5 ms·

OMZ Global (AS34329) is an industrial process company (eg steel, manufacturing, ship building, etc). I'm going to assume someone who shouldn't have had access t

by aroch 11y ago

OMZ Global (AS34329) is an industrial process company (eg steel, manufacturing, ship building, etc). I'm going to assume someone who shouldn't have had access to BGP is trying to use it to block GoogleDNS or similar inside the corporation. That or some pretty hilariously heavy-handed state-sponsored hijacking.

jameskilton 11y ago
OMZ is also Russian, so state-sponsored isn't out of the running.
- ryanlol 11y ago
  How is OMZ being Russian relevant to it possibly being state-sponsored? Also, it's really not a major challenge to take over someone elses equipment to do this.
  - ryanlol 11y ago
    Oh come on, there's absolutely no reason for Russia to use a large Russian industrial company to perform BGP hijacking. Nobody would be bringing up state sponsored attacks if it was a random US manufacturing company doing this.
Laforet 11y ago
IIRC the only commonly access service hosted in that IP block is their DNS servers. There are easier ways to hijack DNS traffic than trying to hijack the entire prefix via BGP. A casual browse through the other entries seems to suggest that people mess up BGP announcements all the time. My favourite one below involves the AS belonging to S & S Discount Market Pvt Ltd. https://bgpstream.com/event/18050 https://bgpstream.com/event/18050 Edit: It has happened previously http://www.bgpmon.net/googles-services-redirected-to-romania-and-austria/ http://www.bgpmon.net/googles-services-redirected-to-romania...
- nmjohn 11y ago
  > A casual browse through the other entries seems to suggest that people mess up BGP announcements all the time. While true, incorrect bgp announcements happen all the time, I think this is one of the cases that Hanlon's Razor probably does not apply: most of the time they are not a result of people messing up - rather the bad announcements come from spammers/malware spreaders needing new IP space because their current (likely hijacked) IP space has gotten blacklisted and is no longer effective.
- deleted 11y ago
  [deleted]
atemerev 11y ago
It is Russian, and it delivers reactor containments and other heavy machinery for nuclear industry and military.
- ryanlol 11y ago
  >and military Do they still? Couldn't find anything post-1940s supporting that.
ancarda 11y ago
I'd be willing to bet this is the case; this only covers 8.8.8.0 to 8.8.8.255 so not 8.8.4.4 so it wouldn't be that effective at blocking Google DNS; only 1 IP would be blocked.
- swiley 11y ago
  Some people don't use both.
- bartbes 11y ago
  Why would they be blocking it? Google promotes 8.8.8.8 as the primary dns server, and, as far as I know, as long as it keeps answering, clients won't fall back to the secondary 8.8.4.4.

by aroch 11y ago

jameskilton 11y ago

OMZ is also Russian, so state-sponsored isn't out of the running.

ryanlol 11y ago
How is OMZ being Russian relevant to it possibly being state-sponsored? Also, it's really not a major challenge to take over someone elses equipment to do this.
- ryanlol 11y ago
  Oh come on, there's absolutely no reason for Russia to use a large Russian industrial company to perform BGP hijacking. Nobody would be bringing up state sponsored attacks if it was a random US manufacturing company doing this.

Laforet 11y ago

IIRC the only commonly access service hosted in that IP block is their DNS servers. There are easier ways to hijack DNS traffic than trying to hijack the entire prefix via BGP. A casual browse through the other entries seems to suggest that people mess up BGP announcements all the time. My favourite one below involves the AS belonging to S & S Discount Market Pvt Ltd. https://bgpstream.com/event/18050 https://bgpstream.com/event/18050 Edit: It has happened previously http://www.bgpmon.net/googles-services-redirected-to-romania-and-austria/ http://www.bgpmon.net/googles-services-redirected-to-romania...

nmjohn 11y ago
> A casual browse through the other entries seems to suggest that people mess up BGP announcements all the time. While true, incorrect bgp announcements happen all the time, I think this is one of the cases that Hanlon's Razor probably does not apply: most of the time they are not a result of people messing up - rather the bad announcements come from spammers/malware spreaders needing new IP space because their current (likely hijacked) IP space has gotten blacklisted and is no longer effective.
deleted 11y ago
[deleted]

atemerev 11y ago

It is Russian, and it delivers reactor containments and other heavy machinery for nuclear industry and military.

ryanlol 11y ago
>and military Do they still? Couldn't find anything post-1940s supporting that.

ancarda 11y ago

I'd be willing to bet this is the case; this only covers 8.8.8.0 to 8.8.8.255 so not 8.8.4.4 so it wouldn't be that effective at blocking Google DNS; only 1 IP would be blocked.

swiley 11y ago
Some people don't use both.
bartbes 11y ago
Why would they be blocking it? Google promotes 8.8.8.8 as the primary dns server, and, as far as I know, as long as it keeps answering, clients won't fall back to the secondary 8.8.4.4.