3 ms·
So if BGP is trust based and hard to compromise then how were these Russians able to? > They re-routed DNS traffic using a man in the middle attack using a ser
by nodesocket 8y ago
So if BGP is trust based and hard to compromise then how were these Russians able to?
> They re-routed DNS traffic using a man in the middle attack using a server at Equinix in Chicago.
- notyourday 8y agoBecause large networks do not register all their prefixes or enforce policies on what they accept from other large networks. So a large network can do this. Allowing a small network to do this demonstrates incompetence. Frankly, I am having a hard time believing that HE.NET failed that badly. AS7007 incident demonstrated this being a bad idea in the nineties.
- pyvpx 8y ago> Frankly, I am having a hard time believing that HE.NET failed that badly. Believe it. HE has many, many netiron-based routers in their network and many, many ASNs as transit customers. the hardware doesn't have the capacity to implement complete filtering for everyone. between hardware-constrained equipment being replaced and the tireless work Job Snijders (& others) are doing with route security, these kinds of episodes will become far more difficult and occur much, much less.
- notyourday 8y agoHalf if not all of HE business model is to sell dirt cheap flat rate IPv4 with BGP to other companies in major carrier facilities. I find it extremely hard to believe that not filtered access to HE.NET is possible.