7 ms·

For 18 minutes, China hijacked 15 percent of the world’s Internet traffic

224 points by pc 16y ago

pc 16y ago
Can anyone with more knowledge comment on plausibility of this? Google Cache: http://webcache.googleusercontent.com/search?q=cache:4lR05JZoeUMJ:www.nationaldefensemagazine.org/blog/Lists/Posts/Post.aspx%3FID%3D249+http://www.nationaldefensemagazine.org/blog/Lists/Posts/Post.aspx%3FID%3D249&hl=en&gl=us&strip=1 http://webcache.googleusercontent.com/search?q=cache:4lR05JZ...
- tptacek 16y ago
  Presumably, a broken BGP advertisement. These days, they create breathless "news" stories like this one. Back in the '90s, when small-town ISPs managed to accidentally advertise short paths to huge chunks of the Internet, they broke the whole Internet. It's hard to get too wound up about it. If you're worried that China is going to MITM your SSL sessions, remove their certificate from your cert store. If I was a Chinese supercyberspy, I probably wouldn't do something as blatant as routing the entire Internet to China just to get traffic I wanted. I think I'd do something much more akin to spearphishing an overseas Google employee to get onto their internal network.
  - erik 16y ago
    "Also, the list of hijacked data just happened to include preselected destinations around the world that encompassed military, intelligence and many civilian networks in the United States and other allies such as Japan and Australia" If this claim is valid, it would seem likely that the bad BGP advertisement was not accidental.
    - pyre 16y ago
      If it wasn't accidental, then I doubt it was a serious operation. Most likely a fishing expedition. Testing the waters to see what the reaction is and what data (or kinds of data) they are able to harvest.
      - shykes 16y ago
        China just validated that they can intercept trafic for malicious intent, with no international retaliation to speak of. How is that not serious?
        tptacek 16y ago
        Because so can practically any random company.
        pyre 16y ago
        By 'serious operation,' I mean something they were after a specific goal, vs just probing for weaknesses.
        johnthedebs 16y ago
        "This happens accidentally a few times per year, Alperovitch said." They aren't the only ones.
  - xtacy 16y ago
    Internet routing is supposed to be a distributed system alright, but most of the internet services (except China's) are not hosted in China. Wouldn't it be easy to add a policy to BGP that effectively blacklists (or gives a low priority) to routers in Chinese AS's? I guess what would be difficult is to reach a consensus on adding the above route.. oh well. Also relevant: http://asert.arbornetworks.com/2008/02/internet-routing-insecuritypakistan-nukes-youtube/ http://asert.arbornetworks.com/2008/02/internet-routing-inse...
    - paolomaffei 16y ago
      ever heard about Net Neutrality?
      - dedward 16y ago
        This has nothing to do with net neutrality - we're talking about routing policy, not traffic policy.
- amalcon 16y ago
  What the article describes can absolutely be done. Well, sort of. China can't advertise its routes as the "fastest", because internet routing cares little about performance[1], but they can otherwise work to make them an attractive option. It's certainly plausible that they could have pulled in 15% of global traffic. It's not plausible that they could have pulled in any traffic they so choose, but (depending on where their border is placed) they could have grabbed most of it. Also, it's not necessarily obvious to a casual observer what they could have grabbed. [1] Internet routing in practice is based mostly on politics, a little bit on cost, and basically just uses performance as a tie-breaker.
da5e 16y ago
I got a message alert in Gmail two days ago saying that my email had been accessed from China. I wonder if that was related.
- starpilot 16y ago
  Cool. Keep us posted.
- rick_2047 16y ago
  Looked at your message and logged into my email account. Got a message that it was accessed by United States (webcontrolcenter.com:67.199.10.9) 21 hours ago. WTF is happening Advise on what to do now is welcomed here
  - rick_2047 16y ago
    Why the hell am I being down voted? I think this is a serious issue here. And I am not alone. There are many other people who had something like this. Please leave a comment as the down votes are cryptic to me.
    - SkyMarshal 16y ago
      Are you in Cocos Islands? Maybe the downvoters assumed you're in the US?
      - rick_2047 16y ago
        I am in India. And was not looking for tech support but you take on what to make of this. I never ask for tech support from a community which is not meant for this.
    - JoachimSchipper 16y ago
      I didn't downvote you, but I don't come to HN to give tech support either. Change your password to a stronger one, don't use it on other sites, don't type it on suspect computers, etc; you should know this. Sorry for the harsh words.
TallGuyShort 16y ago
Interesting note about public keys that are automatically trusted by proprietary operating systems, and the potential for abuse by foreign powers. Reminded me of the discussion a while back about how it's relatively easy to become a root certificate authority in Firefox. Everyday cryptography needs some serious revamping.
- BCM43 16y ago
  This is a good point, and it is something that the authors of http://web.monkeysphere.info/ http://web.monkeysphere.info/ are trying to solve. More info: http://web.monkeysphere.info/why/#index1h2 http://web.monkeysphere.info/why/#index1h2
  - tptacek 16y ago
    Because this project (sensibly) doesn't override X509 authentication, it does nothing to address the problem observed by the parent commenter, or for that matter the fever dream of the article we're commenting on. Thankfully, it is very unlikely that anything like this would ever see widespread adoption, thus allowing us to sidestep the question of how it might work if they turned X509 off.
- tptacek 16y ago
  The UI for everyday cryptography needs some serious revamping. It's not relatively easy to become a Firefox root CA, but too many people are, and part of the reason why is that your cert store configuration is buried deep in the "don't touch, no user serviceable parts" bowels of your configuration.
  - ohashi 16y ago
    And how does one fix/change it?
johnthedebs 16y ago
Disclaimer: I am not a security expert, but I did study networking and network security for a few years. This article seems a bit over the top. It's pure speculation, and it seems much more likely that an engineer configured a router incorrectly, panicked for 15 minutes, then fixed it. "What set this incident apart from other such mishaps was the fact that China Telecom could manage to absorb this large amount of data and send it back out again without anyone noticing a disruption in service." We've got a technically inclined community here: When your Internet access is slow for a while, what do you attribute it to? I doubt anyone's first instinct is "must be a man-in-the-middle attack." Again, it seems much more likely that they simply had the capacity to handle most of that traffic (biggest country in the world, modernization, etc.) and no one noticed because the Internet is often flaky.
- btmorex 16y ago
  When my internet is slow, my first inclination is traceroute (mainly so I can complain to comcast is it's their fault which it usually is), which presumably would show what was happening.
  - andre3k1 16y ago
    I wouldn't consider your behavior normal. :) The parent makes a valid claim.
    - electromagnetic 16y ago
      I've only done traceroute a couple of times, normally when my internet is crawling at a bizarre time of day. I expect some slow down at primetime when everyone is home from work and school, I don't expect it when I'm up at 5-6am.
  - jberryman 16y ago
    More than once a traceroute has shown traffic stopped at my home router, and a walk outside and around the house showed the comcast man fiddling with the junction box. No knock on the door or "hey, I'm going to be yanking the cable out of your house. hope you saved that file you were editing in vim" I mostly sometimes remember to use gnu screen now.
swombat 16y ago
Internet encryption depends on two keys. One key is private and not shared, and the other is public, and is embedded in most computer operating systems. Unknown to most computer users, Microsoft, Apple and other software makers embed the public certificates in their operating systems. They also trust that this system won’t be abused. Umm, yeah, right. Basic fail at understanding public/private key cryptography. If crypto systems relied on trusting that everyone does the right thing, they would be useless. After such a fundamental failure, it's hard to take the rest of the article seriously.
- derefr 16y ago
  In this case, wouldn't a leaked CA private/signing key constitute "abuse"?
- danielh 16y ago
  You are right, this explanation of public key encryption is wrong. Maybe this stems from misunderstanding by the author, or is just the result of oversimplification. However, that threat of Chinese authorities sniffing on SSL traffic is real. Just remember the root certificate issued by the China Internet Network Information Center that ended up in Firefox, see http://news.ycombinator.com/item?id=1244444 http://news.ycombinator.com/item?id=1244444
- JoachimSchipper 16y ago
  This is a failure of the journalist to understand the distinction between "public/private key cryptography" and "public/private key cryptography as used in the SSL/TLS certificate authority scheme". I'm pretty sure that they guy (s)he was interviewing knew the difference. Of course, configuring your system to trust any valid certificate is just stupid.
- Robin_Message 16y ago
  Actually, I think the article is right. They have not failed to understand public/private key cryptography; you have failed to understand where you actually get your bank's public key from. Obviously, the bank has to send it to you. But then the problem is, how can you trust it really is your bank's key? The way we use is to trust a long list of people (CAs) to sign certificates saying "this key belongs to this domain." So, if your browser has a CA belonging to CCNIC, a Chinese corporation which could certainly act for the Chinese government, they could pull off this spoofing. The question then is, is CCNIC in people's browsers? According to http://www.mozilla.org/projects/security/certs/included/ http://www.mozilla.org/projects/security/certs/included/, it is in Firefox. As to how to pull off the spoofing, if you have a root CA, you can sign arbitrary certs, i.e. for domains you don't own. So, the article is right and SSL does require trusting all your trusted CAs are trustworthy. (edited for clarity and tone)
jwr 16y ago
I'm a little bit surprised that peers did not have filters on inbound BGP advertisements. As an operator you typically don't trust most of your peers and only accept advertisements for ASs and network blocks previously agreed upon. Filters are modified manually. The largest operators have peering links with no filters ("everyone is equal"), but that implies a lot of trust. And "trust" should not be a word placed next to a communist country name.
- CWuestefeld 16y ago
  And "trust" should not be a word placed next to a communist country name. The word "trust" shouldn't be placed next to any government.
- count 16y ago
  You may have meant to say: > As a responsible operator Which is categorically different than the majority of operators. Additionally, what does communism have to do with it?
guelo 16y ago
BGP could stand to get a security update but as with most fundamental internet protocols it will probably never happen. Most people seem to believe this incident was accidental. More info, http://bgpmon.net/blog/?p=282 http://bgpmon.net/blog/?p=282 http://www.nytimes.com/external/idg/2010/04/08/08idg-a-chinese-isp-momentarily-hijacks-the-internet-33717.html http://www.nytimes.com/external/idg/2010/04/08/08idg-a-chine...
danio 16y ago
It seems to me that data going over a publicly accessible network that is designed to let that data go by whatever route is necessary has been routed over a part of that network. How is that a problem? You cannot expect your internet data to be private: the nature of the beast is that it will be public. Anything sensitive must be encrypted in such a way that by the time the encryption is broken by your enemy (considering the likely resources they have) the data is no longer useful. Did I miss something?
smutticus 16y ago
RIPE stores every BGP update message sent through the AMSIX in an Oracle DB. I know this because I know the guy that does it. I don't know specifically about ARIN but we can safely assume they do the same. Unless someone actually goes and looks at what was being sent by Chinese BGP routers at the time of this supposed outage they should STFU. I'm not saying this is definitely BS. But the article is seriously short on details.
kevindication 16y ago
If you want more technical internet routing information, always look to NANOG. These two threads are discussing what happened, as it happened, by the people who are likely to fix/deal with it: http://mailman.nanog.org/pipermail/nanog/2010-April/020789.html http://mailman.nanog.org/pipermail/nanog/2010-April/020789.h... http://mailman.nanog.org/pipermail/nanog/2010-April/020865.html http://mailman.nanog.org/pipermail/nanog/2010-April/020865.h...

224 points by pc 16y ago

pc 16y ago

Can anyone with more knowledge comment on plausibility of this? Google Cache: http://webcache.googleusercontent.com/search?q=cache:4lR05JZoeUMJ:www.nationaldefensemagazine.org/blog/Lists/Posts/Post.aspx%3FID%3D249+http://www.nationaldefensemagazine.org/blog/Lists/Posts/Post.aspx%3FID%3D249&hl=en&gl=us&strip=1 http://webcache.googleusercontent.com/search?q=cache:4lR05JZ...

tptacek 16y ago
Presumably, a broken BGP advertisement. These days, they create breathless "news" stories like this one. Back in the '90s, when small-town ISPs managed to accidentally advertise short paths to huge chunks of the Internet, they broke the whole Internet. It's hard to get too wound up about it. If you're worried that China is going to MITM your SSL sessions, remove their certificate from your cert store. If I was a Chinese supercyberspy, I probably wouldn't do something as blatant as routing the entire Internet to China just to get traffic I wanted. I think I'd do something much more akin to spearphishing an overseas Google employee to get onto their internal network.
- erik 16y ago
  "Also, the list of hijacked data just happened to include preselected destinations around the world that encompassed military, intelligence and many civilian networks in the United States and other allies such as Japan and Australia" If this claim is valid, it would seem likely that the bad BGP advertisement was not accidental.
  - pyre 16y ago
    If it wasn't accidental, then I doubt it was a serious operation. Most likely a fishing expedition. Testing the waters to see what the reaction is and what data (or kinds of data) they are able to harvest.
    - shykes 16y ago
      China just validated that they can intercept trafic for malicious intent, with no international retaliation to speak of. How is that not serious?
      - tptacek 16y ago
        Because so can practically any random company.
      - pyre 16y ago
        By 'serious operation,' I mean something they were after a specific goal, vs just probing for weaknesses.
      - johnthedebs 16y ago
        "This happens accidentally a few times per year, Alperovitch said." They aren't the only ones.
- xtacy 16y ago
  Internet routing is supposed to be a distributed system alright, but most of the internet services (except China's) are not hosted in China. Wouldn't it be easy to add a policy to BGP that effectively blacklists (or gives a low priority) to routers in Chinese AS's? I guess what would be difficult is to reach a consensus on adding the above route.. oh well. Also relevant: http://asert.arbornetworks.com/2008/02/internet-routing-insecuritypakistan-nukes-youtube/ http://asert.arbornetworks.com/2008/02/internet-routing-inse...
  - paolomaffei 16y ago
    ever heard about Net Neutrality?
    - dedward 16y ago
      This has nothing to do with net neutrality - we're talking about routing policy, not traffic policy.
amalcon 16y ago
What the article describes can absolutely be done. Well, sort of. China can't advertise its routes as the "fastest", because internet routing cares little about performance[1], but they can otherwise work to make them an attractive option. It's certainly plausible that they could have pulled in 15% of global traffic. It's not plausible that they could have pulled in any traffic they so choose, but (depending on where their border is placed) they could have grabbed most of it. Also, it's not necessarily obvious to a casual observer what they could have grabbed. [1] Internet routing in practice is based mostly on politics, a little bit on cost, and basically just uses performance as a tie-breaker.

da5e 16y ago

I got a message alert in Gmail two days ago saying that my email had been accessed from China. I wonder if that was related.

starpilot 16y ago
Cool. Keep us posted.
rick_2047 16y ago
Looked at your message and logged into my email account. Got a message that it was accessed by United States (webcontrolcenter.com:67.199.10.9) 21 hours ago. WTF is happening Advise on what to do now is welcomed here
- rick_2047 16y ago
  Why the hell am I being down voted? I think this is a serious issue here. And I am not alone. There are many other people who had something like this. Please leave a comment as the down votes are cryptic to me.
  - SkyMarshal 16y ago
    Are you in Cocos Islands? Maybe the downvoters assumed you're in the US?
    - rick_2047 16y ago
      I am in India. And was not looking for tech support but you take on what to make of this. I never ask for tech support from a community which is not meant for this.
  - JoachimSchipper 16y ago
    I didn't downvote you, but I don't come to HN to give tech support either. Change your password to a stronger one, don't use it on other sites, don't type it on suspect computers, etc; you should know this. Sorry for the harsh words.

TallGuyShort 16y ago

Interesting note about public keys that are automatically trusted by proprietary operating systems, and the potential for abuse by foreign powers. Reminded me of the discussion a while back about how it's relatively easy to become a root certificate authority in Firefox. Everyday cryptography needs some serious revamping.

BCM43 16y ago
This is a good point, and it is something that the authors of http://web.monkeysphere.info/ http://web.monkeysphere.info/ are trying to solve. More info: http://web.monkeysphere.info/why/#index1h2 http://web.monkeysphere.info/why/#index1h2
- tptacek 16y ago
  Because this project (sensibly) doesn't override X509 authentication, it does nothing to address the problem observed by the parent commenter, or for that matter the fever dream of the article we're commenting on. Thankfully, it is very unlikely that anything like this would ever see widespread adoption, thus allowing us to sidestep the question of how it might work if they turned X509 off.
tptacek 16y ago
The UI for everyday cryptography needs some serious revamping. It's not relatively easy to become a Firefox root CA, but too many people are, and part of the reason why is that your cert store configuration is buried deep in the "don't touch, no user serviceable parts" bowels of your configuration.
- ohashi 16y ago
  And how does one fix/change it?

johnthedebs 16y ago

Disclaimer: I am not a security expert, but I did study networking and network security for a few years. This article seems a bit over the top. It's pure speculation, and it seems much more likely that an engineer configured a router incorrectly, panicked for 15 minutes, then fixed it. "What set this incident apart from other such mishaps was the fact that China Telecom could manage to absorb this large amount of data and send it back out again without anyone noticing a disruption in service." We've got a technically inclined community here: When your Internet access is slow for a while, what do you attribute it to? I doubt anyone's first instinct is "must be a man-in-the-middle attack." Again, it seems much more likely that they simply had the capacity to handle most of that traffic (biggest country in the world, modernization, etc.) and no one noticed because the Internet is often flaky.

btmorex 16y ago
When my internet is slow, my first inclination is traceroute (mainly so I can complain to comcast is it's their fault which it usually is), which presumably would show what was happening.
- andre3k1 16y ago
  I wouldn't consider your behavior normal. :) The parent makes a valid claim.
  - electromagnetic 16y ago
    I've only done traceroute a couple of times, normally when my internet is crawling at a bizarre time of day. I expect some slow down at primetime when everyone is home from work and school, I don't expect it when I'm up at 5-6am.
- jberryman 16y ago
  More than once a traceroute has shown traffic stopped at my home router, and a walk outside and around the house showed the comcast man fiddling with the junction box. No knock on the door or "hey, I'm going to be yanking the cable out of your house. hope you saved that file you were editing in vim" I mostly sometimes remember to use gnu screen now.

swombat 16y ago

Internet encryption depends on two keys. One key is private and not shared, and the other is public, and is embedded in most computer operating systems. Unknown to most computer users, Microsoft, Apple and other software makers embed the public certificates in their operating systems. They also trust that this system won’t be abused. Umm, yeah, right. Basic fail at understanding public/private key cryptography. If crypto systems relied on trusting that everyone does the right thing, they would be useless. After such a fundamental failure, it's hard to take the rest of the article seriously.

derefr 16y ago
In this case, wouldn't a leaked CA private/signing key constitute "abuse"?
danielh 16y ago
You are right, this explanation of public key encryption is wrong. Maybe this stems from misunderstanding by the author, or is just the result of oversimplification. However, that threat of Chinese authorities sniffing on SSL traffic is real. Just remember the root certificate issued by the China Internet Network Information Center that ended up in Firefox, see http://news.ycombinator.com/item?id=1244444 http://news.ycombinator.com/item?id=1244444
JoachimSchipper 16y ago
This is a failure of the journalist to understand the distinction between "public/private key cryptography" and "public/private key cryptography as used in the SSL/TLS certificate authority scheme". I'm pretty sure that they guy (s)he was interviewing knew the difference. Of course, configuring your system to trust any valid certificate is just stupid.
Robin_Message 16y ago
Actually, I think the article is right. They have not failed to understand public/private key cryptography; you have failed to understand where you actually get your bank's public key from. Obviously, the bank has to send it to you. But then the problem is, how can you trust it really is your bank's key? The way we use is to trust a long list of people (CAs) to sign certificates saying "this key belongs to this domain." So, if your browser has a CA belonging to CCNIC, a Chinese corporation which could certainly act for the Chinese government, they could pull off this spoofing. The question then is, is CCNIC in people's browsers? According to http://www.mozilla.org/projects/security/certs/included/ http://www.mozilla.org/projects/security/certs/included/, it is in Firefox. As to how to pull off the spoofing, if you have a root CA, you can sign arbitrary certs, i.e. for domains you don't own. So, the article is right and SSL does require trusting all your trusted CAs are trustworthy. (edited for clarity and tone)

jwr 16y ago

I'm a little bit surprised that peers did not have filters on inbound BGP advertisements. As an operator you typically don't trust most of your peers and only accept advertisements for ASs and network blocks previously agreed upon. Filters are modified manually. The largest operators have peering links with no filters ("everyone is equal"), but that implies a lot of trust. And "trust" should not be a word placed next to a communist country name.

CWuestefeld 16y ago
And "trust" should not be a word placed next to a communist country name. The word "trust" shouldn't be placed next to any government.
count 16y ago
You may have meant to say: > As a responsible operator Which is categorically different than the majority of operators. Additionally, what does communism have to do with it?

guelo 16y ago

BGP could stand to get a security update but as with most fundamental internet protocols it will probably never happen. Most people seem to believe this incident was accidental. More info, http://bgpmon.net/blog/?p=282 http://bgpmon.net/blog/?p=282 http://www.nytimes.com/external/idg/2010/04/08/08idg-a-chinese-isp-momentarily-hijacks-the-internet-33717.html http://www.nytimes.com/external/idg/2010/04/08/08idg-a-chine...

danio 16y ago

It seems to me that data going over a publicly accessible network that is designed to let that data go by whatever route is necessary has been routed over a part of that network. How is that a problem? You cannot expect your internet data to be private: the nature of the beast is that it will be public. Anything sensitive must be encrypted in such a way that by the time the encryption is broken by your enemy (considering the likely resources they have) the data is no longer useful. Did I miss something?

smutticus 16y ago

RIPE stores every BGP update message sent through the AMSIX in an Oracle DB. I know this because I know the guy that does it. I don't know specifically about ARIN but we can safely assume they do the same. Unless someone actually goes and looks at what was being sent by Chinese BGP routers at the time of this supposed outage they should STFU. I'm not saying this is definitely BS. But the article is seriously short on details.

kevindication 16y ago

If you want more technical internet routing information, always look to NANOG. These two threads are discussing what happened, as it happened, by the people who are likely to fix/deal with it: http://mailman.nanog.org/pipermail/nanog/2010-April/020789.html http://mailman.nanog.org/pipermail/nanog/2010-April/020789.h... http://mailman.nanog.org/pipermail/nanog/2010-April/020865.html http://mailman.nanog.org/pipermail/nanog/2010-April/020865.h...