6 ms·

Could someone explain in laymen terms what happened and what that means?

by baxtr 9y ago

topranks 9y ago
The internet works by organisations "announcing" the IP ranges they're allocated to other networks (ISPs, other large companies etc.) Networks that receive an announcement will route traffic for those IP ranges to the network that announced them. The protocol by which this is done is called BGP. The original version of this was created in 1989 and back then everyone involved trusted each other. So there is no security built in to prevent a rogue company announcing addresses they don't own, and therefore pulling in traffic people send to those addresses. Organisations can and do put filters in place to try and stop this, but because it's not a core baked in feature of BGP not everyone does, and issues can happen. Sometimes these things are just mistakes engineers make, re-announcing routes they've learnt elsewhere. Sometimes they are deliberate hi-jacks.
ag_47 9y ago
Basically, a router somewhere in Russia claimed to be the owner of some ip addresses belonging to Google, Facebook, etc. Other neighbouring routers began forwarding packets from actual users to this router. The packets contain the HTTPS requests people were making to these sites.
- VVayneTracker 9y ago
  Bit late to the party but what could be done with the information that they got their hands on?
GCU-Empiricist 9y ago
Internet traffic goes through whatever path will get it to it's destination fastest. Big Routers advertise to each other how long it will take to get somewhere through them. There have been times when either due to bugs, or due to a desire to slurp traffic, some machines have falsely advertised shorter routes causing traffic to pas through routes traffic wouldn't normally pass through. This time it was somewhere in Russia. This can be mitigated like most malicious acts / network errors if you write clever enough rules, but is hard because you have to identify the bad actors, or paths that lead to them.
- maltalex 9y ago
  > but is hard because you have to identify the bad actors, or paths that lead to them. It's worse than that. There are few truly "bad actors". Many BGP hijacks are performed by completely legitimate networks, which later claim that it was a configuration issue.

Could someone explain in laymen terms what happened and what that means?

by baxtr 9y ago

Could someone explain in laymen terms what happened and what that means?

The internet works by organisations "announcing" the IP ranges they're allocated to other networks (ISPs, other large companies etc.) Networks that receive an announcement will route traffic for those IP ranges to the network that announced them. The protocol by which this is done is called BGP. The original version of this was created in 1989 and back then everyone involved trusted each other. So there is no security built in to prevent a rogue company announcing addresses they don't own, and therefore pulling in traffic people send to those addresses. Organisations can and do put filters in place to try and stop this, but because it's not a core baked in feature of BGP not everyone does, and issues can happen. Sometimes these things are just mistakes engineers make, re-announcing routes they've learnt elsewhere. Sometimes they are deliberate hi-jacks.

ag_47 9y ago

Basically, a router somewhere in Russia claimed to be the owner of some ip addresses belonging to Google, Facebook, etc. Other neighbouring routers began forwarding packets from actual users to this router. The packets contain the HTTPS requests people were making to these sites.

VVayneTracker 9y ago
Bit late to the party but what could be done with the information that they got their hands on?

GCU-Empiricist 9y ago

Internet traffic goes through whatever path will get it to it's destination fastest. Big Routers advertise to each other how long it will take to get somewhere through them. There have been times when either due to bugs, or due to a desire to slurp traffic, some machines have falsely advertised shorter routes causing traffic to pas through routes traffic wouldn't normally pass through. This time it was somewhere in Russia. This can be mitigated like most malicious acts / network errors if you write clever enough rules, but is hard because you have to identify the bad actors, or paths that lead to them.

maltalex 9y ago
> but is hard because you have to identify the bad actors, or paths that lead to them. It's worse than that. There are few truly "bad actors". Many BGP hijacks are performed by completely legitimate networks, which later claim that it was a configuration issue.