5 ms·

This is a well known "feature" (because it is not a bug) of BGP and every ISP worth their salt ought to be doing route filtering to prevent this sort of thing.

This is a well known "feature" (because it is not a bug) of BGP and every ISP worth their salt ought to be doing route filtering to prevent this sort of thing. If they're not, then the traffic can be diverted to Russia or the proverbial bit bucket rather trivially. I understand that less network savvy readers think this story is about Russia, but it really is about ISP's and the old issue of lazy network admins who do not filter routes and what happens. You can replace "Russia" with "Canada" and it wouldn't change the meaning. The country attribution is based on the AS (Autonomous System) registration. If these were really the malicious state actors, they'd probably use an AS registered in another country to cover their tracks. This is either an honest mistake or possibly a "let's see what would happen" prank.

INTPenis 9y ago
I just have to ask, not knowing how to setup BGP but having a lot of experience with PF and ipfw; is it not possible to create a sort of default deny filter so you only exclude the routes you have? The way your post read it sounded like you had to create a filter for all routes in the world but I assume that's not the case in the practical sense.
- gtrubetskoy 9y ago
  You only need to create filters for the routes you know, e.g. if you are an ISP providing internet connectivity for company X, then you know that the only advertisement from the link to X can be for X and if the link to company X advertises routes from Google, Facebook or Apple AS's, then that's bogus. It's just tedious to do this, and a lot of providers, especially smaller ones don't bother with it.
- fosco 9y ago
  creating a list of 'expected' receive routes and expected 'send' routes is fairly easy to create. aka outbound and inbound prefix lists, I quickly googled and found the following config [0] that shows them 'advertising' their owned networks to prevent advertising networks they should not be and also accepting other networks they expect. this prevents and would have mitigated this sort of situation if implemented everywhere. no I do not believe this to be difficult and anyone configuring BGP should have some awareness of most of its tools. you can live your whole life without having to use a fire extinguisher or understanding the differences between a,b,c,d etc types but if you are a fire (man/woman) I expect you to understand which is used in what circumstance. if you do not you have the chance to spread a fire and make it worse then prevent it the same with someone who calls themself a network engineer. [0] https://supportforums.cisco.com/legacyfs/online/legacy/0/5/4/19450-bgp_config.txt https://supportforums.cisco.com/legacyfs/online/legacy/0/5/4...
mrtree 9y ago
Buf if I’m using TLS why should I worry where is it routed to?
OldSchoolJohnny 9y ago
I understand ISP's are to blame here, but how is it not about Russia, the article specifically states that only certain entities were targeted in a suspicious manner. Seems like nefarious purposes at work here no?
- topranks 9y ago
  Yes. The particular networks announced, and particularly the fact that more specific routes were announced, suggests this is some nefarious incident. Not just an accident that someone announced routes they shouldn't have.
- vlan0 9y ago
  >I understand ISP's are to blame here, but how is it not about Russia, the article specifically states that only certain entities were targeted in a suspicious manner. Seems like nefarious purposes at work here no? Sure there are. But compare this to an organization getting owned because they didn't patch a known vulnerability. We generally focus on the company that was breached because the power to stop such a breach was in their hands. The same can be said in this situation. ISPs are not proactively taking known measures to minimize the impact of a BGP hijack. Malicious actors will be malicious...it's what they do. If it's not Russia, it'll be someone else.
- gtrubetskoy 9y ago
  > how is it not about Russia It could be, the key missing piece of information is the physical location of the actual router that is the ultimate source of this. It is only known by their peers or upstream and is not easily traceable (in the US it's usually under NDA and you'd need court order to find out "officially"). Some network admin somewhere probably knows. May be he/she reads HN. The second question is whether that device is hacked and is doing it unbeknown to its admin. But without this information, the fact that this is an AS registered with a bogus .ru domain doesn't mean anything, this could be coming from Liechtenstein or Bolivia.
topranks 9y ago
It's unfair to say it's a "feature". It was an oversight back in 1989 based on nobody expecting we'd end up where we are today. Filtering is easy if your just doing it for downstream customers. But how do Tier 1's filter from each other? Once you go up the tree a few times it gets really hard to build any sort of valid filter list of what you should be getting from provider X or provider Y. BGPSEC and RPKI are unfortunately not really workable yet, in terms of full-path validation. And obviously the source data to do it is a long way off.

INTPenis 9y ago

I just have to ask, not knowing how to setup BGP but having a lot of experience with PF and ipfw; is it not possible to create a sort of default deny filter so you only exclude the routes you have? The way your post read it sounded like you had to create a filter for all routes in the world but I assume that's not the case in the practical sense.

gtrubetskoy 9y ago
You only need to create filters for the routes you know, e.g. if you are an ISP providing internet connectivity for company X, then you know that the only advertisement from the link to X can be for X and if the link to company X advertises routes from Google, Facebook or Apple AS's, then that's bogus. It's just tedious to do this, and a lot of providers, especially smaller ones don't bother with it.
fosco 9y ago
creating a list of 'expected' receive routes and expected 'send' routes is fairly easy to create. aka outbound and inbound prefix lists, I quickly googled and found the following config [0] that shows them 'advertising' their owned networks to prevent advertising networks they should not be and also accepting other networks they expect. this prevents and would have mitigated this sort of situation if implemented everywhere. no I do not believe this to be difficult and anyone configuring BGP should have some awareness of most of its tools. you can live your whole life without having to use a fire extinguisher or understanding the differences between a,b,c,d etc types but if you are a fire (man/woman) I expect you to understand which is used in what circumstance. if you do not you have the chance to spread a fire and make it worse then prevent it the same with someone who calls themself a network engineer. [0] https://supportforums.cisco.com/legacyfs/online/legacy/0/5/4/19450-bgp_config.txt https://supportforums.cisco.com/legacyfs/online/legacy/0/5/4...

mrtree 9y ago

Buf if I’m using TLS why should I worry where is it routed to?

OldSchoolJohnny 9y ago

I understand ISP's are to blame here, but how is it not about Russia, the article specifically states that only certain entities were targeted in a suspicious manner. Seems like nefarious purposes at work here no?

topranks 9y ago
Yes. The particular networks announced, and particularly the fact that more specific routes were announced, suggests this is some nefarious incident. Not just an accident that someone announced routes they shouldn't have.
vlan0 9y ago
>I understand ISP's are to blame here, but how is it not about Russia, the article specifically states that only certain entities were targeted in a suspicious manner. Seems like nefarious purposes at work here no? Sure there are. But compare this to an organization getting owned because they didn't patch a known vulnerability. We generally focus on the company that was breached because the power to stop such a breach was in their hands. The same can be said in this situation. ISPs are not proactively taking known measures to minimize the impact of a BGP hijack. Malicious actors will be malicious...it's what they do. If it's not Russia, it'll be someone else.
gtrubetskoy 9y ago
> how is it not about Russia It could be, the key missing piece of information is the physical location of the actual router that is the ultimate source of this. It is only known by their peers or upstream and is not easily traceable (in the US it's usually under NDA and you'd need court order to find out "officially"). Some network admin somewhere probably knows. May be he/she reads HN. The second question is whether that device is hacked and is doing it unbeknown to its admin. But without this information, the fact that this is an AS registered with a bogus .ru domain doesn't mean anything, this could be coming from Liechtenstein or Bolivia.

topranks 9y ago

It's unfair to say it's a "feature". It was an oversight back in 1989 based on nobody expecting we'd end up where we are today. Filtering is easy if your just doing it for downstream customers. But how do Tier 1's filter from each other? Once you go up the tree a few times it gets really hard to build any sort of valid filter list of what you should be getting from provider X or provider Y. BGPSEC and RPKI are unfortunately not really workable yet, in terms of full-path validation. And obviously the source data to do it is a long way off.