Possible BGP hijack

by v4n4d1s • 11 years ago

95 20 11 years ago

aroch• 11 years ago

OMZ Global (AS34329) is an industrial process company (eg steel, manufacturing, ship building, etc). I'm going to assume someone who shouldn't have had access to BGP is trying to use it to block GoogleDNS or similar inside the corporation.

That or some pretty hilariously heavy-handed state-sponsored hijacking.

jameskilton• 11 years ago

OMZ is also Russian, so state-sponsored isn't out of the running.

ryanlol4• 11 years ago

How is OMZ being Russian relevant to it possibly being state-sponsored?

Also, it's really not a major challenge to take over someone elses equipment to do this.

Laforet• 11 years ago

IIRC the only commonly access service hosted in that IP block is their DNS servers. There are easier ways to hijack DNS traffic than trying to hijack the entire prefix via BGP.

A casual browse through the other entries seems to suggest that people mess up BGP announcements all the time. My favourite one below involves the AS belonging to S & S Discount Market Pvt Ltd.

https://bgpstream.com/event/18050

Edit: It has happened previously

http://www.bgpmon.net/googles-services-redirected-to-romania...

nmjohn2• 11 years ago

A casual browse through the other entries seems to suggest that people mess up BGP announcements all the time.

While true, incorrect bgp announcements happen all the time, I think this is one of the cases that Hanlon's Razor probably does not apply: most of the time they are not a result of people messing up - rather the bad announcements come from spammers/malware spreaders needing new IP space because their current (likely hijacked) IP space has gotten blacklisted and is no longer effective.

atemerev• 11 years ago

It is Russian, and it delivers reactor containments and other heavy machinery for nuclear industry and military.

ryanlol4• 11 years ago

and military

Do they still? Couldn't find anything post-1940s supporting that.

ancarda• 11 years ago

I'd be willing to bet this is the case; this only covers 8.8.8.0 to 8.8.8.255 so not 8.8.4.4 so it wouldn't be that effective at blocking Google DNS; only 1 IP would be blocked.

swiley• 11 years ago

Some people don't use both.

bartbes• 11 years ago

Why would they be blocking it? Google promotes 8.8.8.8 as the primary dns server, and, as far as I know, as long as it keeps answering, clients won't fall back to the secondary 8.8.4.4.

joantune2• 11 years ago

* Edited: Disregard this comment *

Ok, so if OMZ is Russian, do know this:

Russia currently is 'blocking' several websites. I.e. blocking at a DNS level, so this might be half witted attempt on keeping the censorship..

And as @swiley noted: some people only use the easier to remember 8.8.8.8 (I do that for instance)

ryanlol4• 11 years ago

Unlikely.

Especially since that's not really how Roskomnadzors blocking works.

joantune2• 11 years ago

Yes, you're right, I thought it was like here, in Portugal, but they actually block IP addresses and/or use deep packet inspection to do it, as far as I researched now.

I know it's not as sophisticated as the blocking in China, and a comment on reddit on a thread that I read yesterday (https://www.reddit.com/r/europe/comments/41s7z8/the_first_no...), made me think that it used DNS only. Nevermind

ycmbntrthrwaway• 11 years ago

Roskomnadzor "works" by publishing a list of IP addresses and domain names for ISPs to download. A copy of it is leaked to http://reestr.rublacklist.net/ in real time. Each ISP implements blocking in its own way: DNS blocking, transparent Squid proxy, firewalls or nothing at all sometimes. Nobody really cares if something is actually blocked. BGP hijacking for the purpose of blocking websites is really unlikely at this point.

nmjohn2• 11 years ago

Heads up this happened a few days ago, not currently hijacked.

Handy tool though, bookmarked it - using the event graph to display route changes as detected over time is a great visualization - would be really cool if there was the same event graph covering the entire internet (though I suspect without some cleverness in both design and implementation, the quantity of data would be prohibitively large for building a useful visualization).

philip1209• 11 years ago

There's a corresponding twitter feed:

https://twitter.com/bgpstream

ra1n85• 11 years ago

Am I reading this right that leak lasted 2 hours?

These are often the result of mistakes. Even if OMZ were a tier 1 provider in RU, the impact would still be limited - I can't see how this could be intentional.

zdw• 11 years ago

The BGPlay visualization on that page appears to be open sourced: https://github.com/MaxCam/BGPlay

mpitt• 11 years ago

BGPStream [1] and RIPEstat[2], indicate that they also briefly announced prefix 87.23.14.0/24, belonging to a major Italian telco.

[1] https://bgpstream.com/event/17606

[2] https://stat.ripe.net/widget/announced-prefixes#w.resource=A...

Possible BGP hijack

Related Stories