31 ms·

There were BGP anomalies during the Venezuela blackout

941 points by illithid0 9mo ago

Ms-J 9mo ago
Typical cyber warfare techniques.
lawlessone 9mo ago
Look for the same with Greenland or Canada next :/
- agumonkey 9mo ago
  the rest of the world is weirdly too passive, there's a smell of shock
  - deleted 9mo ago
    [deleted]
  - refulgentis 9mo ago
    IMHO the rest of the world isn't asleep. Denmark's prime minister said the same as you, for example. US just got roasted at UN by inter alia, France, with ~20 countries either speaking the same or asking to speak on it. That's just from 30s with front page of nytimes.com.
    - erxam 9mo ago
      That just sounds like more 'strongly worded letters' which never go anywhere and they never do anything about. It's over for the EU. They rested on their laurels for too long and cowardice rotted them from the inside. I don't think Denmark will put even a smidge of resistance up. Trump is going to bark some orders, boots are going to hit the ground and it's fait accompli.
      - refulgentis 9mo ago
        What does action (i.e. not-strongly-worded-letters, i.e. not words) look like? Capture Trump? Invade the US? The idea the EU is some bureaucratic hellhole incapable of anything is really odd and nigh-universal - I'm used to righties adopting it from Brexit & antipathy for social demoracy, but I'm not used to see it as a despondent wailing from people otherwise sympathetic to it. Note no one even mentioned the EU - it's so universal a reaction to "US is acting bad" that it came out of nowhere. Not to pick on you: when I was first replying, I also replied as if it was the EU! Had to go back and read the comment I was replying to and corrected myself before posting.
        lysace 9mo ago
        Action probably looks like crash-starting multiple nuclear weapons programs. With or without the help of the british/french. Probably with. I'd imagine programs from: the Nordics and Poland+Baltics. Maybe Germany, probably not.
        refulgentis 9mo ago
        What happens when you start making nukes and the US doesn't want you to? Ssetting aside the whole non-proliferation thing, or expense (see NK), etc. Let's get serious, please.
        subw00f 9mo ago
        Why set aside expense? You do it anyway by whatever means necessary, like the DRPK. And if you’re a “western democracy” (also known as capitalist dictatorship) and you’re part of the ruling class, you still have the incentive to protect your assets, things you exploit in your country, land, natural resources, etc, that the US won’t be sharing or that they want to decrease supply when they take over through puppets or multinationals, and you can always force the public to pay for such a project, like all the times western peoples had to bail out or spend their taxes to benefit private corporations, but now it would look like it’s to protect sovereignty, which is a bonus of course, it would be to protect the local ruling class’s interests, but anyway. It’s clear the Americans will stop at nothing to acquire whatever it is they want, including indirectly violent means like ordering their financial institutions and tech giants to destroy whoever is on the way. The monster was always there since the Cold War and just now it dropped any pretenses.
    - pamcake 9mo ago
      In EU, so far I believe only the PM of Spain had the backbone to speak properly with anything that could be considered "strongly worded", proving that it's possible. The others have been variants of "Celebrating liberation of the Venezuelan people from the illegitimate dictator, a new dawn for democracy! (oh and everyone (not naming names) please behave and try to be mindful of international law and human rights from now on)" Not a single word about the dead, for one. While the NYTimes headline names France as critical, here's Macron (still only posting) on Twitter: https://xcancel.com/EmmanuelMacron/status/2007525386977194040 https://xcancel.com/EmmanuelMacron/status/200752538697719404... Meanwhile POTUS is over there talking literally and openly about how US are "going to run things" and motivating it with taking the oil and how they don't really care about democracy one way or other.
      - blell 9mo ago
        This has happened because the party that rules Spain has ties to the dictatorship. This goes so far that one of the ministers of the government met in Spain with Delcy Rodriguez, bringing her a few briefcases of something that hasn't been explained yet, despite her being subject to a travel ban in the EU. Of course this is a progressive government so the EU said absolutely nothing about it.
      - refulgentis 9mo ago
        It’s really dumb I’m sitting at -2 and the top reply is about a Macron tweet from 2 days ago, lying and saying no one else from Europe has said anything, and lying and saying anything besides the King of Spain was actually celebrating. You’re making stuff up. Full stop. You could easily have googled either thing I mentioned. You didn’t, choosing to free associate instead. May you reap what you sow.
    - benjiro 9mo ago
      Given that the nukes topic came up ... Will the US/Trump be so aggressive if Denmark has a few nukes that can hit the US? Or at minimum sink a invading fleet? These actions by Trump are only reinforcing that we will see even more of a push for everybody to get their own nukes, even in Europe. People do not need to yell "bad trump", to have his actions result in decisions being pushed forward like this. Theodore: "speak softly and carry a big stick"... and nuke(s) is a BIG stick.
  - marcosdumay 9mo ago
    I don't think anybody cares any bit about Maduro.
    - agumonkey 9mo ago
      understandably, it's more about the acceleration in aggressiveness from Trump clan and the precedent of crossing the usual international red lines
      - marcosdumay 9mo ago
        Almost every country made some repudiation note. But I don't think we'll see anybody doing any actual thing because of that.
- ceejayoz 9mo ago
  Not sure why this got downvoted; we're threatening it again, credibly enough that the Danish PM is telling them to shut up. Yesterday: > Adding to the alarm, Katie Miller, a right-wing podcast host and the wife of Trump adviser Stephen Miller, posted an image of Greenland superimposed with the American flag and the caption "SOON!" https://www.nbcnews.com/world/greenland/trump-venezuela-attack-maduro-greenland-threats-denmark-europe-rcna252289 https://www.nbcnews.com/world/greenland/trump-venezuela-atta...
  - Herring 9mo ago
    > Not sure why this got downvoted Fragile egos. Narcissists desperately need to feel good about themselves. They're caught in a cycle: feel worthless -> do bad things (feed the ego) -> feel worthless.
    - refulgentis 9mo ago
      It's not only downvoted, it was flagged, and dead. (flag accepted by moderator, no one else will see this comment thread without expanding) Mr. Trump good. Trump derangement syndrome bad. If Mr. Trump does what you say eventually, then it was good. (see rule #1) I see this frequently on HN since the re-election, won't speculate as to why: only way around the downvote is to criticize policy generically, untethered to time, with some sort of micro-focus like you're sharing new information about how things work, not discussing current events.
      - lawlessone 9mo ago
        Of course, because this site is control of Mark Eggman Andrreesen.
        JumpCrisscross 9mo ago
        > this site is control of Mark Eggman Andrreesen You're mixing up your VCs?
      - uncletscollie 9mo ago
- MaxHoppersGhost 9mo ago
  Canada has a strong army and can defend itself. Greenland on the other hand is not well defended and I doubt Denmark really cares (e.g., if they’re willing to send tens of thousands of troops to die for it) if it was occupied by China or Russia in the event of a war. Greenland is a massive strategic liability for the US and Europe (although the EU still has its head in the sand they are starting to wake up some).
  - OkayPhysicist 9mo ago
    Frankly, the right move (before Trump did as Trump does, and fucked up our foreign relations) would have been to straight-up buy Greenland. The people of Greenland have the right under Danish law to vote for independence, and there's not that many of them. Paying individual people for the votes probably would have cost the US $10 billion, and then we could give them Puerto Rico-esque status.
kachapopopow 9mo ago
I wonder what kind of capabilities the US army didn't use during this operation.
- Thaxll 9mo ago
  BGP is so unsecure that almost anyone can create chaos.
  - ronsor 9mo ago
    Even by accident!
    - kachapopopow 9mo ago
      or even by normal load from someone deciding to split a /8 prefix into /24's
      - icedchai 9mo ago
        Most BGP peers have router filters in place. It's not 1996 anymore. I remember the days of logging into a Cisco connected to a Sprint T1 and seeing a coworker had fat fingered a spammer's route, sending it to null0. Oops. How did that happen?
        doublerabbit 9mo ago
        I worked as a contractor for a IoT gig that sold sim cards services for buses, trains et cetera. The radio towers we used to access to obtain the accounting data (CDRs) all had the same very weak password.
        mesrik 9mo ago
        Also RPKI has been available long time already. Considering the routing table size has been increasing and IPv6 need anyone shouldn't be running global routing with gear not supporting RPKI any more, the routing polices and announcing those RIR they operate. https://en.wikipedia.org/wiki/Resource_Public_Key_Infrastructure https://en.wikipedia.org/wiki/Resource_Public_Key_Infrastruc...
subzidion 9mo ago
There were reports they had considered Christmas Day and New Year's Day. I wonder if it was far enough along that you could see similar BGP anomalies around those times.
- bakies 9mo ago
  Not from the cloudflare dashboard, you can zoom out. The night of the attack doesnt even really stand out as abnormal when zooming out that far.
  - floatrock 9mo ago
    So you're saying I can't set an alert for these conditions and use the timing to place a quick bet on the geopolitical polymarket du-jour? https://finance.yahoo.com/news/one-polymarket-user-made-more-164427975.html?guccounter=1 https://finance.yahoo.com/news/one-polymarket-user-made-more...
    - bakies 9mo ago
      Yeah, I was thinking it definitely needs to be correlated to geopolitical tensions in some way. Polymarket data might be helpful in this case- and provides incentives for putting this kind of data together.
mywittyname 9mo ago
What would be the result of this? I think it would route data through Sparkle as a way of potentially spying on internet traffic without having compromised the network equipment within Venezuela, but I'm not familiar enough with network architecture to really understand what happened.
- 7952 9mo ago
  Maybe there would be some benefit in just dropping some packets. For example to WhatsApp, Telegram, Gmail servers. Could add a communication delay that could be critical and denies people a fairly reliable fallback communication method.
- Aloisius 9mo ago
  The effect of this would be traffic from GlobeNet destined for Dayco would transit over CANTV's network for a period. I'm not sure why the author singled out Telecom Italia Sparkle.
deleted 9mo ago
[deleted]
catigula 9mo ago
Cyber-warfare capabilities on this level seem pretty horrific. What if you could simply turn off the power grid of Kyiv or Moscow in anticipation of a strike? That seems extremely disorientating. What if you could simply turn off the power grid indefinitely?
- ceejayoz 9mo ago
  > What if you could simply turn off the power grid of Kyiv or Moscow in anticipation of a strike? I expect every major world power has a plan to (attempt to) do precisely that to their enemies. https://en.wikipedia.org/wiki/Graphite_bomb https://en.wikipedia.org/wiki/Graphite_bomb > The US Navy used sea-launched Tomahawk missiles with Kit-2 warheads, involving reels of carbon fibers, in Iraq as part of Operation Desert Storm during the Gulf War in 1991, where it disabled about 85% of the electricity supply. The US Air Force used the CBU-94, dropped by F-117 Nighthawks, during the NATO bombing of Yugoslavia on 2 May 1999, where it disabled more than 70% national grid electricity supply. I would not, however, take "Trump said something" as indicative of much. "It was dark, the lights of Caracas were largely turned off due to a certain expertise that we have, it was dark, and it was deadly" is both visibly untrue from the video evidence available, and is the precise sort of off-the-cuff low-fact statement he's prone to.
  - catigula 9mo ago
    On the other hand, Trump has a track record of leaking capabilities.
  - 9cb14c1ec0 9mo ago
    General Caine specifically said they utilized CYBERCOM (which is the US inter-branch hacking command) to pave the way for the special ops helicopters. I personally have no doubt that any (whether or not they all were) lights being out was due to a US hack. Some of the stuff that got blown up may well have been to prevent forensic recover of US tools and techniques.
    - ceejayoz 9mo ago
t0mas88 9mo ago
Alternative theory: Part of the operation caused power outages or disrupted some connections, the BGP anomalies were a result of that. The data would make that more likely, because deliberately adding a longer route doesn't achieve much. It's not usually going to get any traffic.
- Someone1234 9mo ago
  The BGP anomalies were 24-hours~ before the power outage, so I'm not sure I follow what you're arguing.
  - t0mas88 9mo ago
    What I mean is that cause and effect here could be different then the author thinks. We see some route changes, but those changes make no sense on their own since they wouldn't capture any traffic. That makes it more probable that BGP was not the attack, but that some other action caused this BGP anomalie as a side effect. For example, maybe some misconfiguration caused these routes to be published because another route was lost. Which could very well be the actual cyber attack, or the effect of jamming, or breaking some undersea cable, or turning off the power to some place.
    - narmiouh 9mo ago
      I think what the other commenter is saying is that the BGP changes happened 12 hours before any of the power loss/bomb drop, so that eliminates your primary cause.
      - teiferer 9mo ago
        At that earlier time, some preparatory action was likely already on its way.
- t0mas88 9mo ago
  As a follow-up, Cloudflare came to the same conclusion: https://blog.cloudflare.com/bgp-route-leak-venezuela/ https://blog.cloudflare.com/bgp-route-leak-venezuela/ > The newsletter suggests “BGP shenanigans” and posits that such a leak could be exploited to collect intelligence useful to government entities. > > While we can’t say with certainty what caused this route leak, our data suggests that its likely cause was more mundane.
holysoles 9mo ago
Fascinating find and investigation. While there isn't a solid conclusion from it, glad it was written up, perhaps someone will be able to connect more dots with it.
pamcake 9mo ago
Related: https://news.ycombinator.com/item?id=46499419 https://news.ycombinator.com/item?id=46499419
deleted 9mo ago
[deleted]
cheema33 9mo ago
If you were not already entirely reliant on American tech before, this ought to convince you to put jump in with both feet. What could possibly go wrong?
- lenerdenator 9mo ago
  It's pick-your-poison, really. Technology is notoriously expensive to develop and manufacture. One must either have native capacity (and thus, the wealth) to do so, or must get it from someone else. Other Western/US-aligned countries might have the ability to do so, albeit at geopolitical and economic cost, because the only thing you're likely to gain from kicking the US out of your tech stack and infrastructure is a tech stack and infrastructure free of the US. Meanwhile American companies will be developing new features and ways of doing things that add economic value. So at best, a wash economically. Maybe the geopolitical implications are enticing enough. Places like Venezuela? Nah. They'll be trading the ability of Americans to jack with their tech infrastructure for the ability of the PRC, Non-US Western nations, or Russia to jack with their tech stack. The geopolitics of technology are a lot like a $#1+ sandwich: the more bread you have, the less of someone else's $#1+ you have to eat.
- bawolff 9mo ago
  There is not really any reason to conclude that "american tech" was responsible for this attack. If anything, given all the sanctions Venezuela was under and how friendly they are with china, i would be surprised if they were using american tech in their infrastructure. [Of course i agree with the broader point of dont become dependent on the technology of your geopolitical enemies]
  - 7952 9mo ago
    There are other attack vectors beyond infrastructure though when the population all have Android Smart Phones running Play Services and communicate using WhatsApp.
    - A4ET8a8uTh0_v2 9mo ago
delichon 9mo ago
I assume that nuclear capability would rule out a target from this kind of snatch operation, and that this event will add pressure to proliferate.
- bawolff 9mo ago
  From bgp hijacking? Almost certainly not. It would probably rule out the type of decapitation strike the US did, but bgp hijacking is way way below on the escalation ladder.
  - JasonADrury 9mo ago
    Nuclear capability wouldn't necessarily rule out this kind of a decapitation strike, it's just that it's very hard to imagine this kind of an operation actually being successful in any nuclear-capable country. The US couldn't just fly a bunch of helicopters to Pyongyang or Tehran and do the same within 30 minutes. Most likely every single one of those helicopters would end up being shot down.
    - NoMoreNicksLeft 9mo ago
      >It's extremely difficult to believe that the US could fly a bunch of helicopters to Pyongyang or Tehran and do the same within 30 minutes. Would your answer change if China were somehow guaranteed to not intervene? Because I'm not sure the obstacle here is North Korean defenses, so much as Chinese intervention. Tehran? I think it'd go more or less like Caracas did.
      - JasonADrury 9mo ago
        >Would your answer change if China were somehow guaranteed to not intervene? Because I'm not sure the obstacle here is North Korean defenses, so much as Chinese intervention. No. The obstacle isn't Chinese intervention, the obstacle is that such an operation would have to be significantly larger and it would take longer. There would be much more air defense assets to suppress, and some of them would be impossible to effectively defeat. A helicopter assault on either of those cities would in the most optimistic scenario take hours of preparatory bombing, which would give a plenty of time for nuclear retaliation by North Korea. Both countries would also certainly have better safeguarding mechanisms for their heads of state, during that bombing they would be evacuated and now you'd probably be looking at the very least at a weeks-long operation. Assassination is a different thing, but I would suspect that for purely psychological reasons a rapid kidnapping operation like this would be far less likely to invite anything more than symbolic retaliation than a single targeted missile strike. This kind of operation would be far more confusing for the enemy than a simple assassination, and the window during which for example nuclear retaliation might make sense tends to be rather small. >Tehran? I think it'd go more or less like Caracas did. Tehran doesn't have a fancy air defense network, but it does have one. They'd have shot down every single helicopter. You don't even need fancy missiles, a bunch of .50cal machine guns will do the trick.
deleted 9mo ago
[deleted]
DiggyJohnson 9mo ago
Was the OSRS economy affected by the strikes? I'm assuming they didn't disrupt internet access for most Venezuelan citizens but I have not looked into it yet.
- d-moon 9mo ago
  Any osrs Venezuelan clans you’re looking to contact about this?
- manacit 9mo ago
  Yes, it looks like it definitely was: https://x.com/eslischn/status/1104542595806609408 https://x.com/eslischn/status/1104542595806609408
  - brendoelfrendo 9mo ago
    Unless I'm missing an update, it appears that this post is from 2019?
  - make3 9mo ago
    that's in 2019
- static_motion 9mo ago
  I'd say that an OSRS outage would be more likely to measurably affect the Venezuelan economy than the reverse.
- FumblingBear 9mo ago
  My clanmates and I noticed that some of the more popular goldfarming hotspots were much less populated that day. Rev caves, Zalcano, etc. Not sure about impacts for the broader economy though. Maybe FlippingOldSchool will release a video analyzing the economic trends over the course of that week? Would be interesting for sure.
  - giancarlostoro 9mo ago
    Maybe they were out celebrating.
deleted 9mo ago
[deleted]
throwaway0x9AF4 9mo ago
Symbolic link to the Cloudflare RPKI status for CANTV. [1]:https://radar.cloudflare.com/routing/as8048ref=loworbitsecurity.com https://radar.cloudflare.com/routing/as8048ref=loworbitsecur...
- notlisted 9mo ago
  missing a question mark https://radar.cloudflare.com/routing/as8048?ref=loworbitsecurity.com https://radar.cloudflare.com/routing/as8048?ref=loworbitsecu...
binome 9mo ago
This doesn't look like anything malicious, 8048 is just prepending these announcements to 52320.. If anything, it looks like 269832(MDS) had a couple hits to their tier 1 peers which caused these prepended announcements to become more visible to collectors.
narmiouh 9mo ago
I guess one of the interesting things I learnt off this article(1) was that 7% of DNS query types served by 1.1.1.1 are HTTPS and started wondering what HTTPS query type was as I had only heard of A, MX, AAAA, SPF etc... Apparently that is part of implementing ECH (Encrypted Client Hello) in TLS 1.3 where the DNS hosts the public key of the server to fully encrypt the server name in a HTTPS request. Since Nginx and other popular web servers don't yet support it, I suspect the 7% of requests are mostly Cloudflare itself. (1) https://radar.cloudflare.com/?ref=loworbitsecurity.com#dns-query-type https://radar.cloudflare.com/?ref=loworbitsecurity.com#dns-q...
- johnisgood 9mo ago
  Wait, so you do not leak the host through DNS with this? I have not checked it out yet.
  - SchemaLoad 9mo ago
    Encrypted DNS has existed for quite a while now through DNS over HTTPS, the missing link was that to connect to a website, you first had to send the server the hostname in plaintext to get the right public key for the site. So someone listening on the wire could not see your DNS requests but would effectively still get the site you connected to anyway. The new development (encrypted client hello) is you no longer have to send the hostname. So someone listening in the middle would only see you connected to an AWS/etc IP. This will make blocking websites very difficult if they use shared services like cloudflare or cloud VPS hosting.
    - deleted 9mo ago
      [deleted]
    - drnick1 9mo ago
      > blocking websites very difficult if they use shared services like cloudflare or cloud VPS hosting. I see this as a very good development and a big win for privacy. I have been running my own DNS server for years to prevent passive logging, but could basically do nothing against the SNI leak.
Aloisius 9mo ago
> When BGP traffic is being sent from point A to point B, it can be rerouted through a point C. If you control point C, even for a few hours, you can theoretically collect vast amounts of intelligence that would be very useful for government entities. The CANTV AS8048 being prepended to the AS path 10 times means there the traffic would not prioritize this route through AS8048, perhaps that was the goal? AS prepending is a relatively common method of traffic engineering to reduce traffic from a peer/provider. Looking at CANTV's (AS8048) announcements from outside that period shows they do this a lot. Since this was detected as a BGP route leak, it looks like CANTV (AS8048) propagated routes from Telecom Italia Sparkle (AS6762) to GlobeNet Cabos Sumarinos Columbia (AS52320). This could have simply been a misconfiguration. Nothing nefarious immediately jumps out to me here. I don't see any obvious attempts to hijack routes to Dayco Telecom (AS21980), which was the actual destination. The prepending would have made traffic less likely to transit over CANTV assuming there was any other route available. The prepending done by CANTV does make it slightly easier to hijack traffic destined to it (though not really to Dayco), but that just appears to be something they just normally do. This could be CANTV trying to force some users of GlobeNet to transit over them to Dayco I suppose, but leaving the prepending in would be an odd way of going about it. I suppose if you absolutely knew you were the shortest path length, there's no reason to remove the prepending, but a misconfiguration is usually the cause of these things.
- next_hopself 9mo ago
  CANTV (AS8048) is a correct upstream transit provider for Dayco (AS21980) as seen in both https://radar.cloudflare.com/routing/as21980#connectivity https://radar.cloudflare.com/routing/as21980#connectivity and https://bgp.tools/as/21980#upstreams https://bgp.tools/as/21980#upstreams What most likely happened, instead of a purposeful attempt to leak routes and MITM traffic, is CANTV had too loose of a routing export policy facing their upstream AS52320 neighbor, and accidentally redistributed the Dayco prefixes that they learned indirectly from Sparkle (AS6762) when the direct Dayco routes became unavailable to them. This is a pretty common mistake and would explain the leak events that were written about here.
  - itsamario 9mo ago
renewiltord 9mo ago
[flagged]
eqvinox 9mo ago
For a length-15 ASpath to show up on the internet, a whole bunch of better routes need to disappear first, which seems to have happened here. But that disappearance is very likely unrelated to CANTV. Furthermore, BGP routes can get "stuck", if some device doesn't handle a withdrawal correctly… this can lead to odd routes like the ones seen here. Especially combined with the long path length and disappearance of better routes.
maximgeorge 9mo ago
[dead]
a1o 9mo ago
I wonder if this can be monitored on a global scale as a sort of predictor of “something gonna happen at country X”.
fooker 9mo ago
There are BGP anomalies every day.
1970-01-01 9mo ago
I never understood the (now decade old) argument of 'parts of the Internet cannot be shut down' Clearly and empirically, BGP can shut off parts of the Internet, just as Trump wanted to do in 2015. https://finance.yahoo.com/news/dear-donald-trump-no-you-1322759672586294.html https://finance.yahoo.com/news/dear-donald-trump-no-you-1322...
SanjayMehta 9mo ago
The only anomaly was military. As far as I can tell, Venezuela's AD was shut down, or told to shut down. Didn't the US use Chinooks? They're supposed to be loud. And AD didn't take even one out. If Venezuela as corrupt as most socialist countries, I have no doubt that someone in his inner circle gave him up. Back in the days of our version of socialism we had Indian politicians selling out for $100K, leave alone $50M.
ianpenney 9mo ago
If the system eats its own analysts, the doctrine question becomes moot.
1zael 9mo ago
Solid OSINT methodology here. The 10x AS path prepending is the most interesting detail to me b/c typically you'd see prepending used to de-prioritize a route, which raises the question: was this about making traffic avoid CANTV, or was it a side effect of something else? A few thoughts: - The affected prefixes (200.74.224.0/20 block → Dayco Telecom) hosting banks and ISPs feels significant. If you're doing pre-kinetic intelligence gathering, knowing the exact network topology and traffic patterns of critical infrastructure would be valuable. Even a few hours of passive collection through a controlled transit point could map out dependencies you'd want to understand before cutting power. - What's also notable is the transit path through Sparkle, which the author points out doesn't implement RPKI filtering. That's not an accident if you're planning something (you'd specifically choose providers with weaker validation). - The article stops short of drawing conclusions, which is the right call. BGP anomalies are common enough that correlation ≠ causation. But the timing and the specific infrastructure affected make this worth deeper analysis. Would love to see someone with access to more complete BGP table dumps do a before/after comparison of routing stability for Venezuelan prefixes in that window.
- codefeenix 9mo ago
  really?
  - 1zael 9mo ago
    ?
KnuthIsGod 9mo ago
Time for every country at threat from the US to invest in their own independent nuclear arsenal....
VanTheBrand 9mo ago
Some pretty spooky comments in this thread from accounts with pretty low comment histories too…
- deleted 9mo ago
  [deleted]
bandrami 9mo ago
There are two things that it's very important normies never learn much about: BGP and fractional reserve banking
- jokoon 9mo ago
  [flagged]
  - dfsdfsdfddd 9mo ago
    [dead]
freakynit 9mo ago
.
- notachatbot123 9mo ago
  No thanks.
  - freakynit 9mo ago
    """ Balanced and civil engagement with occasional mild suggestions — mostly neutral and constructive. """
PythonPeak 9mo ago
[dead]
bdcp 9mo ago
ELI5 for people not familiar in this domain?
- _def 9mo ago
  From the article: When BGP traffic is being sent from point A to point B, it can be rerouted through a point C. If you control point C, even for a few hours, you can theoretically collect vast amounts of intelligence that would be very useful for government entities.
internet_points 9mo ago
[flagged]
neves 9mo ago
Does it mean that countries must not buy American telecom equipments? Snowden already revealed the intromission of the government in Cisco routers.
- wtcactus 9mo ago
  Only the ones run by dictators.
  - aprilthird2021 9mo ago
    Dictators the US doesn't support (so Sisi, MBS, MBZ, etc. are fine)
fusslo 9mo ago
Is there a term for the distance between an acronym's first use and its definition?
qwertydathug 9mo ago
https://isbgpsafeyet.com https://isbgpsafeyet.com
fobispo26 9mo ago
This is not unusual, CANTV has notoriously slow, expensive links, most ISPs in Venezuela would have it as a "backup" provider. If there is an outage of GlobeNet or TIM, it would cause those routes to disappear, leaving the CANTV routes up, which are heavily prepended to avoid routing through them on "normal" operations.

941 points by illithid0 9mo ago

Ms-J 9mo ago

Typical cyber warfare techniques.

lawlessone 9mo ago

Look for the same with Greenland or Canada next :/

agumonkey 9mo ago
the rest of the world is weirdly too passive, there's a smell of shock
- deleted 9mo ago
  [deleted]
- refulgentis 9mo ago
  IMHO the rest of the world isn't asleep. Denmark's prime minister said the same as you, for example. US just got roasted at UN by inter alia, France, with ~20 countries either speaking the same or asking to speak on it. That's just from 30s with front page of nytimes.com.
  - erxam 9mo ago
    That just sounds like more 'strongly worded letters' which never go anywhere and they never do anything about. It's over for the EU. They rested on their laurels for too long and cowardice rotted them from the inside. I don't think Denmark will put even a smidge of resistance up. Trump is going to bark some orders, boots are going to hit the ground and it's fait accompli.
    - refulgentis 9mo ago
      What does action (i.e. not-strongly-worded-letters, i.e. not words) look like? Capture Trump? Invade the US? The idea the EU is some bureaucratic hellhole incapable of anything is really odd and nigh-universal - I'm used to righties adopting it from Brexit & antipathy for social demoracy, but I'm not used to see it as a despondent wailing from people otherwise sympathetic to it. Note no one even mentioned the EU - it's so universal a reaction to "US is acting bad" that it came out of nowhere. Not to pick on you: when I was first replying, I also replied as if it was the EU! Had to go back and read the comment I was replying to and corrected myself before posting.
      - lysace 9mo ago
        Action probably looks like crash-starting multiple nuclear weapons programs. With or without the help of the british/french. Probably with. I'd imagine programs from: the Nordics and Poland+Baltics. Maybe Germany, probably not.
        refulgentis 9mo ago
        What happens when you start making nukes and the US doesn't want you to? Ssetting aside the whole non-proliferation thing, or expense (see NK), etc. Let's get serious, please.
        subw00f 9mo ago
        Why set aside expense? You do it anyway by whatever means necessary, like the DRPK. And if you’re a “western democracy” (also known as capitalist dictatorship) and you’re part of the ruling class, you still have the incentive to protect your assets, things you exploit in your country, land, natural resources, etc, that the US won’t be sharing or that they want to decrease supply when they take over through puppets or multinationals, and you can always force the public to pay for such a project, like all the times western peoples had to bail out or spend their taxes to benefit private corporations, but now it would look like it’s to protect sovereignty, which is a bonus of course, it would be to protect the local ruling class’s interests, but anyway. It’s clear the Americans will stop at nothing to acquire whatever it is they want, including indirectly violent means like ordering their financial institutions and tech giants to destroy whoever is on the way. The monster was always there since the Cold War and just now it dropped any pretenses.
  - pamcake 9mo ago
    In EU, so far I believe only the PM of Spain had the backbone to speak properly with anything that could be considered "strongly worded", proving that it's possible. The others have been variants of "Celebrating liberation of the Venezuelan people from the illegitimate dictator, a new dawn for democracy! (oh and everyone (not naming names) please behave and try to be mindful of international law and human rights from now on)" Not a single word about the dead, for one. While the NYTimes headline names France as critical, here's Macron (still only posting) on Twitter: https://xcancel.com/EmmanuelMacron/status/2007525386977194040 https://xcancel.com/EmmanuelMacron/status/200752538697719404... Meanwhile POTUS is over there talking literally and openly about how US are "going to run things" and motivating it with taking the oil and how they don't really care about democracy one way or other.
    - blell 9mo ago
      This has happened because the party that rules Spain has ties to the dictatorship. This goes so far that one of the ministers of the government met in Spain with Delcy Rodriguez, bringing her a few briefcases of something that hasn't been explained yet, despite her being subject to a travel ban in the EU. Of course this is a progressive government so the EU said absolutely nothing about it.
    - refulgentis 9mo ago
      It’s really dumb I’m sitting at -2 and the top reply is about a Macron tweet from 2 days ago, lying and saying no one else from Europe has said anything, and lying and saying anything besides the King of Spain was actually celebrating. You’re making stuff up. Full stop. You could easily have googled either thing I mentioned. You didn’t, choosing to free associate instead. May you reap what you sow.
  - benjiro 9mo ago
    Given that the nukes topic came up ... Will the US/Trump be so aggressive if Denmark has a few nukes that can hit the US? Or at minimum sink a invading fleet? These actions by Trump are only reinforcing that we will see even more of a push for everybody to get their own nukes, even in Europe. People do not need to yell "bad trump", to have his actions result in decisions being pushed forward like this. Theodore: "speak softly and carry a big stick"... and nuke(s) is a BIG stick.
- marcosdumay 9mo ago
  I don't think anybody cares any bit about Maduro.
  - agumonkey 9mo ago
    understandably, it's more about the acceleration in aggressiveness from Trump clan and the precedent of crossing the usual international red lines
    - marcosdumay 9mo ago
      Almost every country made some repudiation note. But I don't think we'll see anybody doing any actual thing because of that.
ceejayoz 9mo ago
Not sure why this got downvoted; we're threatening it again, credibly enough that the Danish PM is telling them to shut up. Yesterday: > Adding to the alarm, Katie Miller, a right-wing podcast host and the wife of Trump adviser Stephen Miller, posted an image of Greenland superimposed with the American flag and the caption "SOON!" https://www.nbcnews.com/world/greenland/trump-venezuela-attack-maduro-greenland-threats-denmark-europe-rcna252289 https://www.nbcnews.com/world/greenland/trump-venezuela-atta...
- Herring 9mo ago
  > Not sure why this got downvoted Fragile egos. Narcissists desperately need to feel good about themselves. They're caught in a cycle: feel worthless -> do bad things (feed the ego) -> feel worthless.
  - refulgentis 9mo ago
    It's not only downvoted, it was flagged, and dead. (flag accepted by moderator, no one else will see this comment thread without expanding) Mr. Trump good. Trump derangement syndrome bad. If Mr. Trump does what you say eventually, then it was good. (see rule #1) I see this frequently on HN since the re-election, won't speculate as to why: only way around the downvote is to criticize policy generically, untethered to time, with some sort of micro-focus like you're sharing new information about how things work, not discussing current events.
    - lawlessone 9mo ago
      Of course, because this site is control of Mark Eggman Andrreesen.
      - JumpCrisscross 9mo ago
        > this site is control of Mark Eggman Andrreesen You're mixing up your VCs?
    - uncletscollie 9mo ago
MaxHoppersGhost 9mo ago
Canada has a strong army and can defend itself. Greenland on the other hand is not well defended and I doubt Denmark really cares (e.g., if they’re willing to send tens of thousands of troops to die for it) if it was occupied by China or Russia in the event of a war. Greenland is a massive strategic liability for the US and Europe (although the EU still has its head in the sand they are starting to wake up some).
- OkayPhysicist 9mo ago
  Frankly, the right move (before Trump did as Trump does, and fucked up our foreign relations) would have been to straight-up buy Greenland. The people of Greenland have the right under Danish law to vote for independence, and there's not that many of them. Paying individual people for the votes probably would have cost the US $10 billion, and then we could give them Puerto Rico-esque status.

kachapopopow 9mo ago

I wonder what kind of capabilities the US army didn't use during this operation.

Thaxll 9mo ago
BGP is so unsecure that almost anyone can create chaos.
- ronsor 9mo ago
  Even by accident!
  - kachapopopow 9mo ago
    or even by normal load from someone deciding to split a /8 prefix into /24's
    - icedchai 9mo ago
      Most BGP peers have router filters in place. It's not 1996 anymore. I remember the days of logging into a Cisco connected to a Sprint T1 and seeing a coworker had fat fingered a spammer's route, sending it to null0. Oops. How did that happen?
      - doublerabbit 9mo ago
        I worked as a contractor for a IoT gig that sold sim cards services for buses, trains et cetera. The radio towers we used to access to obtain the accounting data (CDRs) all had the same very weak password.
      - mesrik 9mo ago
        Also RPKI has been available long time already. Considering the routing table size has been increasing and IPv6 need anyone shouldn't be running global routing with gear not supporting RPKI any more, the routing polices and announcing those RIR they operate. https://en.wikipedia.org/wiki/Resource_Public_Key_Infrastructure https://en.wikipedia.org/wiki/Resource_Public_Key_Infrastruc...

subzidion 9mo ago

There were reports they had considered Christmas Day and New Year's Day. I wonder if it was far enough along that you could see similar BGP anomalies around those times.

bakies 9mo ago
Not from the cloudflare dashboard, you can zoom out. The night of the attack doesnt even really stand out as abnormal when zooming out that far.
- floatrock 9mo ago
  So you're saying I can't set an alert for these conditions and use the timing to place a quick bet on the geopolitical polymarket du-jour? https://finance.yahoo.com/news/one-polymarket-user-made-more-164427975.html?guccounter=1 https://finance.yahoo.com/news/one-polymarket-user-made-more...
  - bakies 9mo ago
    Yeah, I was thinking it definitely needs to be correlated to geopolitical tensions in some way. Polymarket data might be helpful in this case- and provides incentives for putting this kind of data together.

mywittyname 9mo ago

What would be the result of this? I think it would route data through Sparkle as a way of potentially spying on internet traffic without having compromised the network equipment within Venezuela, but I'm not familiar enough with network architecture to really understand what happened.

7952 9mo ago
Maybe there would be some benefit in just dropping some packets. For example to WhatsApp, Telegram, Gmail servers. Could add a communication delay that could be critical and denies people a fairly reliable fallback communication method.
Aloisius 9mo ago
The effect of this would be traffic from GlobeNet destined for Dayco would transit over CANTV's network for a period. I'm not sure why the author singled out Telecom Italia Sparkle.

deleted 9mo ago

[deleted]

catigula 9mo ago

Cyber-warfare capabilities on this level seem pretty horrific. What if you could simply turn off the power grid of Kyiv or Moscow in anticipation of a strike? That seems extremely disorientating. What if you could simply turn off the power grid indefinitely?

ceejayoz 9mo ago
> What if you could simply turn off the power grid of Kyiv or Moscow in anticipation of a strike? I expect every major world power has a plan to (attempt to) do precisely that to their enemies. https://en.wikipedia.org/wiki/Graphite_bomb https://en.wikipedia.org/wiki/Graphite_bomb > The US Navy used sea-launched Tomahawk missiles with Kit-2 warheads, involving reels of carbon fibers, in Iraq as part of Operation Desert Storm during the Gulf War in 1991, where it disabled about 85% of the electricity supply. The US Air Force used the CBU-94, dropped by F-117 Nighthawks, during the NATO bombing of Yugoslavia on 2 May 1999, where it disabled more than 70% national grid electricity supply. I would not, however, take "Trump said something" as indicative of much. "It was dark, the lights of Caracas were largely turned off due to a certain expertise that we have, it was dark, and it was deadly" is both visibly untrue from the video evidence available, and is the precise sort of off-the-cuff low-fact statement he's prone to.
- catigula 9mo ago
  On the other hand, Trump has a track record of leaking capabilities.
- 9cb14c1ec0 9mo ago
  General Caine specifically said they utilized CYBERCOM (which is the US inter-branch hacking command) to pave the way for the special ops helicopters. I personally have no doubt that any (whether or not they all were) lights being out was due to a US hack. Some of the stuff that got blown up may well have been to prevent forensic recover of US tools and techniques.
  - ceejayoz 9mo ago

t0mas88 9mo ago

Alternative theory: Part of the operation caused power outages or disrupted some connections, the BGP anomalies were a result of that. The data would make that more likely, because deliberately adding a longer route doesn't achieve much. It's not usually going to get any traffic.

Someone1234 9mo ago
The BGP anomalies were 24-hours~ before the power outage, so I'm not sure I follow what you're arguing.
- t0mas88 9mo ago
  What I mean is that cause and effect here could be different then the author thinks. We see some route changes, but those changes make no sense on their own since they wouldn't capture any traffic. That makes it more probable that BGP was not the attack, but that some other action caused this BGP anomalie as a side effect. For example, maybe some misconfiguration caused these routes to be published because another route was lost. Which could very well be the actual cyber attack, or the effect of jamming, or breaking some undersea cable, or turning off the power to some place.
  - narmiouh 9mo ago
    I think what the other commenter is saying is that the BGP changes happened 12 hours before any of the power loss/bomb drop, so that eliminates your primary cause.
    - teiferer 9mo ago
      At that earlier time, some preparatory action was likely already on its way.
t0mas88 9mo ago
As a follow-up, Cloudflare came to the same conclusion: https://blog.cloudflare.com/bgp-route-leak-venezuela/ https://blog.cloudflare.com/bgp-route-leak-venezuela/ > The newsletter suggests “BGP shenanigans” and posits that such a leak could be exploited to collect intelligence useful to government entities. > > While we can’t say with certainty what caused this route leak, our data suggests that its likely cause was more mundane.

holysoles 9mo ago

Fascinating find and investigation. While there isn't a solid conclusion from it, glad it was written up, perhaps someone will be able to connect more dots with it.

pamcake 9mo ago

Related: https://news.ycombinator.com/item?id=46499419 https://news.ycombinator.com/item?id=46499419

deleted 9mo ago

[deleted]

cheema33 9mo ago

If you were not already entirely reliant on American tech before, this ought to convince you to put jump in with both feet. What could possibly go wrong?

lenerdenator 9mo ago
It's pick-your-poison, really. Technology is notoriously expensive to develop and manufacture. One must either have native capacity (and thus, the wealth) to do so, or must get it from someone else. Other Western/US-aligned countries might have the ability to do so, albeit at geopolitical and economic cost, because the only thing you're likely to gain from kicking the US out of your tech stack and infrastructure is a tech stack and infrastructure free of the US. Meanwhile American companies will be developing new features and ways of doing things that add economic value. So at best, a wash economically. Maybe the geopolitical implications are enticing enough. Places like Venezuela? Nah. They'll be trading the ability of Americans to jack with their tech infrastructure for the ability of the PRC, Non-US Western nations, or Russia to jack with their tech stack. The geopolitics of technology are a lot like a $#1+ sandwich: the more bread you have, the less of someone else's $#1+ you have to eat.
bawolff 9mo ago
There is not really any reason to conclude that "american tech" was responsible for this attack. If anything, given all the sanctions Venezuela was under and how friendly they are with china, i would be surprised if they were using american tech in their infrastructure. [Of course i agree with the broader point of dont become dependent on the technology of your geopolitical enemies]
- 7952 9mo ago
  There are other attack vectors beyond infrastructure though when the population all have Android Smart Phones running Play Services and communicate using WhatsApp.
  - A4ET8a8uTh0_v2 9mo ago

delichon 9mo ago

I assume that nuclear capability would rule out a target from this kind of snatch operation, and that this event will add pressure to proliferate.

bawolff 9mo ago
From bgp hijacking? Almost certainly not. It would probably rule out the type of decapitation strike the US did, but bgp hijacking is way way below on the escalation ladder.
- JasonADrury 9mo ago
  Nuclear capability wouldn't necessarily rule out this kind of a decapitation strike, it's just that it's very hard to imagine this kind of an operation actually being successful in any nuclear-capable country. The US couldn't just fly a bunch of helicopters to Pyongyang or Tehran and do the same within 30 minutes. Most likely every single one of those helicopters would end up being shot down.
  - NoMoreNicksLeft 9mo ago
    >It's extremely difficult to believe that the US could fly a bunch of helicopters to Pyongyang or Tehran and do the same within 30 minutes. Would your answer change if China were somehow guaranteed to not intervene? Because I'm not sure the obstacle here is North Korean defenses, so much as Chinese intervention. Tehran? I think it'd go more or less like Caracas did.
    - JasonADrury 9mo ago
      >Would your answer change if China were somehow guaranteed to not intervene? Because I'm not sure the obstacle here is North Korean defenses, so much as Chinese intervention. No. The obstacle isn't Chinese intervention, the obstacle is that such an operation would have to be significantly larger and it would take longer. There would be much more air defense assets to suppress, and some of them would be impossible to effectively defeat. A helicopter assault on either of those cities would in the most optimistic scenario take hours of preparatory bombing, which would give a plenty of time for nuclear retaliation by North Korea. Both countries would also certainly have better safeguarding mechanisms for their heads of state, during that bombing they would be evacuated and now you'd probably be looking at the very least at a weeks-long operation. Assassination is a different thing, but I would suspect that for purely psychological reasons a rapid kidnapping operation like this would be far less likely to invite anything more than symbolic retaliation than a single targeted missile strike. This kind of operation would be far more confusing for the enemy than a simple assassination, and the window during which for example nuclear retaliation might make sense tends to be rather small. >Tehran? I think it'd go more or less like Caracas did. Tehran doesn't have a fancy air defense network, but it does have one. They'd have shot down every single helicopter. You don't even need fancy missiles, a bunch of .50cal machine guns will do the trick.

deleted 9mo ago

[deleted]

DiggyJohnson 9mo ago

Was the OSRS economy affected by the strikes? I'm assuming they didn't disrupt internet access for most Venezuelan citizens but I have not looked into it yet.

d-moon 9mo ago
Any osrs Venezuelan clans you’re looking to contact about this?
manacit 9mo ago
Yes, it looks like it definitely was: https://x.com/eslischn/status/1104542595806609408 https://x.com/eslischn/status/1104542595806609408
- brendoelfrendo 9mo ago
  Unless I'm missing an update, it appears that this post is from 2019?
- make3 9mo ago
  that's in 2019
static_motion 9mo ago
I'd say that an OSRS outage would be more likely to measurably affect the Venezuelan economy than the reverse.
FumblingBear 9mo ago
My clanmates and I noticed that some of the more popular goldfarming hotspots were much less populated that day. Rev caves, Zalcano, etc. Not sure about impacts for the broader economy though. Maybe FlippingOldSchool will release a video analyzing the economic trends over the course of that week? Would be interesting for sure.
- giancarlostoro 9mo ago
  Maybe they were out celebrating.

deleted 9mo ago

[deleted]

throwaway0x9AF4 9mo ago

Symbolic link to the Cloudflare RPKI status for CANTV. [1]:https://radar.cloudflare.com/routing/as8048ref=loworbitsecurity.com https://radar.cloudflare.com/routing/as8048ref=loworbitsecur...

notlisted 9mo ago
missing a question mark https://radar.cloudflare.com/routing/as8048?ref=loworbitsecurity.com https://radar.cloudflare.com/routing/as8048?ref=loworbitsecu...

binome 9mo ago

This doesn't look like anything malicious, 8048 is just prepending these announcements to 52320.. If anything, it looks like 269832(MDS) had a couple hits to their tier 1 peers which caused these prepended announcements to become more visible to collectors.

narmiouh 9mo ago

I guess one of the interesting things I learnt off this article(1) was that 7% of DNS query types served by 1.1.1.1 are HTTPS and started wondering what HTTPS query type was as I had only heard of A, MX, AAAA, SPF etc... Apparently that is part of implementing ECH (Encrypted Client Hello) in TLS 1.3 where the DNS hosts the public key of the server to fully encrypt the server name in a HTTPS request. Since Nginx and other popular web servers don't yet support it, I suspect the 7% of requests are mostly Cloudflare itself. (1) https://radar.cloudflare.com/?ref=loworbitsecurity.com#dns-query-type https://radar.cloudflare.com/?ref=loworbitsecurity.com#dns-q...

johnisgood 9mo ago
Wait, so you do not leak the host through DNS with this? I have not checked it out yet.
- SchemaLoad 9mo ago
  Encrypted DNS has existed for quite a while now through DNS over HTTPS, the missing link was that to connect to a website, you first had to send the server the hostname in plaintext to get the right public key for the site. So someone listening on the wire could not see your DNS requests but would effectively still get the site you connected to anyway. The new development (encrypted client hello) is you no longer have to send the hostname. So someone listening in the middle would only see you connected to an AWS/etc IP. This will make blocking websites very difficult if they use shared services like cloudflare or cloud VPS hosting.
  - deleted 9mo ago
    [deleted]
  - drnick1 9mo ago
    > blocking websites very difficult if they use shared services like cloudflare or cloud VPS hosting. I see this as a very good development and a big win for privacy. I have been running my own DNS server for years to prevent passive logging, but could basically do nothing against the SNI leak.

Aloisius 9mo ago

> When BGP traffic is being sent from point A to point B, it can be rerouted through a point C. If you control point C, even for a few hours, you can theoretically collect vast amounts of intelligence that would be very useful for government entities. The CANTV AS8048 being prepended to the AS path 10 times means there the traffic would not prioritize this route through AS8048, perhaps that was the goal? AS prepending is a relatively common method of traffic engineering to reduce traffic from a peer/provider. Looking at CANTV's (AS8048) announcements from outside that period shows they do this a lot. Since this was detected as a BGP route leak, it looks like CANTV (AS8048) propagated routes from Telecom Italia Sparkle (AS6762) to GlobeNet Cabos Sumarinos Columbia (AS52320). This could have simply been a misconfiguration. Nothing nefarious immediately jumps out to me here. I don't see any obvious attempts to hijack routes to Dayco Telecom (AS21980), which was the actual destination. The prepending would have made traffic less likely to transit over CANTV assuming there was any other route available. The prepending done by CANTV does make it slightly easier to hijack traffic destined to it (though not really to Dayco), but that just appears to be something they just normally do. This could be CANTV trying to force some users of GlobeNet to transit over them to Dayco I suppose, but leaving the prepending in would be an odd way of going about it. I suppose if you absolutely knew you were the shortest path length, there's no reason to remove the prepending, but a misconfiguration is usually the cause of these things.

next_hopself 9mo ago
CANTV (AS8048) is a correct upstream transit provider for Dayco (AS21980) as seen in both https://radar.cloudflare.com/routing/as21980#connectivity https://radar.cloudflare.com/routing/as21980#connectivity and https://bgp.tools/as/21980#upstreams https://bgp.tools/as/21980#upstreams What most likely happened, instead of a purposeful attempt to leak routes and MITM traffic, is CANTV had too loose of a routing export policy facing their upstream AS52320 neighbor, and accidentally redistributed the Dayco prefixes that they learned indirectly from Sparkle (AS6762) when the direct Dayco routes became unavailable to them. This is a pretty common mistake and would explain the leak events that were written about here.
- itsamario 9mo ago

renewiltord 9mo ago

[flagged]

eqvinox 9mo ago

For a length-15 ASpath to show up on the internet, a whole bunch of better routes need to disappear first, which seems to have happened here. But that disappearance is very likely unrelated to CANTV. Furthermore, BGP routes can get "stuck", if some device doesn't handle a withdrawal correctly… this can lead to odd routes like the ones seen here. Especially combined with the long path length and disappearance of better routes.

maximgeorge 9mo ago

[dead]

a1o 9mo ago

I wonder if this can be monitored on a global scale as a sort of predictor of “something gonna happen at country X”.

fooker 9mo ago

There are BGP anomalies every day.

1970-01-01 9mo ago

I never understood the (now decade old) argument of 'parts of the Internet cannot be shut down' Clearly and empirically, BGP can shut off parts of the Internet, just as Trump wanted to do in 2015. https://finance.yahoo.com/news/dear-donald-trump-no-you-1322759672586294.html https://finance.yahoo.com/news/dear-donald-trump-no-you-1322...

SanjayMehta 9mo ago

The only anomaly was military. As far as I can tell, Venezuela's AD was shut down, or told to shut down. Didn't the US use Chinooks? They're supposed to be loud. And AD didn't take even one out. If Venezuela as corrupt as most socialist countries, I have no doubt that someone in his inner circle gave him up. Back in the days of our version of socialism we had Indian politicians selling out for $100K, leave alone $50M.

ianpenney 9mo ago

If the system eats its own analysts, the doctrine question becomes moot.

1zael 9mo ago

Solid OSINT methodology here. The 10x AS path prepending is the most interesting detail to me b/c typically you'd see prepending used to de-prioritize a route, which raises the question: was this about making traffic avoid CANTV, or was it a side effect of something else? A few thoughts: - The affected prefixes (200.74.224.0/20 block → Dayco Telecom) hosting banks and ISPs feels significant. If you're doing pre-kinetic intelligence gathering, knowing the exact network topology and traffic patterns of critical infrastructure would be valuable. Even a few hours of passive collection through a controlled transit point could map out dependencies you'd want to understand before cutting power. - What's also notable is the transit path through Sparkle, which the author points out doesn't implement RPKI filtering. That's not an accident if you're planning something (you'd specifically choose providers with weaker validation). - The article stops short of drawing conclusions, which is the right call. BGP anomalies are common enough that correlation ≠ causation. But the timing and the specific infrastructure affected make this worth deeper analysis. Would love to see someone with access to more complete BGP table dumps do a before/after comparison of routing stability for Venezuelan prefixes in that window.

codefeenix 9mo ago
really?
- 1zael 9mo ago
  ?

KnuthIsGod 9mo ago

Time for every country at threat from the US to invest in their own independent nuclear arsenal....

VanTheBrand 9mo ago

Some pretty spooky comments in this thread from accounts with pretty low comment histories too…

deleted 9mo ago
[deleted]

bandrami 9mo ago

There are two things that it's very important normies never learn much about: BGP and fractional reserve banking

jokoon 9mo ago
[flagged]
- dfsdfsdfddd 9mo ago
  [dead]

freakynit 9mo ago

notachatbot123 9mo ago
No thanks.
- freakynit 9mo ago
  """ Balanced and civil engagement with occasional mild suggestions — mostly neutral and constructive. """

PythonPeak 9mo ago

[dead]

bdcp 9mo ago

ELI5 for people not familiar in this domain?

_def 9mo ago
From the article: When BGP traffic is being sent from point A to point B, it can be rerouted through a point C. If you control point C, even for a few hours, you can theoretically collect vast amounts of intelligence that would be very useful for government entities.

internet_points 9mo ago

[flagged]

neves 9mo ago

Does it mean that countries must not buy American telecom equipments? Snowden already revealed the intromission of the government in Cisco routers.

wtcactus 9mo ago
Only the ones run by dictators.
- aprilthird2021 9mo ago
  Dictators the US doesn't support (so Sisi, MBS, MBZ, etc. are fine)

fusslo 9mo ago

Is there a term for the distance between an acronym's first use and its definition?

qwertydathug 9mo ago

https://isbgpsafeyet.com https://isbgpsafeyet.com

fobispo26 9mo ago

This is not unusual, CANTV has notoriously slow, expensive links, most ISPs in Venezuela would have it as a "backup" provider. If there is an outage of GlobeNet or TIM, it would cause those routes to disappear, leaving the CANTV routes up, which are heavily prepended to avoid routing through them on "normal" operations.