4 ms·

Wow I’m surprised. That is such a low barrier to doing your own BGP hijackig.

by dannyw 9y ago

Steeeve 9y ago
You have no idea
godzillabrennus 9y ago
It's even easier to steal a phone number. Lots of phone companies still just approve a port if you send them the required paperwork to initiate a port. That means with zero verification from the account holder a number can vanish from your account.
- IntelMiner 9y ago
  PacketCable (VoIP over Cable internet) is even worse When it came out. If you wanted to "borrow" someone's phone number. All you had to do was clone the MAC address of the VoIP (EMTA) port If someone called the number. Both you and the victims phones would ring
  - rootsudo 9y ago
    Same with CDMA. Just had to copy the phone number and ESN. Boom whichever phone was closest to the tower would ring, if both phones wear pinging with near freq then both could receive the same SMS and call, but only one could be on a call at a time. No actual interception. Things got a bit different with MDN and MIN were different to ESN pair. Calls still came but you couldn't auth or call out for data services. It's all a bit old now, but look up QPST, QXDM for the past decade and 20 years ago look up Oki900.
    - kevin_nisbet 9y ago
      For some reason I think CDMA could suffer from crosstalk in certain circumstances, but it was something relatively obscure, like one device had to be above another (like an apartment building), but otherwise in the same/similar coordinates, and then certain code assignments would allow crosstalk to happen. It was weird, because it could be one direction only. Unfortunately I don't really remember the details, since I worked on the core data network at the time.
- aviv 9y ago
  Worse. Some very large carriers don't even look at the supporting documentation (bill, LOA) submitted with port orders unless there's a rejection from the losing carrier and they want to double check the address entered or something. Hijacking numbers is crazy simple. Same for hijacking the SMS functionality of any number in the US (voice traffic remains untouched). In about 10 minutes you can start receiving SMS directed towards any number you want, and also be able to send out texts originating from that number. Anyone who relies on SMS for any type of authentication should stop.
  - walrus01 9y ago
    SS7 was designed in an era of huge Monopoly telecoms that all trusted each other. Worked fine. Needs to be burnt to the ground, the ashes stomped around on a bit, and rebuilt with the same level of thought that has gone into the development of TLS1.3 for modern use. Won't happen though due to the sheerly massive installed base of telecom gear worldwide.
    - rusk 9y ago
      Yes, sunk costs mean that while those costs are amortized these technologies will remain in place. Upside is there's plenty of business in the area of plugging the holes in the meantime!
  - threeseed 9y ago
    > Anyone who relies on SMS for any type of authentication should stop Err. That's pretty much every implementation of 2FA around the world. Why isn't this more well known ?
    - walrus01 9y ago
      Not nearly as many people know how terrible ss7 is and the lack of security/pki/crypto in old-school traditional telecom. It is also a lot more opaque to learn and has higher barriers to entry, and is a very clique like club of "Telco" people.
    - stilist 9y ago
- burnte 9y ago
  As someone who has tried to port about 1,100 phone numbers last year, this couldn't be further from the truth. Getting numbers ported is a GIGANTIC pain in the ass with ANY small detail being wrong will reject the entire batch. Since the slamming problem in the 90s it's been increasingly hard to port phone numbers without every T crossed and every I dotted exactly right.
walrus01 9y ago
Any sane bgp neighbor has prefix limit ACLs and prefix filters in place on their edge connections to another peer. As an ISP that announces a lot of space and customer space to 2 upstream transits, every time we take on a new downstream customer that brings their own /24 or bigger, we need to have our upstream transit providers update their prefix-list filters. If our upstreams were clueless or negligent, it would be possible to get into a situation such as when a Pakistani telecom announced a huge chunk of V4 space that is YouTube, effectively DDoSing their international submarine links and also taking down YouTube for some users worldwide.
- devicenull 9y ago
  Except many of the big upstream providers don't actually filter anything. HE.net for example, doesn't. We forgot to create some IRR entries and GTT just accepted our prefixes. There is essentially no security, it's fairly trivial to hijack whatever space you want. (Doing it undetected is more difficult though!)
Hikikomori 9y ago
Well, not really. It doesn't mean that Comcast was re-advertising it into BGP and also advertising it to their peers. Usually you use a combination of prefix-list filtering and route tagging so you don't advertise garbage to your peers. RIP and other IGP protocols do not need to have their neighbors explicitly configured, they will find neighbors automatically on enabled interfaces. On some platforms they are enabled on all interfaces by default so it will form neighbor relationships with anything connected. A sane network design would be to only enable it on interfaces connected to your own routers (or customer interface, but on a different process ID) and also use a password.

Wow I’m surprised. That is such a low barrier to doing your own BGP hijackig.

by dannyw 9y ago

Wow I’m surprised. That is such a low barrier to doing your own BGP hijackig.

Steeeve 9y ago

You have no idea

godzillabrennus 9y ago

It's even easier to steal a phone number. Lots of phone companies still just approve a port if you send them the required paperwork to initiate a port. That means with zero verification from the account holder a number can vanish from your account.

IntelMiner 9y ago
PacketCable (VoIP over Cable internet) is even worse When it came out. If you wanted to "borrow" someone's phone number. All you had to do was clone the MAC address of the VoIP (EMTA) port If someone called the number. Both you and the victims phones would ring
- rootsudo 9y ago
  Same with CDMA. Just had to copy the phone number and ESN. Boom whichever phone was closest to the tower would ring, if both phones wear pinging with near freq then both could receive the same SMS and call, but only one could be on a call at a time. No actual interception. Things got a bit different with MDN and MIN were different to ESN pair. Calls still came but you couldn't auth or call out for data services. It's all a bit old now, but look up QPST, QXDM for the past decade and 20 years ago look up Oki900.
  - kevin_nisbet 9y ago
    For some reason I think CDMA could suffer from crosstalk in certain circumstances, but it was something relatively obscure, like one device had to be above another (like an apartment building), but otherwise in the same/similar coordinates, and then certain code assignments would allow crosstalk to happen. It was weird, because it could be one direction only. Unfortunately I don't really remember the details, since I worked on the core data network at the time.
aviv 9y ago
Worse. Some very large carriers don't even look at the supporting documentation (bill, LOA) submitted with port orders unless there's a rejection from the losing carrier and they want to double check the address entered or something. Hijacking numbers is crazy simple. Same for hijacking the SMS functionality of any number in the US (voice traffic remains untouched). In about 10 minutes you can start receiving SMS directed towards any number you want, and also be able to send out texts originating from that number. Anyone who relies on SMS for any type of authentication should stop.
- walrus01 9y ago
  SS7 was designed in an era of huge Monopoly telecoms that all trusted each other. Worked fine. Needs to be burnt to the ground, the ashes stomped around on a bit, and rebuilt with the same level of thought that has gone into the development of TLS1.3 for modern use. Won't happen though due to the sheerly massive installed base of telecom gear worldwide.
  - rusk 9y ago
    Yes, sunk costs mean that while those costs are amortized these technologies will remain in place. Upside is there's plenty of business in the area of plugging the holes in the meantime!
- threeseed 9y ago
  > Anyone who relies on SMS for any type of authentication should stop Err. That's pretty much every implementation of 2FA around the world. Why isn't this more well known ?
  - walrus01 9y ago
    Not nearly as many people know how terrible ss7 is and the lack of security/pki/crypto in old-school traditional telecom. It is also a lot more opaque to learn and has higher barriers to entry, and is a very clique like club of "Telco" people.
  - stilist 9y ago
burnte 9y ago
As someone who has tried to port about 1,100 phone numbers last year, this couldn't be further from the truth. Getting numbers ported is a GIGANTIC pain in the ass with ANY small detail being wrong will reject the entire batch. Since the slamming problem in the 90s it's been increasingly hard to port phone numbers without every T crossed and every I dotted exactly right.

walrus01 9y ago

Any sane bgp neighbor has prefix limit ACLs and prefix filters in place on their edge connections to another peer. As an ISP that announces a lot of space and customer space to 2 upstream transits, every time we take on a new downstream customer that brings their own /24 or bigger, we need to have our upstream transit providers update their prefix-list filters. If our upstreams were clueless or negligent, it would be possible to get into a situation such as when a Pakistani telecom announced a huge chunk of V4 space that is YouTube, effectively DDoSing their international submarine links and also taking down YouTube for some users worldwide.

devicenull 9y ago
Except many of the big upstream providers don't actually filter anything. HE.net for example, doesn't. We forgot to create some IRR entries and GTT just accepted our prefixes. There is essentially no security, it's fairly trivial to hijack whatever space you want. (Doing it undetected is more difficult though!)

Hikikomori 9y ago

Well, not really. It doesn't mean that Comcast was re-advertising it into BGP and also advertising it to their peers. Usually you use a combination of prefix-list filtering and route tagging so you don't advertise garbage to your peers. RIP and other IGP protocols do not need to have their neighbors explicitly configured, they will find neighbors automatically on enabled interfaces. On some platforms they are enabled on all interfaces by default so it will form neighbor relationships with anything connected. A sane network design would be to only enable it on interfaces connected to your own routers (or customer interface, but on a different process ID) and also use a password.