6 ms·

US Dept of Energy AS32982 Network Possibly BGP Hijacked by China Telecom

118 points by mmaunder 8y ago

pizza 8y ago
Just noticed this one, too: https://bgpstream.com/event/170070 https://bgpstream.com/event/170070 Does it mean an Iranian telecom hijacked some of AT&T's traffic?
- dogecoinbase 8y ago
  Notionally yes, though as with a lot of these hijackings it's really a question of how far it propagated/who is correctly filtering routes. This happens with Iran Tele from time to time, typically when they are trying to block something specific internally and let the route leak out (e.g. their Telegram block back in July).
thechao 8y ago
Article describing BGP hijacking. It is the first article from a DDG search, and I know nothing of the topic so YMMV. https://www.internetsociety.org/blog/2018/05/what-is-bgp-hijacking-anyway/ https://www.internetsociety.org/blog/2018/05/what-is-bgp-hij...
- duality 8y ago
  Wikipedia article: https://en.wikipedia.org/wiki/BGP_hijacking https://en.wikipedia.org/wiki/BGP_hijacking
  - sgc 8y ago
    The article mentions there are mitigations to this type of attack available. Does anyone know of how an individual user could (practically) reduce their exposure to this type of attack?
    - lgierth 8y ago
      A typical mitigation at the ASN level is to have allowlists of exactly which prefixes your downstsream ASN is expected and allowed to announce. I don't recall the name of this technique, and it's somewhat widely deployed, but definitely far from widely enough to secure Internet routing. Individual end users don't have much of a chance to avoid BGP hijacking. You could continuously run traceroutes to your destination network, but then that gives you not much guarantee that individual TCP connections will take the same route as those ICMP packets.
    - gruez 8y ago
      By using encryption. That way if such attack occurs, the only negative effects is downtime, rather than data exposure.
      - altmind 8y ago
        Encryption does not help BGP hijacks at all. You need to filter the accepted upstream routes. But filtering ultimatively defeats the purpose of BGP - route learning is no longer fully dynamic and need some manual approvals.
    - vinay_ys 8y ago
      The IP you normally would have communicated with is among the hijacked IPs, then you have exposure. The data you send to such IP is ending up in the hijacker's hands. As an end user, your only defense is to use end-to-end authenticated encryption between you and your intended other end-point. The authenticated part is very critical in this case.
lgierth 8y ago
It's not neccessarily AS4812 / China Telecom announcing this themselves. Anyone could be announcing AS4812,192.208.19.0/24. For some degree of attribution, you need to go and figure out where the actual announcement is coming from. The "beauty" of BGP :) edit: It's also interesting to note that the bogus announcement is for /24, which is more specific than the original /23, so it takes precedence.
- CKN23-ARIN 8y ago
  For reference, the path observed by BGPMon was: 11039 The George Washington University 46887 Lightower Fiber Networks I, LLC 6939 Hurricane Electric LLC 4134 China Telecom Backbone 4134 China Telecom Backbone 4134 China Telecom Backbone 4812 China Telecom (Group) Hurricane Electric has been known to not apply route filters to large peers, leading to hijacks like this. I suspect that was the case here, too. Although you are right, this path could have been spoofed by GWU or Lightower (or BGPMon!)
notabot 8y ago
So? What is the significance of one single event? Looking at that site it is not that uncommon. Did this event catch your attention simply because it had the right keywords (US Dept of Energy and China)? MIT hijacked someone's route? https://bgpstream.com/event/171889 https://bgpstream.com/event/171889 An US ISP? https://bgpstream.com/event/171683 https://bgpstream.com/event/171683 Another US ISP? https://bgpstream.com/event/170328 https://bgpstream.com/event/170328 China Telecom could have been a victim too? https://bgpstream.com/event/155707 https://bgpstream.com/event/155707 The list goes on... (edited: formatting)
- toomuchtodo 8y ago
  "Who is responding to such an event during the government shutdown?" was my first thought. Assuming nefarious intent, now would be an ideal time to stage an attack.
  - gh02t 8y ago
    DoE is currently not affected by the partial shutdown. It's business as usual at the national laboratories and with other employees/contractors. The way it's funded means that there would have to be a prolonged shutdown before DoE would have to start shutting down, but I think even then security and safety essential personnel are exempt. https://www.directives.doe.gov/directives-documents/100-series/0137-1-border-b-recertified https://www.directives.doe.gov/directives-documents/100-seri...
    - toomuchtodo 8y ago
      But is ESnet [1]? They are the org responsible for providing inter-org networking services between US DOE labs and other associated institutions. [1] http://es.net/ http://es.net/
      - gh02t 8y ago
        The plan includes pay for external contractors and security-essential functions, so yes I would assume so (though I don't know firsthand about them specifically). To the best of my knowledge, DoE will continue to run entirely as normal until carryover funding from previous allocations runs out. Couple months at least. After that it basically goes into hibernation, but I expect that communications and network security would be considered as essential and hence would remain funded even then.
deleted 8y ago
[deleted]

118 points by mmaunder 8y ago

Just noticed this one, too: https://bgpstream.com/event/170070 https://bgpstream.com/event/170070 Does it mean an Iranian telecom hijacked some of AT&T's traffic?

dogecoinbase 8y ago
Notionally yes, though as with a lot of these hijackings it's really a question of how far it propagated/who is correctly filtering routes. This happens with Iran Tele from time to time, typically when they are trying to block something specific internally and let the route leak out (e.g. their Telegram block back in July).

thechao 8y ago

Article describing BGP hijacking. It is the first article from a DDG search, and I know nothing of the topic so YMMV. https://www.internetsociety.org/blog/2018/05/what-is-bgp-hijacking-anyway/ https://www.internetsociety.org/blog/2018/05/what-is-bgp-hij...

duality 8y ago
Wikipedia article: https://en.wikipedia.org/wiki/BGP_hijacking https://en.wikipedia.org/wiki/BGP_hijacking
- sgc 8y ago
  The article mentions there are mitigations to this type of attack available. Does anyone know of how an individual user could (practically) reduce their exposure to this type of attack?
  - lgierth 8y ago
    A typical mitigation at the ASN level is to have allowlists of exactly which prefixes your downstsream ASN is expected and allowed to announce. I don't recall the name of this technique, and it's somewhat widely deployed, but definitely far from widely enough to secure Internet routing. Individual end users don't have much of a chance to avoid BGP hijacking. You could continuously run traceroutes to your destination network, but then that gives you not much guarantee that individual TCP connections will take the same route as those ICMP packets.
  - gruez 8y ago
    By using encryption. That way if such attack occurs, the only negative effects is downtime, rather than data exposure.
    - altmind 8y ago
      Encryption does not help BGP hijacks at all. You need to filter the accepted upstream routes. But filtering ultimatively defeats the purpose of BGP - route learning is no longer fully dynamic and need some manual approvals.
  - vinay_ys 8y ago
    The IP you normally would have communicated with is among the hijacked IPs, then you have exposure. The data you send to such IP is ending up in the hijacker's hands. As an end user, your only defense is to use end-to-end authenticated encryption between you and your intended other end-point. The authenticated part is very critical in this case.

lgierth 8y ago

It's not neccessarily AS4812 / China Telecom announcing this themselves. Anyone could be announcing AS4812,192.208.19.0/24. For some degree of attribution, you need to go and figure out where the actual announcement is coming from. The "beauty" of BGP :) edit: It's also interesting to note that the bogus announcement is for /24, which is more specific than the original /23, so it takes precedence.

CKN23-ARIN 8y ago
For reference, the path observed by BGPMon was: 11039 The George Washington University 46887 Lightower Fiber Networks I, LLC 6939 Hurricane Electric LLC 4134 China Telecom Backbone 4134 China Telecom Backbone 4134 China Telecom Backbone 4812 China Telecom (Group) Hurricane Electric has been known to not apply route filters to large peers, leading to hijacks like this. I suspect that was the case here, too. Although you are right, this path could have been spoofed by GWU or Lightower (or BGPMon!)

notabot 8y ago

So? What is the significance of one single event? Looking at that site it is not that uncommon. Did this event catch your attention simply because it had the right keywords (US Dept of Energy and China)? MIT hijacked someone's route? https://bgpstream.com/event/171889 https://bgpstream.com/event/171889 An US ISP? https://bgpstream.com/event/171683 https://bgpstream.com/event/171683 Another US ISP? https://bgpstream.com/event/170328 https://bgpstream.com/event/170328 China Telecom could have been a victim too? https://bgpstream.com/event/155707 https://bgpstream.com/event/155707 The list goes on... (edited: formatting)

toomuchtodo 8y ago
"Who is responding to such an event during the government shutdown?" was my first thought. Assuming nefarious intent, now would be an ideal time to stage an attack.
- gh02t 8y ago
  DoE is currently not affected by the partial shutdown. It's business as usual at the national laboratories and with other employees/contractors. The way it's funded means that there would have to be a prolonged shutdown before DoE would have to start shutting down, but I think even then security and safety essential personnel are exempt. https://www.directives.doe.gov/directives-documents/100-series/0137-1-border-b-recertified https://www.directives.doe.gov/directives-documents/100-seri...
  - toomuchtodo 8y ago
    But is ESnet [1]? They are the org responsible for providing inter-org networking services between US DOE labs and other associated institutions. [1] http://es.net/ http://es.net/
    - gh02t 8y ago
      The plan includes pay for external contractors and security-essential functions, so yes I would assume so (though I don't know firsthand about them specifically). To the best of my knowledge, DoE will continue to run entirely as normal until carryover funding from previous allocations runs out. Couple months at least. After that it basically goes into hibernation, but I expect that communications and network security would be considered as essential and hence would remain funded even then.

deleted 8y ago

[deleted]