7 ms·

> While one may argue such attacks can always be explained by ‘normal’ BGP behavior, these in particular suggest malicious intent, precisely because of their un

> While one may argue such attacks can always be explained by ‘normal’ BGP behavior, these in particular suggest malicious intent, precisely because of their unusual transit characteristics – namely the lengthened routes and the abnormal durations. The investigation is pretty damning—it’s clear from the visuals that the traffic followed unusual routes. (Canada to South Korea via China, seriously?) Could there possibly be an innocent explanation where the channel through PRC somehow happens to be less saturated or otherwise faster? Could it be related to the recent objection by DoJ to the US—HK undersea link? I imagine such a link could enable even wilder hijacking scenarios. The article is from 2018, but it seems like it was an ongoing thing at the time of publication—is it still happening with no repercussions? I did get some laughs from the unsuccessful attempt at diverting US—Italy traffic, but overall it paints a bleak picture.

slovenlyrobot 7y ago
> Could there possibly be an innocent explanation where the channel through PRC somehow happens to be less saturated or otherwise faster? AIUI these aren't empirical measurements of routes actual traffic takes, but reconstructions from historical BGP announcements. I guess when they say traffic was hijacked, they mean there were announcements originating from China Telecom for subnets that unquestionably aren't supposed to be served by them How to detect that? Well, I guess after a hijack ends, it is possible to compare the origin ASNs announcing those subnets with before the hijack. If a subnet suddenly starts to be announced by an origin it had no prior relationship with, then that announcement later disappears, only for the subnet's old announcements to continue, it's easy to say this may have been a hijacking It goes without saying when some origin begins publishing new addresses, humans were almost certainly involved somewhere along the chain. So for the innocence part, nope I think they can report that Cogent are affected by analysing Cogent's own announcements, where BGP (IIRC) records the path of ASNs causing the announcement to be made. So CT -> Cogent announcement, then Cogent -> their customers announcement, that the origin is CT is actually identified in announcements the customers receive, and likely where data for reports like this are being collected (disclaimer: I'm not a networking guy whatsoever)
toast0 7y ago
> Could there possibly be an innocent explanation China Telecom is a global transit provider. As a sibling commenter mentioned, the document doesn't show that traffic actually went to China, just that China Telecom was an available path -- even assuming traffic transited their network, it's unreasonable to assume it actually transited through China without a traceroute at least; if the traffic did transit their network, it could be logged and sent wherever, of course. Since the routes were reported as being available for several months, the most likely explanation is that at least one the organizations' ISPs had China Telecom as a transit provider or peer, or the ISPs' transit providers had China Telecom as a provider or peer (etc). It's not an unreasonable provider to get traffic from west coast North America to east coast Asia. It's also not unreasonable to go through Hong Kong, instead of direct to South Korea --- Hong Kong and South Korea are well connected to each other, and I believe Hong Kong has more connectivity to the US than South Korea does (I could be wrong/out of date). Most of the non-US based global transit providers have a significant presence in US PoPs as well, because good connectivity to the US is a very important part of their business. Some of these are Telefonica, Telia, Tata. (Apparently, it's important to start your name with a T).
- nickodell 7y ago
  >China Telecom is a global transit provider. As a sibling commenter mentioned, the document doesn't show that traffic actually went to China, just that China Telecom was an available path -- even assuming traffic transited their network, it's unreasonable to assume it actually transited through China without a traceroute at least; The paper is based upon data from the DIMES project, which uses many volunteer-contributed nodes to run traceroutes and pings. See https://arxiv.org/pdf/cs/0506099.pdf https://arxiv.org/pdf/cs/0506099.pdf
CameronNemo 7y ago
>Could there possibly be an innocent explanation where the channel through PRC somehow happens to be less saturated or otherwise faster? BGP prioritizes routes via the number of hops in the AS path. A prefix announcement could be described like this: subnet: 169.254.0.0/16 origin-as: 65419 as-path: 65419 -> 65420 -> 65416 This announcement is twice removed from the origin AS (autonomous system), and would have a lower priority than a direct announcement from the origin as or another path. A BGP speaker can lie about the AS path and claim they have a shorter path than they really do. Then their peers either reject the route advertisement, if RPKI is configured (it is not), or accept it and forward traffic through it.
- kortilla 7y ago
  RPKI only protects the origin, not the path. You need full bgpsec for that which is barely standardized, let alone implemented and adopted.
- dylz 7y ago
  From a US West POV: I don't believe I've ever seen that kind of path through PRC to be faster. Their peering ports are insanely oversubscribed and lossy at peak in LA/SJ, and half-decent traffic via CT's Next Generation is absurdly expensive.
  - solotronics 7y ago
    China Unicom / China Telecom / China Mobile suck as transit, not sure what the above poster is getting at. https://jpgamboa.com/peering-chinese-internet/ https://jpgamboa.com/peering-chinese-internet/

slovenlyrobot 7y ago

> Could there possibly be an innocent explanation where the channel through PRC somehow happens to be less saturated or otherwise faster? AIUI these aren't empirical measurements of routes actual traffic takes, but reconstructions from historical BGP announcements. I guess when they say traffic was hijacked, they mean there were announcements originating from China Telecom for subnets that unquestionably aren't supposed to be served by them How to detect that? Well, I guess after a hijack ends, it is possible to compare the origin ASNs announcing those subnets with before the hijack. If a subnet suddenly starts to be announced by an origin it had no prior relationship with, then that announcement later disappears, only for the subnet's old announcements to continue, it's easy to say this may have been a hijacking It goes without saying when some origin begins publishing new addresses, humans were almost certainly involved somewhere along the chain. So for the innocence part, nope I think they can report that Cogent are affected by analysing Cogent's own announcements, where BGP (IIRC) records the path of ASNs causing the announcement to be made. So CT -> Cogent announcement, then Cogent -> their customers announcement, that the origin is CT is actually identified in announcements the customers receive, and likely where data for reports like this are being collected (disclaimer: I'm not a networking guy whatsoever)

toast0 7y ago

> Could there possibly be an innocent explanation China Telecom is a global transit provider. As a sibling commenter mentioned, the document doesn't show that traffic actually went to China, just that China Telecom was an available path -- even assuming traffic transited their network, it's unreasonable to assume it actually transited through China without a traceroute at least; if the traffic did transit their network, it could be logged and sent wherever, of course. Since the routes were reported as being available for several months, the most likely explanation is that at least one the organizations' ISPs had China Telecom as a transit provider or peer, or the ISPs' transit providers had China Telecom as a provider or peer (etc). It's not an unreasonable provider to get traffic from west coast North America to east coast Asia. It's also not unreasonable to go through Hong Kong, instead of direct to South Korea --- Hong Kong and South Korea are well connected to each other, and I believe Hong Kong has more connectivity to the US than South Korea does (I could be wrong/out of date). Most of the non-US based global transit providers have a significant presence in US PoPs as well, because good connectivity to the US is a very important part of their business. Some of these are Telefonica, Telia, Tata. (Apparently, it's important to start your name with a T).

nickodell 7y ago
>China Telecom is a global transit provider. As a sibling commenter mentioned, the document doesn't show that traffic actually went to China, just that China Telecom was an available path -- even assuming traffic transited their network, it's unreasonable to assume it actually transited through China without a traceroute at least; The paper is based upon data from the DIMES project, which uses many volunteer-contributed nodes to run traceroutes and pings. See https://arxiv.org/pdf/cs/0506099.pdf https://arxiv.org/pdf/cs/0506099.pdf

CameronNemo 7y ago

>Could there possibly be an innocent explanation where the channel through PRC somehow happens to be less saturated or otherwise faster? BGP prioritizes routes via the number of hops in the AS path. A prefix announcement could be described like this: subnet: 169.254.0.0/16 origin-as: 65419 as-path: 65419 -> 65420 -> 65416 This announcement is twice removed from the origin AS (autonomous system), and would have a lower priority than a direct announcement from the origin as or another path. A BGP speaker can lie about the AS path and claim they have a shorter path than they really do. Then their peers either reject the route advertisement, if RPKI is configured (it is not), or accept it and forward traffic through it.

kortilla 7y ago
RPKI only protects the origin, not the path. You need full bgpsec for that which is barely standardized, let alone implemented and adopted.
dylz 7y ago
From a US West POV: I don't believe I've ever seen that kind of path through PRC to be faster. Their peering ports are insanely oversubscribed and lossy at peak in LA/SJ, and half-decent traffic via CT's Next Generation is absurdly expensive.
- solotronics 7y ago
  China Unicom / China Telecom / China Mobile suck as transit, not sure what the above poster is getting at. https://jpgamboa.com/peering-chinese-internet/ https://jpgamboa.com/peering-chinese-internet/