3 ms·

Would someone explain to a scrub what "route leaking" is? Would this be an issue because the leak receiver could inspect traffic that it wouldn't have gotten o

Would someone explain to a scrub what "route leaking" is? Would this be an issue because the leak receiver could inspect traffic that it wouldn't have gotten otherwise?

RationPhantoms 7y ago
That's exactly right. Think of it like modifying your GPS to get you to drive to a bad part of town (so that your car/valuables are stolen). The fact that it's China Telecom speaks volumes to this being a suspected route hijack. It's possible it was just an error on the Swiss colo companies part but somehow I doubt that.
- x86_64Ubuntu 7y ago
  Is there still enough unencrypted traffic to make this attack have any value? Or are they like the NSA where they care more about who and when and not so much the content of the conversations.
tptacek 7y ago
The way inter-ISP routing works is that every ISP advertises its IP ranges† (prefixes) to each ISP it's connected to, who in turn stamp them with their own addresses and relay them to all their connections; in this way, advertisements are eventually propagated to every ISP on the Internet. A prefix can be connected to several ISPs, and thus be advertised multiple times from multiple places. Each ISP resolves all the advertisements and computes paths to each prefix, sending traffic towards the shortest path received. The protocol that conducts this process, BGP4, is unauthenticated and managed by a combination of fiddly filtering configurations (often based on regular expressions) and trust. An ISP can advertise any prefix and stand a chance of getting some other ISPs to route that prefix towards them. Here, what appears to have happened was that a Dutch ISP advertised a bunch of prefixes incorrectly (they may have been advertised in such a way as to make them unattractive options for routing, as a safeguard, but that proved ineffective). China Telecom picked them up and propagated them, and, in doing so, made itself an attractive path for the prefixes for many other ISPs. Yes, this would allow China Telecom to inspect traffic mistakenly routed to them, though it's extraordinarily unlikely that anything like that occurred. † ISPs themselves have their own short numeric addresses, called ASNs.
- yegle 7y ago
  Except GFW always check the traffic and likely 1) DNS poisoned, 2) TCP RST'ed some of the misrouted traffic?

Would someone explain to a scrub what "route leaking" is? Would this be an issue because the leak receiver could inspect traffic that it wouldn't have gotten otherwise?

RationPhantoms 7y ago

That's exactly right. Think of it like modifying your GPS to get you to drive to a bad part of town (so that your car/valuables are stolen). The fact that it's China Telecom speaks volumes to this being a suspected route hijack. It's possible it was just an error on the Swiss colo companies part but somehow I doubt that.

x86_64Ubuntu 7y ago
Is there still enough unencrypted traffic to make this attack have any value? Or are they like the NSA where they care more about who and when and not so much the content of the conversations.

tptacek 7y ago

The way inter-ISP routing works is that every ISP advertises its IP ranges† (prefixes) to each ISP it's connected to, who in turn stamp them with their own addresses and relay them to all their connections; in this way, advertisements are eventually propagated to every ISP on the Internet. A prefix can be connected to several ISPs, and thus be advertised multiple times from multiple places. Each ISP resolves all the advertisements and computes paths to each prefix, sending traffic towards the shortest path received. The protocol that conducts this process, BGP4, is unauthenticated and managed by a combination of fiddly filtering configurations (often based on regular expressions) and trust. An ISP can advertise any prefix and stand a chance of getting some other ISPs to route that prefix towards them. Here, what appears to have happened was that a Dutch ISP advertised a bunch of prefixes incorrectly (they may have been advertised in such a way as to make them unattractive options for routing, as a safeguard, but that proved ineffective). China Telecom picked them up and propagated them, and, in doing so, made itself an attractive path for the prefixes for many other ISPs. Yes, this would allow China Telecom to inspect traffic mistakenly routed to them, though it's extraordinarily unlikely that anything like that occurred. † ISPs themselves have their own short numeric addresses, called ASNs.

yegle 7y ago
Except GFW always check the traffic and likely 1) DNS poisoned, 2) TCP RST'ed some of the misrouted traffic?