Slashdot Mirror

← Back to Stories (view on slashdot.org)

China Telecom Hijacks US, Canadian Internet Traffic On a Regular Basis, Report Says (itnews.com.au)

Posted by BeauHD on from the business-as-usual dept.

Bismillah writes: China Telecom is up to no good with Border Gateway Protocol (BGP) shenanigans researchers have discovered. The state-owned telco is hijacking and rerouting internet traffic to China via it's U.S. and Canadian points of presence (PoPs). As for how the researchers came to their conclusion, they reportedly "built a route tracing system that monitors BGP announcements and which picks up on patterns suggesting accidental or deliberate hijacks and discovered multiple attacks by China Telecom over the past few years," reports iTNews.

In one example occurring in 2016, "China Telecom diverted traffic between Canada and Korean government networks to its PoP in Toronto," the report says. "From there, traffic was forwarded to the China Telecom PoP on the U.S. West Coast and sent to China, and finally delivered to Korea. Normally, the traffic would take a shorter route, going between Canada, the U.S. and directly to Korea." The telecommunications company is able to reroute the traffic by announcing fake routes via the BGP, which "governs data flow between Autonomous Systems, the large networks operated by telcos, internet providers and corporations."

12 of 64 comments (clear)

  1. So what do we do about it? by Anonymous Coward · · Score: 3, Interesting

    Is anyone going to impose any actual consequences, or are they just too damn big?

    1. Re:So what do we do about it? by Narcocide · · Score: 5, Insightful

      Oh, I have an idea. How about we stop allowing border gateway maintenance to be policed exclusively by the honor system?

    2. Re:So what do we do about it? by postbigbang · · Score: 2

      Are the tariffs stupid? Didn't comment on that.

      This morning I looked at some of the website my organizations manage. The attacks came 84% from China origin. Pakistan, Albania, Azerbaijan, and even France trailed well behind.

      I try to specifically not buy Chinese goods, especially Chinese foods. Certainly others do. I try to put my money where it will do the most good, and that's as local as possible. This said, the dependency that US Corporate industry has put on China now enslaves them to a regime that suppresses free speech, human rights (yeah, we do to, but we're working on it), and attempts to conquer the S China Sea. They're suckering parts of Africa, S America, and the Middle East, the disaffected areas, into financial chattel.

      So they hijack BGP for a little while to sniff who's doing what. It's not a mistake. It is a mistake to have a president that uses a sniffable phone, but let's not quibble. All of that data gets sorted and sifted. They do not, and no one has the right to do that, no, not even the NSA. The honor system used to respect BGP updates is hilarious, and one of the many flaws of the Internet. But the US has given up most of its policing rights. Let the games begin. Oh, wait, they've been underway for a decade.

      --
      ---- Teach Peace. It's Cheaper Than War.
  2. so use RPKI by johnjones · · Score: 5, Informative

    the canadian government is surprised to find china did exactly the same thing to them as they did to china...

    come on just implement signing and validation...
    https://blog.benjojo.co.uk/post/are-bgps-security-features-working-yet-rpki

    also get on your DNSSEC and DANE implementations

    1. Re:so use RPKI by houstonbofh · · Score: 2, Insightful

      Or just block bgp from China entirely. Yes, it would suck for them. So sad. :)

    2. Re: so use RPKI by petermgreen · · Score: 4, Informative

      Using BGP is the normal way routes are exchanged between carriers on the Internet. It is absoloutely normal for carriers in different countries to have BGP sessions with each other.

      The problem is a combination of laziness and resource limitations mean that carriers and other networks end up trusting each other. Sure filters can be put in place in theory but on a link where thousands of prefixes are normally exchanged maintaining those filters is both a a PITA and a resource drain on the routers.

      Adding to that many networks are cheapskates. Rather than take the shortest path to a destination they will take the cheapest. i.e. they will prefer sending the traffic to a peer or downstream over sending it to an upstream.

      The result of this is it's easy for traffic to get diverted, either accidentally or maliciously, and as long as the traffic reaches it's destination without undue delays it is very likely that no one will notice.

      --
      note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
    3. Re: so use RPKI by Bert64 · · Score: 3, Informative

      Not only that, but traffic going from canada to korea via china isn't unreasonable, it could be the cheapest route or the direct routes could be unavailable for whatever reason. If the traffic was destined from canada to the us and went via china that would be far more suspicious.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  3. Repeat after me by Nkwe · · Score: 5, Interesting

    "The Internet is not a secure network."

    As an Internet user you have no control over where your packets go or how they are routed. China could re-route them. The NSA could re-route them. Your ISP could re-route them. The only "guarantee" you get is the Internet will try really hard to get your packets there by any means necessary. Because there is no way to know where your packets are going to go, you should assume that *anyone* could be reading your packets. ("Packets" meaning the web pages your browse, the credit card details you enter on a website, the emails you send, etc.)

    This of course doesn't matter because you encrypt everything you send across the Internet right?

  4. Stopped even trying.. by Anonymous Coward · · Score: 2, Interesting

    I've given up trying to tell ISP's when their networks are hijacked (it happens, a lot). It's not just China either, Comcast likes to engage in it's own hijacking for example. Many networks simply don't give a shit or want free consulting.

    I'm sure there are some of you here that understand BGP but for the rest, in short it's not necessarily a case of Provider C announces Provider A's networks such that Provider B routes through C. There are quite a few metrics that go into how routers decide one routeu over another, some are policy while others are protocol level (link goes down, routes get withdrawn). Having a shorter path or lower latency for example are two ways a third party can fool networks into giving them preference.

    Dropping your BGP session is a script kiddie level attack, influencing your routing such that YOU believe I have a better one without making global changes is much more sinister.

  5. Neat, but doesn't matter. by Anonymous Coward · · Score: 2, Informative

    Just encrypt your traffic.

  6. IPV6? by WindBourne · · Score: 2

    Seriously, it is time for the west to really make the move to IPV6. Protocols like SEND would help make a difference. We would have far less issues all the way around.

    --
    I prefer the "u" in honour as it seems to be missing these days.
  7. sanctions by Kvasio · · Score: 2

    I still wonder why instead of current economic sanctions on Russia, USA did not enforce "cut all BGP traffic to Russia; if 3rd country operator transfers BGP traffic for Russia, it gets cut away". Just like in 2001 they forced nearly all nations to join "battle on terrorism".
    It would be much more efficient, resulting in:
    - cutting Russian hackers
    - cuttting Russian troll factories influencing US politics
    - cutting Russian espionage
    Just profit. Losses minimal compared to profits.

    With China such sanction would be more difficult, on the other hand it would make making business with China much more diffiult, so easier to replace Chinese products with local ones.