9 ms·

China systematically hijacks internet traffic: researchers

119 points by maltalex 8y ago

maltalex 8y ago
Original Paper: https://scholarcommons.usf.edu/cgi/viewcontent.cgi?article=1050&context=mca https://scholarcommons.usf.edu/cgi/viewcontent.cgi?article=1... Bruce Schneier's blog post on this paper: https://www.schneier.com/blog/archives/2018/10/chinas_hacking_.html https://www.schneier.com/blog/archives/2018/10/chinas_hackin...
- mark_gtf 8y ago
  thnkz
hope4555 8y ago
Important
bsaul 8y ago
"then an appropriate defence policy in response could state that no traffic to or from the US or ally is allowed to enter a China Telecom PoP in the US or in the ally's networks" The fact that this is possible today seems incredible to me when i think of the number of times i've heard cybersecurity and cyberespionage was a priority of the US security agencies during the last decade.
- pjc50 8y ago
  On the contrary, I think as phrased that's a "break the internet" policy, especially if more than one country does it - what if China asks for a reciprocal version?
  - bsaul 8y ago
    the article in fact points out that china does exactly that
Taniwha 8y ago
And the US and the rest of the 5-eyes don't? that doesn't make it right, just more wrong, if you're angry that China is doing this then you should be equally because the US and 'friends' are doing it to you too
- adamiscool8 8y ago
  At least in theory FVEY nations are democratically accountable for the behavior.
  - cinquemb 8y ago
    Its great to have non scientific theories we can fallback to, rely upon and pat ourselves on the back for when understanding how the world actually is.
  - chmod775 8y ago
    Being spied upon by a non-democratic nation is the same as being spied upon by a democratic nation if you're not a citizen - you don't hold any influence over either and neither is accountable to you. So from an outside perspective the US and China are pretty much the same thing in that regard. To top it off, the five eyes nations are spying on each other - so even if you're a citizen of one you're tolerating being spied upon by four other surveillance apparati that aren't accountable to you.
- braythwayt 8y ago
  “And you are lynching negroes” https://en.wikipedia.org/wiki/And_you_are_lynching_Negroes https://en.wikipedia.org/wiki/And_you_are_lynching_Negroes Or if you prefer, the contemporary form: https://en.wikipedia.org/wiki/Whataboutism https://en.wikipedia.org/wiki/Whataboutism —— This varient is particularly useful against anybody with a social justice argument. Let’s say I complain about Google and what appears to be systemic support for sexual coercion by male managers. You can trot out, “But it’s far worse at Uber, did you complain then? No? Have you taken an Uber since then? You have? You have no right to complain now.” Or maybe I say that migrant children have been separated from their families. “You’re a Canadian. Did you speak out against Residentual Schools? No? Then shut up about migrant families.” It’s endlessly applicable.
jstanley 8y ago
It's clear that the internet is too insecure, and the world's super powers can't help themselves, they simply have to meddle with it. Maybe it's time we started using Tor hidden services for everything.
- qubax 8y ago
  Just like programming languages can only have two out of three concepts ( soundness, completeness, decidability ), the creators of the internet had to choose two out of three concepts ( openness, robustness, security ). It's theoretically impossible to have a language that is sound, complete and decidable. It's probably also impossible to have an internet that is open, robust and secure.
  - jstanley 8y ago
    I don't think that argument holds water. Which one of "open, robust, secure" do you think Tor doesn't meet? You can pick any 3 concepts and group them together like that, but it doesn't mean you can't have all 3, e.g. a house can be "large, cheap, and well-decorated" (e.g. if it is in the middle of nowhere).
    - ZeKZ 8y ago
      Tor lacks usability and efficiency.
      - Filligree 8y ago
        Those weren't on the list. ;-)
      - jstanley 8y ago
        The efficiency isn't as bad as it used to be. I browse using Tor as a matter of course now, and it's fine. What's the usability problem? Just that you have to download Tor Browser instead of Firefox? The usability of setting up a hidden service is actually easier than getting an SSL certificate.
    - 8y ago
sethbannon 8y ago
As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?
- lbriner 8y ago
  If you have something that you genuinely need to keep from the Chinese, don't connect to the internet full-stop. Even SSL can be decrypted by their great firewall if they are suspicious enough. Even VPNs have no guarantee that someone with the right resources hasn't terminated the VPN themselves on the quiet!
  - vegardx 8y ago
    [citation needed] Like whoa, are you even aware of what you are suggesting? This is completely false.
    - anyzen 8y ago
      No need to decrypt SSL, there are easier ways: https://xkcd.com/538/ https://xkcd.com/538/
      - walrus01 8y ago
        Or do like Uzbekistan has done, force all local computer stores to install a trusted root CA in the operating system before it gets to the hand of the end user. You can transparently MITM TLS1.2 if the system trusts the mitm operator CA. Maybe 0.01% of people even know where to look to examine their windows 10 machine's trusted CA list.
        yayana 8y ago
        Having looked through the government CAs in preinstalled CA lists, I'm a little surprised Uzbekistan doesn't qualify.
      - vegardx 8y ago
walrus01 8y ago
From an ISP perspective this is really hard to hide. If somebody announces my /16 from Pakistan and traffic goes there, it's going to get noticed. Like the time PTCL broke YouTube... You basically can't bgp hijack without breaking basic internet connectivity for the legit users of the IP space (where it is intended to be announced to peers and transits), so anything lasting more than 30 seconds will generate a huge flurry of phone calls and noc emails. There are third party services you can pay, and software you can set up yourself to watch for bgp announcements for "your" Arin/ripe/apnic/whatever prefixes, and generate alerts based on that. Pretty common stuff with Linux based systems (FRR, etc) that can hold the entire global v4+v6 routing table in RAM and do quick analysis on it. Google "bgp hijack", this is a well known issue in the ISP operational community. RPKI validation of announced routes and best common practices for what you accept from your bgp neighbors go a long way.
Dowwie 8y ago
Traffic heading to China gets intercepted-- you don't say?
- propter_hoc 8y ago
  This is not what the article says happened. Rather, the researchers found that China was able to reroute traffic going to other countries to instead go to China, presumably to analyze or decrypt it, before sending it on to its original destination later. Please read the article before commenting.
speeq 8y ago
Back in 2010 I had Chinese IPs show up in my traceroute - I guess they hijacked my traffic as well. Oh well.. https://ubuntuforums.org/showthread.php?t=1627912 https://ubuntuforums.org/showthread.php?t=1627912 https://forums.linuxmint.com/viewtopic.php?t=60181 https://forums.linuxmint.com/viewtopic.php?t=60181
majia 8y ago
Could someone explain how out-of-ordinary these hijacks are? I thought network traffic is similar to connecting flights: it's not uncommon to fly from NY to Seoul with a transit stop in China. Network traffic may follow a non-optimal path for various reasons, such as complicated deal/rebate structures among AS, third party ASN spoofing, technical failures within AS and state-sponsored hacks. The paper seemed to cherry-pick some examples of "hijacks" involving China. But it would be more convincing to show whether they are happening all over the world or are specific to China. In addition, network traffic at ISP level are never intended to be secure. That's why we have/need end-to-end encryption.

119 points by maltalex 8y ago

Original Paper: https://scholarcommons.usf.edu/cgi/viewcontent.cgi?article=1050&context=mca https://scholarcommons.usf.edu/cgi/viewcontent.cgi?article=1... Bruce Schneier's blog post on this paper: https://www.schneier.com/blog/archives/2018/10/chinas_hacking_.html https://www.schneier.com/blog/archives/2018/10/chinas_hackin...

mark_gtf 8y ago
thnkz

hope4555 8y ago

Important

bsaul 8y ago

"then an appropriate defence policy in response could state that no traffic to or from the US or ally is allowed to enter a China Telecom PoP in the US or in the ally's networks" The fact that this is possible today seems incredible to me when i think of the number of times i've heard cybersecurity and cyberespionage was a priority of the US security agencies during the last decade.

pjc50 8y ago
On the contrary, I think as phrased that's a "break the internet" policy, especially if more than one country does it - what if China asks for a reciprocal version?
- bsaul 8y ago
  the article in fact points out that china does exactly that

Taniwha 8y ago

And the US and the rest of the 5-eyes don't? that doesn't make it right, just more wrong, if you're angry that China is doing this then you should be equally because the US and 'friends' are doing it to you too

adamiscool8 8y ago
At least in theory FVEY nations are democratically accountable for the behavior.
- cinquemb 8y ago
  Its great to have non scientific theories we can fallback to, rely upon and pat ourselves on the back for when understanding how the world actually is.
- chmod775 8y ago
  Being spied upon by a non-democratic nation is the same as being spied upon by a democratic nation if you're not a citizen - you don't hold any influence over either and neither is accountable to you. So from an outside perspective the US and China are pretty much the same thing in that regard. To top it off, the five eyes nations are spying on each other - so even if you're a citizen of one you're tolerating being spied upon by four other surveillance apparati that aren't accountable to you.
braythwayt 8y ago
“And you are lynching negroes” https://en.wikipedia.org/wiki/And_you_are_lynching_Negroes https://en.wikipedia.org/wiki/And_you_are_lynching_Negroes Or if you prefer, the contemporary form: https://en.wikipedia.org/wiki/Whataboutism https://en.wikipedia.org/wiki/Whataboutism —— This varient is particularly useful against anybody with a social justice argument. Let’s say I complain about Google and what appears to be systemic support for sexual coercion by male managers. You can trot out, “But it’s far worse at Uber, did you complain then? No? Have you taken an Uber since then? You have? You have no right to complain now.” Or maybe I say that migrant children have been separated from their families. “You’re a Canadian. Did you speak out against Residentual Schools? No? Then shut up about migrant families.” It’s endlessly applicable.

jstanley 8y ago

It's clear that the internet is too insecure, and the world's super powers can't help themselves, they simply have to meddle with it. Maybe it's time we started using Tor hidden services for everything.

qubax 8y ago
Just like programming languages can only have two out of three concepts ( soundness, completeness, decidability ), the creators of the internet had to choose two out of three concepts ( openness, robustness, security ). It's theoretically impossible to have a language that is sound, complete and decidable. It's probably also impossible to have an internet that is open, robust and secure.
- jstanley 8y ago
  I don't think that argument holds water. Which one of "open, robust, secure" do you think Tor doesn't meet? You can pick any 3 concepts and group them together like that, but it doesn't mean you can't have all 3, e.g. a house can be "large, cheap, and well-decorated" (e.g. if it is in the middle of nowhere).
  - ZeKZ 8y ago
    Tor lacks usability and efficiency.
    - Filligree 8y ago
      Those weren't on the list. ;-)
    - jstanley 8y ago
      The efficiency isn't as bad as it used to be. I browse using Tor as a matter of course now, and it's fine. What's the usability problem? Just that you have to download Tor Browser instead of Firefox? The usability of setting up a hidden service is actually easier than getting an SSL certificate.
  - 8y ago

sethbannon 8y ago

As someone with a trip to Beijing on the horizon, aside from using a VPN, are there any other best practices to keep data secure while traveling there?

lbriner 8y ago
If you have something that you genuinely need to keep from the Chinese, don't connect to the internet full-stop. Even SSL can be decrypted by their great firewall if they are suspicious enough. Even VPNs have no guarantee that someone with the right resources hasn't terminated the VPN themselves on the quiet!
- vegardx 8y ago
  [citation needed] Like whoa, are you even aware of what you are suggesting? This is completely false.
  - anyzen 8y ago
    No need to decrypt SSL, there are easier ways: https://xkcd.com/538/ https://xkcd.com/538/
    - walrus01 8y ago
      Or do like Uzbekistan has done, force all local computer stores to install a trusted root CA in the operating system before it gets to the hand of the end user. You can transparently MITM TLS1.2 if the system trusts the mitm operator CA. Maybe 0.01% of people even know where to look to examine their windows 10 machine's trusted CA list.
      - yayana 8y ago
        Having looked through the government CAs in preinstalled CA lists, I'm a little surprised Uzbekistan doesn't qualify.
    - vegardx 8y ago

walrus01 8y ago

From an ISP perspective this is really hard to hide. If somebody announces my /16 from Pakistan and traffic goes there, it's going to get noticed. Like the time PTCL broke YouTube... You basically can't bgp hijack without breaking basic internet connectivity for the legit users of the IP space (where it is intended to be announced to peers and transits), so anything lasting more than 30 seconds will generate a huge flurry of phone calls and noc emails. There are third party services you can pay, and software you can set up yourself to watch for bgp announcements for "your" Arin/ripe/apnic/whatever prefixes, and generate alerts based on that. Pretty common stuff with Linux based systems (FRR, etc) that can hold the entire global v4+v6 routing table in RAM and do quick analysis on it. Google "bgp hijack", this is a well known issue in the ISP operational community. RPKI validation of announced routes and best common practices for what you accept from your bgp neighbors go a long way.

Dowwie 8y ago

Traffic heading to China gets intercepted-- you don't say?

propter_hoc 8y ago
This is not what the article says happened. Rather, the researchers found that China was able to reroute traffic going to other countries to instead go to China, presumably to analyze or decrypt it, before sending it on to its original destination later. Please read the article before commenting.

speeq 8y ago

Back in 2010 I had Chinese IPs show up in my traceroute - I guess they hijacked my traffic as well. Oh well.. https://ubuntuforums.org/showthread.php?t=1627912 https://ubuntuforums.org/showthread.php?t=1627912 https://forums.linuxmint.com/viewtopic.php?t=60181 https://forums.linuxmint.com/viewtopic.php?t=60181

majia 8y ago

Could someone explain how out-of-ordinary these hijacks are? I thought network traffic is similar to connecting flights: it's not uncommon to fly from NY to Seoul with a transit stop in China. Network traffic may follow a non-optimal path for various reasons, such as complicated deal/rebate structures among AS, third party ASN spoofing, technical failures within AS and state-sponsored hacks. The paper seemed to cherry-pick some examples of "hijacks" involving China. But it would be more convincing to show whether they are happening all over the world or are specific to China. In addition, network traffic at ISP level are never intended to be secure. That's why we have/need end-to-end encryption.