3 ms·
Wow. Not sure why they don't name-and-shame the ISP, but that's really ridiculous.
by scott_karana 12y ago
Wow. Not sure why they don't name-and-shame the ISP, but that's really ridiculous.
- sergers 12y agoAs a Canadian, using a Canadian ISP, I would like to know as well. Not entirely surprised regarding rogue employee possibility.
- dfox 12y agoThere are two things at play here: attacker has to have access to one ISP to inject the route (eg. rogue employee) and there has to be another ISP that accepts such route from BGP (I would say that filtering weirdly specific routes is good and common practice). When you have access to ISP network you don't have to inject things into BGP to attack your own customers.
- devicenull 12y agoA /24 is not a 'weirdly specific route'. I agree, that the upstream should have been filtering things, but you can't expect them to just filter out all the /24's. For example, Google DNS anycast would stop working: http://bgp.he.net/net/8.8.8.0/24 http://bgp.he.net/net/8.8.8.0/24 as would basically anyone else doing anycast.
- tacoman 12y ago"the CTU research team provided the BGP evidence to the upstream ISP closest to the origin of the malicious activity." I think this likely means it's a smaller ISP.
- tbarbugli 12y agoJack Bauer will take good care of this issue
- deleted 12y ago[deleted]
- devicenull 12y agoNANOG post from this morning has the AS path: http://mailman.nanog.org/pipermail/nanog/2014-August/069131.html http://mailman.nanog.org/pipermail/nanog/2014-August/069131.... I'm unsure exactly which was originating the route.