3 ms·

> This isn't a paranoid fantasy by the way, I work for a company that monitors these kinds of attacks for a living. Then you'll certainly be familiar with some

• maltalex 9y ago
  I've asked around the company and unfortunately I can't talk about attacks (and/or suspicious "configuration errors") we've detected. There are legal issues involved, plus some of these cases are currently being investigated by law enforcement. Moreover, I don't know of any other company or person that deals with such attacks, so I have no one to quote. The only thing I can do is to offer some hand waving: 1. It's known publicly that nation states as well as criminal organizations are deflecting Internet routes. There are numerous reports of such cases; these cases aren't that hard to find since BGP information is (mostly) public. A few published examples: - Russian network "Rostelecom" hijacks sites of financial services: https://arstechnica.com/information-technology/2017/04/russian-controlled-telecom-hijacks-financial-services-internet-traffic/ https://arstechnica.com/information-technology/2017/04/russi... - Global Large scale BGP hijacks in 2013, some through "Rostelecom": https://arstechnica.com/information-technology/2013/11/repeated-attacks-hijack-huge-chunks-of-internet-traffic-researchers-warn/ https://arstechnica.com/information-technology/2013/11/repea... - Spammers use BGP to announce fake IP addresses to spam yahoo mail users: https://ripe72.ripe.net/presentations/45-Invisible_Hijacking.pdf https://ripe72.ripe.net/presentations/45-Invisible_Hijacking... - Traffic to UK organization that deals with nuclear weapons hijacked using BGP to the Ukraine: http://hub.dyn.com/dyn-research/uk-traffic-diverted-through-ukraine http://hub.dyn.com/dyn-research/uk-traffic-diverted-through-... - BGP hijack of bitcoin miners: https://bgpmon.net/the-canadian-bitcoin-hijack/ https://bgpmon.net/the-canadian-bitcoin-hijack/ - "Hacking Team" (Italian company selling spyware to law enforcement) helps Italian police perform BGP hijack: https://arstechnica.com/information-technology/2015/07/hacking-team-orchestrated-brazen-bgp-hack-to-hijack-ips-it-didnt-own/ https://arstechnica.com/information-technology/2015/07/hacki... - Chinese hijack of US military an governmental networks (2010): http://www.theregister.co.uk/2010/11/17/bgp_hijacking_report/ http://www.theregister.co.uk/2010/11/17/bgp_hijacking_report... 2. There are known attacks against routing protocols which aren't BGP (e.g. OSPF, Black Hat 2011) and against routers (see CVEs for CISCO IOS). 3. Routing changes that happen within an autonomous system leave a much smaller footprint compared to BGP. 4. Nation states are known to have an interest in direct access into routers: - Suspected NSA example: http://www.theregister.co.uk/2015/09/15/compromised_cisco_routers/ http://www.theregister.co.uk/2015/09/15/compromised_cisco_ro... - Suspected Chinese example: http://www.abovetopsecret.com/forum/thread350381/pg1 http://www.abovetopsecret.com/forum/thread350381/pg1 5. Network connect to each other (mainly) in central exchange points. In these exchanges networks can pay for a direct point-to-point connection from network to network, or use open peering through a layer 2 switch that aggregates connections from dozens or hundreds of different networks at once (Example: https://www.de-cix.net/en/de-cix-service-world/globepeer https://www.de-cix.net/en/de-cix-service-world/globepeer). Hundreds of networks use these switches with very little visibility. Everyone can talk to everyone else on the same switch without leaving a trace. If a router connected to such a switch is locally configured to forward traffic to some other router on the same switch, it can do so regardless of BGP routing or any common sense.