the US not because he's a traitor, but rather because he gets flattered or bribed. That doesn't mean he isn't a traitor in common usage, though not within the definition given by the US Constitution. It just means that being a traitor isn't why he does that, it's doing that that makes him a traitor.
I think we've pushed this "anyone can grow up to be president" thing too far.
It may be a coincidence, but the Tenable Network Security forums seemed to get hit on Tuesday by something. For about an hour, our account got hit with a string of forum responses from Tenable. Then it just stopped. I'm thinking that maybe if you replied to the forum message via email, it didn't go back to Tenable?
It is easier to build strong children than to repair broken men. -Frederick Douglass
Testing for exactly what, well...
Enjoy life! This is not a dress rehearsal.
A better title for the story: Major internet routers still inexplicably accepting unauthenticated BGP announcements
See that "Preview" button?
The BRIC nations (Russia, Brazil, China, India & South Africa) are building their own backup global DNS system.
https://www.bleepingcomputer.c...
My guess is that it's on track sooner than expected and it's likely more than the purported "backup". Especially with asshat, cabal owned, Pai killing Net Neutrality today, nobody trusts the US, nor should they. The routing should be taken as a precursor.
Any bets on this being a dry run for a BGP attack used to steal bitcoin?
I wonder if there is something previously considered secret in common about some of the addresses. We'd probably never know if some or all were key points of some government cyber collection or war system, but someone would be having a very, very bad day if they were.
Exactly this.
This was my first thought... Who accepts route changes from people you don't trust? I suppose *somebody* did this and everybody who trusted them fell in line, but I'd yank who ever sent me such changes out of my trusted list regardless of who they where...
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
I have a throwaway Facebook account, with a deliberately useless password (easy to recover even with hash+salt) - and it was logged into yesterday from Brazil of all places. Unless Facebook allows unlimited attempts at password logins, before notifying users of failed login attempts, then nobody has tried to login to my account before - and this person appears to have gotten in first-time... So, wonder if my account as MITM'd during a BGP reroute - I didn't login since Monday or before, though.
Can we nuke Russia already for these high crimes?
What makes you think any Russian citizen is involved? They could be a victim as much as the companies who owned the hijacked subnets.
All we know at this time is that an AS number assigned to a Russian entity was used. Anyone can configure that on their router, just as I can send a threatening letter with your return address on the envelope.
I'm not a complete idiot... Some parts are missing.
I think they were talking about the network being in Russia has nothing to do with a russian citizen or government being involved.
it is much easier to rent/compromise computers and run a flase flag than it is to move thousands of troops or expensive military equipment for a flase flag operation in the "old military economy"
I think they were talking about the network being in Russia has nothing to do with a russian citizen or government being involved.
it is much easier to rent/compromise computers and run a flase flag than it is to move thousands of troops or expensive military equipment for a flase flag operation in the "old military economy"
If it came fmor outside Russia, it wasn't Russia. If it came from inside Russia, it wasn't Russia. The No True Russia argument.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Keep in mind that BGP is an automated process. After the fact, rules may be added to limit trust, but that doesn't prevent the initial problem.
Also keep in mind that in many cases, BGP is the only way you know anything about the routes. All you have is that router A says it has a 5 hop route to range X and router B says it has a 4 hop route to the same range. Neither A nor B is directly connected to the range in question and both are also depending on BGP.
The stability of BGP currently depends on the lower level routers having rules to enforce some level of plausibility but at the level of an exchange, there are a lot ofseemingly plausible routes that would be incorrect. It will take a good bit of analysis to come up with mostly good plausibility rules there.
Given what has just happened, it may be necessary to limit routes to Russia to a few choke points that are configured to only accept routes to IPs associated with Russia from Russian routers, but it would take a world-wide effort to really lock that down.