3 ms·

For those that want to know what happened, quoting someone from the obscured comment thread on that page: "AS286 provides IP Transit to AS25459. What happened

For those that want to know what happened, quoting someone from the obscured comment thread on that page: "AS286 provides IP Transit to AS25459. What happened is that both AS286 and AS25459 did not have proper filtering in place. AS286 leaked AS25459's blackhole routes to it's peers, and a handful accepted those more specifics. This lasted a few minutes before they realized what was going on and a fix was put into place."

shubb 13y ago
So are you saying that there was no deliberate hijack, but rather AS25459 was configured not to carry traffic to those IPs, and it's blackholes got propagated?
- cbhl 13y ago
  I think the author is merely worried about how much of BGP relies on operators trusting each other to configure their networks properly. All it takes is one typo somewhere to bring down the internet for half of America. Granted, seeing how slowly IPsec and DNSSEC are being adopted, I think the author is fighting an uphill battle.
  - toomuchtodo 13y ago
    Certificate pinning in mobile apps goes a long way to preventing a leak of secure data. Sure, you can't get to your service while the hijack is occurring, but you don't have to worry you just submitted your login and password info to a hijacked/malicious IP block. Better to fail closed in this case. Disclaimer: I use PNC Bank, who was part of this hijack.
    - peterwwillis 13y ago
      What does this have to do with certificates and mobile data? Hijacking an IP is the same as a man-in-the-middle, which PKI prevents without needing to "pin" a cert. You have to first control a trusted CA before you can do real MITM, and if you have that, it's much more effective to simply MITM the existing route and not expose yourself by changing BGP routes all over the place. (Also, a mobile app bundled with a cert "pinned" for that app is effectively just public-key cryptography, so you don't even need to use the global PKI infrastructure at that point)
  - deleted 13y ago
    [deleted]

shubb 13y ago

So are you saying that there was no deliberate hijack, but rather AS25459 was configured not to carry traffic to those IPs, and it's blackholes got propagated?

cbhl 13y ago
I think the author is merely worried about how much of BGP relies on operators trusting each other to configure their networks properly. All it takes is one typo somewhere to bring down the internet for half of America. Granted, seeing how slowly IPsec and DNSSEC are being adopted, I think the author is fighting an uphill battle.
- toomuchtodo 13y ago
  Certificate pinning in mobile apps goes a long way to preventing a leak of secure data. Sure, you can't get to your service while the hijack is occurring, but you don't have to worry you just submitted your login and password info to a hijacked/malicious IP block. Better to fail closed in this case. Disclaimer: I use PNC Bank, who was part of this hijack.
  - peterwwillis 13y ago
    What does this have to do with certificates and mobile data? Hijacking an IP is the same as a man-in-the-middle, which PKI prevents without needing to "pin" a cert. You have to first control a trusted CA before you can do real MITM, and if you have that, it's much more effective to simply MITM the existing route and not expose yourself by changing BGP routes all over the place. (Also, a mobile app bundled with a cert "pinned" for that app is effectively just public-key cryptography, so you don't even need to use the global PKI infrastructure at that point)
- deleted 13y ago
  [deleted]