BGP hijacking

Minimalist · Dec 18, 2017

Last week a suspicious event routed traffic for major tech companies (i.e. Google, Facebook, Apple, and Microsoft) through a previously unknown Russian Internet provider. The event occurred on Wednesday, researchers who investigated it believe the traffic was intentionally hijacked.

The incident involved the Internet’s Border Gateway Protocol that is used to route traffic among Internet backbones, ISPs, and other large networks.
Click to expand...

https://securityaffairs.co/wordpress/66838/hacking/bgp-hijacking-russia.html

hawki · Apr 25, 2018

"Amazon Cloud Services IP Addresses Hijacked

Amazon lost control of 1,300+ Amazon Cloud Services IP address for two hours yesterday, when hackers used a Border Gateway Protocol (BGP)-hijacking to reroute traffic to rogue destinations.

The incident hijacked addresses belonging to Route 53, Amazon’s domain name system service, Internet Intelligence said on Twitter.
Those responsible used the hijack to steal $17 million in ETH alt-coins from online cryptocurrency website MyEtherWallet.com.

Amazon officials said: 'Neither AWS nor Amazon Route 53 were hacked or compromised. An upstream Internet Service Provider (ISP) was compromised by a malicious actor who then used that provider to announce a subset of Route 53 IP addresses to other networks with whom this ISP was peered. These peered networks, unaware of this issue, accepted these announcements and incorrectly directed a small percentage of traffic for a single customer’s domain to the malicious copy of that domain.'..."

https://www.cbronline.com/news/amazon-cloud-ip

guest · Jul 10, 2018

Shutting down the BGP Hijack Factory
July 10, 2018
https://dyn.com/blog/shutting-down-the-bgp-hijack-factory/

It started with a lengthy email to the NANOG mailing list on 25 June 2018: independent security researcher Ronald Guilmette detailed the suspicious routing activities of a company called Bitcanal, whom he referred to as a “Hijack Factory.” In his post, Ronald detailed some of the Portuguese company’s most recent BGP hijacks and asked the question: why Bitcanal’s transit providers continue to carry its BGP hijacked routes on to the global internet?

This email kicked off a discussion that led to a concerted effort to kick this bad actor, who has hijacked with impunity for many years, off the internet.
Transit Providers
When presented with the most recent evidence of hijacks, transit providers GTT and Cogent, to their credit, immediately disconnected Bitcanal as a customer. With the loss of international transit, Bitcanal briefly reconnected via Belgian telecom BICS before being disconnected once they were informed of their new customer’s reputation. [...]
Click to expand...

guest · Aug 1, 2018

Hey, don't route the messenger! Telegram redirected through Iran by baffling BGP leak
August 01, 2018
https://www.theregister.co.uk/2018/08/01/bgp_route_leak_telegram_iran/

Updated A bunch of Telegram messages went the long way round on Monday: a BGP leak sent people's Telegram chat communications via systems in Iran.

Essentially, ten Telegram route prefixes, among more than 100 prefixes, were run through networks in Iran rather than, well, where they normally go. Most of the other routes were owned by Iranian networks.

However, speculation that this redirection was deliberate stems from Iran's well-known hostility to Telegram: the rerouting therefore could either be an attempt to eavesdrop on the encrypted chats by intercepting packets, or block users of the software in the county by black-holing them – assuming the switch-a-roo was deliberate.

The ancient BGP route distribution protocol has long been criticized for being too easy for the careless or malicious to pipe internet traffic where it shouldn't go. [...] Better security for BGP was on the agenda at July's IETF 102 meeting – Geoff Huston summarises the discussions at length here
Click to expand...

guest · Aug 6, 2018

U.S. Payment Processing Services Targeted by BGP Hijacking Attacks
August 06, 2018
https://www.bleepingcomputer.com/ne...g-services-targeted-by-bgp-hijacking-attacks/

According to a new report, three United States payment processing companies were targeted by BGP hijacking attacks on their DNS servers. These Internet routing attacks were designed to redirect traffic directed at the payment processors to servers controlled by malicious actors who would then attempt to steal the data.

Oracle thinks this may be just the beginning of these types of attacks.

"If previous hijacks were shots across the bow, these incidents show the Internet infrastructure is now taking direct hits," Oracle's research stated. "Unfortunately, there is no reason not to expect to see more of these types of attacks against the Internet."
Click to expand...

guest · Sep 5, 2018

NIST Releases Draft on BGP Security
Paper describes a technique to protect the Internet from Border Gateway Protocol route hijacking attacks.
September 5, 2018
https://www.darkreading.com/perimeter/nist-releases-draft-on-bgp-security/d/d-id/1332740

A new draft publication from the NIST National Cybersecurity Center of Excellence (NCCoE) takes aim at security concerns about the Border Gateway Protocol (BGP), the default routing protocol to route traffic among Internet domains. The paper, "Protecting the Integrity of Internet Routing: Border Gateway Protocol (BGP) Route Origin Validation," is open for public comment until Oct. 15.

Draft SP 1800-14 was developed in cooperation with AT&T, CenturyLink, Cisco, Comcast, Juniper, Palo Alto Networks, and The George Washington University. [...]
Rather than describing new technology, the paper describes " ... how networks can protect BGP routes from vulnerability to route hijacks by using available security protocols, products, and tools to perform BGP ROV to reduce route hijacking threats," according to NIST.

Read here and here for more details.
Click to expand...

guest · Oct 27, 2018

China systematically hijacks internet traffic: researchers
October 26, 2018
https://www.itnews.com.au/news/china-systematically-hijacks-internet-traffic-researchers-514537

Researchers have mapped out a series of internet traffic hijacks and redirections that they say are part of large espionage and intellectual property theft effort by China.

The researchers, Chris Demchak of the United States Naval War College and Yuval Shavitt of the Tel Aviv University in Israel, say in their paper that state-owned China Telecom hijacked and diverted internet traffic going to or passing through the US and Canada to China on a regular basis.

Tel Aviv University researchers built a route tracing system that monitors BGP announcements and which picks up on patterns suggesting accidental or deliberate hijacks and discovered multiple attacks by China Telecom over the past few years.
Click to expand...

Paper: "China’s Maxim – Leave No Access Point Unexploited: The Hidden Story of China Telecom’s BGP Hijacking" (PDF): https://scholarcommons.usf.edu/cgi/viewcontent.cgi?article=1050&context=mca

guest · Nov 13, 2018

Google Services Inaccessible Due to BGP Leak
November 13, 2018
https://www.securityweek.com/google-services-inaccessible-due-bgp-leak

The Border Gateway Protocol (BGP) controls the route of data across the Internet. BGP hijacking (route hijacking) and BGP leaks occur when IP address groups are intentionally or accidentally taken over by corrupting the routing tables that store the path to a network.

“This incident at a minimum caused a massive denial of service to G Suite and Google Search. However, this also put valuable Google traffic in the hands of ISPs in countries with a long history of Internet surveillance,” ThousandEyes said in a blog post.

The company said it was unclear if this was a malicious attack or the result of a misconfiguration at the Nigerian ISP, but highlighted that the incident demonstrates no one is immune from BGP hijacks and leaks.
"[...] We will conduct an internal investigation of this issue and make appropriate improvements to our systems to help prevent or minimize future recurrence,” Google told users on its Cloud Platform status page.
Click to expand...

ronjor · Nov 13, 2018

'Ugly' mistake sends Google data to China

Google data for search and cloud services went astray for more than an hour on Monday thanks to an "ugly" mistake by an African ISP.
Click to expand...

ronjor · Dec 21, 2018

How 3ve’s BGP hijackers eluded the Internet—and made $29M

Dan Goodin - 12/21/2018
Over the past decade, many attackers have exploited design weaknesses in the Internet’s global routing system. Most commonly, the Border Gateway Protocol (BGP) is abused to divert gigabytes, or possibly even petabytes, of high-value traffic to ISPs inside Russia or China, sometimes for years at a time, so that the data can be analyzed or manipulated. Other times, attackers have used BGP hijackings more surgically to achieve specific aims, such as stealing cryptocurrency or regaining control of computers monitored in a police investigation.
Click to expand...

Minimalist · Dec 30, 2018

Open-source tool aims to curb BGP hijacking amid Chinese espionage concerns

BGP security is going global.

International agencies including the U.S. Department of Homeland Security, the National Science Foundation, the European Research Council and others are funding the Automatic and Real-Time dEtection and Mitigation System (ARTEMIS), in an effort to stop hackers from rerouting internet traffic through malicious networks.
Click to expand...

https://www.cyberscoop.com/open-sou...gp-hijacking-amid-chinese-espionage-concerns/

Minimalist · Jan 25, 2019

Internet experiment goes wrong, takes down a bunch of Linux routers

Earlier this month, an academic experiment studying the impact of newly released security features for the Border Gateway Protocol (BGP) went horribly wrong and crashed a bunch of Linux-based internet routers.

The experiment, organized by academics from all over the world, was first announced last year in mid-December and was described as "an experiment to evaluate alternatives for speeding up adoption of BGP route origin validation."
Click to expand...

https://www.zdnet.com/article/internet-experiment-goes-wrong-takes-down-a-bunch-of-linux-routers/

Minimalist · Feb 18, 2019

Criminals, Nation-States Keep Hijacking BGP and DNS

The internet is composed of a series of networks built on trust. Unfortunately, that trust can be abused due to weaknesses in older protocols, such as Border Gateway Protocol and the Domain Name System, which were never designed with security in mind.
Click to expand...

https://www.databreachtoday.com/criminals-nation-states-keep-hijacking-bgp-dns-a-12028

guest · Mar 3, 2019

Eliminating opportunities for traffic hijacking
March 1, 2019
https://habr.com/en/company/qrator/blog/442264/

And that’s just the beginning — in the era of state-sponsored cyber actors, it is evident that the keystone of Border Gateway Protocol, which is trust, is no longer sufficient enough to prevent malicious outbreaks of routing incidents, deliberate or not, to occur.

You should think, that due to such an enormous potential of collateral damage to such a vital part of modern life businesses should be scared to death and take all the measures they could to prevent such events in the first place. Well, this sounds too good to be true IRL.
ASPA approach
Our answer is the hacker approach — ASPA, where current tools are used to fight the most severe problems in the world of BGP routing.

The Autonomous System Path Authorization improvement to the BGP protocol that our engineers are working on, in collaboration with others, could efficiently and, more importantly, quickly solve the global hijacks issue.
Click to expand...

guest · Jun 7, 2019

For two hours, a large chunk of European mobile traffic was rerouted through China
It was China Telecom, again. The same ISP accused last year of "hijacking the vital internet backbone of western countries."
June 7, 2019
https://www.zdnet.com/article/for-t...an-mobile-traffic-was-rerouted-through-china/

For more than two hours on Thursday, June 6, a large chunk of European mobile traffic was rerouted through the infrastructure of China Telecom, China's third-largest telco and internet service provider (ISP).
The incident occurred because of a BGP route leak at Swiss data center colocation company Safe Host, which accidentally leaked over 70,000 routes from its internal routing table to the Chinese ISP.
MOBILE OPERATORS IN FRANCE, HOLLAND, SWITZERLAND AFFECTED
"Some of the most impacted European networks included Swisscom (AS3303) of Switzerland, KPN (AS1130) of Holland, and Bouygues Telecom (AS5410) and Numericable-SFR (AS21502) of France," said Doug Madory, Director of Oracle's Internet Analysis division (formerly Dyn).
CHINA TELECOM, AGAIN!
"Two hours is a long time for a routing leak of this magnitude to stay in circulation, degrading global communications."
But if any other ISP would have caused this incident, it would have likely been ignored.
Click to expand...

guest · Jun 18, 2019

Cloudflare aims to make HTTPS certificates safe from BGP hijacking attacks
Free service prevents BGP hijackers from fraudulently obtaining browser-trusted certs
June 18, 2019
https://arstechnica.com/information...certificates-safe-from-bgp-hijacking-attacks/

Content delivery network Cloudflare is introducing a free service designed to make it harder for browser-trusted HTTPS certificates to fall into the hands of bad guys who exploit Internet weaknesses at the time the certificates are issued.

The attacks were described in a paper published last year titled Bamboozling Certificate Authorities with BGP. In it, researchers from Princeton University warned that attackers could manipulate the Internet’s border gateway protocol to obtain certificates for domains the attackers had no control over.
Reining it in
Cloudflare, with more than 175 datacenters worldwide, is unveiling a new service called multipath domain control validation that’s designed to exploit this limitation of BGP hijacking. As its name suggests, it performs the validation process from multiple origins that follow different Internet paths to the domain. Unless the results from multiple queries are identical, the validation will fail.
Click to expand...

Minimalist · Jun 30, 2019

The Infrastructure Mess Causing Countless Internet Outages

The web is distributed, but it's also interconnected. It needs to be so that data can move around worldwide without all being controlled by a single entity. So every time you load a website or send an email, BGP is the system responsible for optimizing the route that data takes across these sprawling, intertwined networks. And when it goes wrong, the whole internet feels it.
Click to expand...

https://www.wired.com/story/bgp-route-leak-internet-outage/

guest · Oct 9, 2019

MIT CSAIL’s AI detects possible IP address hijacking
October 8, 2019
https://venturebeat.com/2019/10/08/mit-csails-ai-detects-possible-ip-address-hijacking/

Border gateway protocol (BGP), a routing protocol used to transfer data and information between different host gateways, is fundamental to the internet’s design. Unfortunately, it’s flawed in two respects: It lacks route authentication and basic origin validation.

That’s why researchers at MIT’s Computer Science and Artificial Intelligence Lab recently conducted a study of BGP activity over the course of five years, with the goal of identifying the dominant characteristics of hijackers and how they differ from legitimate systems.
The work informed a set of metrics to which the team applied an AI algorithm to evaluate their accuracy in identifying hijackers’ patterns.

“Our preliminary results suggest that [certain] patterns can be leveraged in automated applications, potentially revealing undetected behavior or generating a novel category of reputation scores,” wrote the coauthors of the paper detailing the research.
Click to expand...

Testart and colleagues will present the paper at the ACM Internet Measurement Conference in Amsterdam later this month. A dataset containing the list of suspicious networks flagged by the algorithm is publicly available on GitHub.
Click to expand...

guest · Apr 5, 2020

Russian telco hijacks internet traffic for Google, AWS, Cloudflare, and others
April 5, 2020
https://www.zdnet.com/article/russi...traffic-for-google-aws-cloudflare-and-others/

Earlier this week, traffic meant for more than 200 of the world's largest content delivery networks (CDNs) and cloud hosting providers was suspiciously redirected through Rostelecom, Russia's state-owned telecommunications provider.

Impacted companies are a who's who in the cloud and CDN market, including big names such as Google, Amazon, Facebook, Akamai, Cloudflare, GoDaddy, Digital Ocean, Joyent, LeaseWeb, Hetzner, and Linode.

[For a full list of victim networks, see this filtered Twitter stream.]
The incident is a classic "BGP hijack."
Click to expand...

ROSTELECOM, A REPEAT OFFENDER
Experts have pointed out many times in the past that not all BGP hijacks are malicious.
But, as many internet experts have also pointed out in the past, it is possible to make an intentional BGP hijack appear as an accident, and nobody could tell the difference.

While not involved in BGP hijacks as common as China Telecom, Rostelecom (AS12389) is also behind many similarly suspicious incidents.
Click to expand...

Minimalist · Apr 17, 2020

You Can Now Check If Your ISP Uses Basic Security Measures

“Is BGP Safe Yet” is a new site that names and shames internet service providers who don't tend to their routing.
Click to expand...

https://www.wired.com/story/cloudflare-bgp-routing-safe-yet/

Minimalist · Jun 11, 2020

IBM Cloud global outage caused by "incorrect" BGP routing

On June 9th, 2020, IBM Cloud data centers suffered a global outage that caused connectivity issues for many of the web sites and platforms utilizing the service, including BleepingComputer.
Click to expand...

https://www.bleepingcomputer.com/ne...lobal-outage-caused-by-incorrect-bgp-routing/

Log in or Sign up

BGP hijacking

Minimalist Registered Member

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Log in or Sign up

BGP hijacking

Minimalist Registered Member

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Useful Searches