Someone Forced World Internet Traffic Through Belarus and Iceland

http://allthingsd.com/20131120/how-somebody-forced-the-worlds-internet-traffic-through-belarus-and-iceland/

by Anon84 • 13 years ago

140 68 13 years ago

mschuster912• 13 years ago

The autor is dead incompetent or outright stupid.

  In network security circles, this is what’s known as a Man-In-The-Middle attack. And for years it has been understood to be possible in theory, but never seen in practice.

Uh, no. What happened here was a BGP hijack, which has happened MULTIPLE times over the last few years. IIRC the one with the biggest fallout was some Pakistani ISP which fucked up a YouTube block order - they broadcasted the null-route to the entire Internet and Google couldn't do anything, lol.

And even "normal" MITM attacks have been done for years now. Every ISP doing censorship, BitTorrent throttling and anything that interrupts normal packet flow does active MITM attacking, and the NSA listening posts are passive MITM posts.

Saus• 13 years ago

  IIRC the one with the biggest fallout was some Pakistani ISP which fucked up a YouTube block order - they broadcasted the null-route to the entire Internet and Google couldn't do anything, lol.

I never heard the 'Pakistan shutting off Youtube globally'-story, so for those equally interested: http://www.renesys.com/wp-content/uploads/2013/05/nanog43-hi...

mschuster912• 13 years ago

See http://www.ripe.net/internet-coordination/news/industry-deve... for a source and some diagrams explaining the BGP routes. The accident occured back in 2008, and Wikipedia carries a list of successful, big BGP hijacks at http://en.wikipedia.org/wiki/IP_hijacking

tijs2• 13 years ago

I think you are not taking into account that he's writing this for a, what i would call, moderately technical audience. In a sense it -is- a man in the middle attack as someone seems to have tried to put himself between the internet user and the requested service. To explain it as such at least makes it easier to understand for 'normal' people even if it's not 100% correct which in this case for this audience is just not that relevant.

sp332• 13 years ago

A "man in the middle attack" is not about sniffing traffic going between two other people. It's about impersonating the two people to each other - telling Alice that you're Bob, and telling Bob that you're Alice.

Jgrubb• 13 years ago

With all due respect, one thing that gets really tiresome on this board is the "OMG, this person is soo stupid because they don't know nearly as much as I do about this one particular topic" tone in this comment. If you started your comment with "what happened here was..." you'd come across as knowledgable and helpful to those of us who aren't knowledgable in this field, rather than (please forgive my saying it) an asshole. Maybe try thinking "what if someone wrote this to/about me" before hitting Submit. Just trying to be helpful in my own way, pardon me if it's unwanted.

edit: my point had nothing to do with the content of the article. It was more just saying "hey, effective written communication is a tricky thing. Where the author of the article may have failed in some of the important technical details of the article, you have also failed in presenting your corrections in a somewhat offensive manner. Maybe consider the _how_ next time in addition to _what_ you are trying to convey."

bowlofpetunias• 13 years ago

I don't think anything excuses the media for being so shoddy in (mis)informing their readership.

Remember, you're on Hacker News. Thanks to people like the author, the average person thinks you and I are criminals. Because, hackers.

You may be right about omitting that tone in general, but considering the feelings of media hacks is not a big motivator.

jsmeaton• 13 years ago

Totally agree. For the most part, that article was quite good, even though some of the details were off. It's almost like disregarding the entire article for a spelling mistake.

It's good to point out the faults where the information is wrong - but relax on the tone.

fnordfnordfnord• 13 years ago

"And for years it has been understood to be possible in theory, but never seen in practice. "

The statement that follows is even worse. It's just outright wrong.

yaix• 13 years ago

I appreciate it when the top-voted comment tells me the bullshit level of the linked article, so I can decide if it is worth to actually click through. In this care it seems that it is not.

Jach2• 13 years ago

Why can't we be capable here of reading past the tone (whether monotone, "offensive", nagging, trying to sell us something, or whatever else)? If you're trying to get votes (or upvotes) then sure, worry about your tone. If you're trying to win friends and influence people, fine, worry about your tone. I know I've sometimes intentionally phrased things in different ways than I normally would to head off certain snarky remarks (whether that snark is a "don't be offensive!" comment or a "hey that's just your opinion, man" comment or something else unhelpfully meta), but it's very nice not to have to worry about such things in general.

InclinedPlane• 13 years ago

I'm going to say that the comment's tone was justified. The article makes strong allegations that aren't backed up by the facts. The onus is on the author to provide evidence and to understand the topic at a sufficient level to make their allegations meaningful.

If someone writes an article claiming someone is a murderer and they use DNA evidence to back their story, except they have no idea how DNA evidence even works or what DNA even is and, more so, the evidence does not actually back up their claims, well, that person is deserving of ridicule. It's not those who do the ridiculing who have breached the wall of propriety, it is the author who has done so.

The same is the case here. If you want people to treat your mistakes kindly, if you want to be treated with propriety and respect, then you need to be fucking circumspect about the allegations you lay down and you need to have an understanding of the lines of evidence you purport to bring to bear.

smoyer• 13 years ago

If this was the mainstream media, I'd agree but this article was put out by a supposedly technical journal. We DO expect more from them. And why would a detail-oriented group of hackers expect less?

SEJeff• 13 years ago

Also the author shouldn't rule out Halon's razor[1]. Advertising the wrong AS is often caused by incompetence or mistakes of network engineers. Note that I'm not a network engineer (I'm a linux monkey by trade), but know you can do BGP AS path filtering[2] ala ACLs to prevent a rogue/incompetent entity from advertising routes that dont' belong to them. If more ISPs would simply lock down their routing infrastructure a bit more, a lot of these types of attacks would be rendered mostly void.

[1] http://en.wikipedia.org/wiki/Hanlon's_razor

[2] https://ftp.apnic.net/meetings/22/docs/tut-routing-pres-bgp-...

kordless• 13 years ago

As pointed out by others, your tone suggests dismissal of the article. The article is interesting and informative and as an old network admin I took little issue with them using the term man-in-the-middle. Further, Wikipedia's definition seems to support using the term the way the author does:

a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker.

In the article, the connection is being controlled by the attacker after breaking into and controlling an innocent ISP's BGP advertisements. The attacker also provide a means to route the data back out another connection as well, which implies something was sitting in the middle of the connection grabbing and redirecting data to another connection that hadn't had it's BGP tables altered. (If it hadn't, the data would have just gone in a loop at the ISP.)

In the other cases of BGP 'hijacking', the data simply disappeared because it wasn't routed back out to the Internets. If someone null routed Gmail, well, it won't work because I wouldn't get any data back to run the browser view. In this case, the data made it back to where it was going, which implies the conversation is being controlled by the attacker.

I'm ignoring your last point as it seems a bit off topic. Censorship and subversive BGP activities have little to do with each other.

kens• 13 years ago

The researchers who analyzed this attack call it a "Man-In-the-Middle (MITM) hijack", which makes this whole subthread kind of pointless since the journalist is just using the terminology of the original research.

Check out the researchers' article for tracerout data and other interesting details: http://www.renesys.com/2013/11/mitm-internet-hijacking/

And if you're interested in how the internet works at this level (BGP, peering, ISPs), the book "Tubes: A Journey to the Center of the Internet" is interesting reading.

the_watcher3• 13 years ago

Tubes was available for free on Amazon a few weeks ago and I picked it up. I'm looking forward to reading it.

Angostura• 13 years ago

Thankyou, I was for someone who had actually bothered to read the original paper to make this point.

ahupp• 13 years ago

Their description is entirely accurate, which makes your insults doubly inappropriate.

diminoten• 13 years ago

Not his fault, his sources[0] call it an MitM attack, too.

Furthermore, he goes on to explain that this was a BGP hijack, and even mentions the Pakistani incident you just brought up.

[0] http://www.renesys.com/2013/11/mitm-internet-hijacking/

mgraczyk• 13 years ago

I think the above quote says more about the intended audience of the piece than it says about the author. That is actually the exact line where I stopped reading. However, I didn't stop myself thinking, "Man what an idiot this author is," but rather, "Ooops I accidentally started reading an article about something I do professionally, but intended for a layman audience."

Obviously this is an entertainment piece, not a technical write up. If you think the content isn't right for you then read something else.

ancarda• 13 years ago

Cowie said the really big Internet service providers ... should be watching for when smaller players advertise false routes.

How can an ISP tell if a route is "false"?

hrkristian• 13 years ago

Tracing packages would do it, a false route would be longer as is explained in the article, where a package from Mexico suddenly -instead of just being sent north- is crossing the Atlantic and the length of Europe twice over, to get to D.C.

Unless I am missing something?

tomp• 13 years ago

By knowing what IP ranges the smaller ISPs own. If a small A connects to bit B, and B knows that A has IPs 123.234.., then it should not accepts routes that route other IPs to A.

perlgeek2• 13 years ago

It's not that simple, an ISP that has multiple peering partners doesn't just accept traffic for its own IPs, but also for those of its peering partners (and their peering partners, recursively).

gcb1• 13 years ago

and it knows A has those ips by...

brown9-2• 13 years ago

The map could be where Renesys's "vantage points" are.

jauer• 13 years ago

Check routes recieved from downstream customers against routing registries and such. https://en.wikipedia.org/wiki/RPSL and http://www.irr.net/docs/list.html

ColinWright• 13 years ago

Is the report over here more useful?

https://news.ycombinator.com/item?id=6774263

junto• 13 years ago

Content wise yes. Font size no. Font is so small it is almost unreadable.

Take-away: To improve time spent on site, and return visitors computing.co.uk should increase the font size!

That just reminded me of an (urban) story where a man went to Fairy Liquid and offered to increase their profits by 25%. He wanted 5% of the 25% increase. They signed contracts and agreed to the deal. The simple solution was to make the hole 25% bigger. The customers squeezed just the same and 25% more came out. Profit.

mattkevan• 13 years ago

I heard a similar story about Listerine. A canny marketing manager boosted sales by realising everyone used the cap to measure doses. He made the cap bigger.

chollida1• 13 years ago

FYI your link is dead.

quarterto• 13 years ago

Interestingly, the two UK cities marked on the map appear to be Bristol or Cardiff, and... somewhere in the middle of nowhere in Cumbria? Why not London, Manchester, Birmingham etc.?

nmc• 13 years ago

Same weird placement effect on French cities: one seems to be Rennes, the other Limoges or Poitiers...

DanBC• 13 years ago

ZOMG!!! GCHQ have sites in Scarborough and Harrogate, Yorkshire!!!

The stars are big and so I guess it's just very rough placement.

perlgeek2• 13 years ago

I don't really understand how that works. After all I don't think a normal Internet can hijack BGP, they need to be able to announce routes. So if an ISP announces low-cost routes, you know who did it -- unless the ISP's security was breached quite severely.

So, can't you just asked the ISPs who announced those fake routes if they were hacked, and if not, demand an explanation? (And if no explanation comes forth, stop peering with them)

FedRegister• 13 years ago

Or implement BGP advertisements based on prefix so you can filter out bullshit advertisements from bozos.

nathanm412• 13 years ago

A much more competent article written by the researchers themselves explained that they did contact the Iceland ISP involved in one of the attacks. Their reply stated that it was caused by a bug in a vendor's software that was resolved after a patch. The ISP wasn't interested in looking into it any further.

http://www.renesys.com/2013/11/mitm-internet-hijacking/

notacoward• 13 years ago

Also interestingly, somebody tried to submit that article yesterday. I know because I tried to submit it myself, and found that I'd been scooped. It got no responses and almost no upvotes, until allthingsd added the "MITM" keyword that people here recognize. It might be inaccurate - the attack seems to enable MITM rather than being MITM itself - but it got some much needed publicity for the story.

MichaelGG• 13 years ago

If an ISP is involved in a major hijacking like this, and doesn't sufficiently explain their actions -- shouldn't ISPs start refusing to accept routes from their AS? Just like browsers drop CAs that mess up, shouldn't the same happen to ISPs?

ChuckMcM• 13 years ago

It will be interesting to see how this rolls around. I have listened to people complain about the insecurity of BGP for years. Got to experience a bit of it when a bad router update our ASIN in it and sent our traffic out and about briefly (fortunately just pushing up latency not killing the web site.)

It is currently the most effective and useless DDOS strategy to push a black hole route out for the 'target.' Effective since all their packets will stop getting to them, useless because it points exactly at the point where it is coming from, and NOCs have gotten reasonably good at working around bogus advertisements. So it is short lived.

Someone Forced World Internet Traffic Through Belarus and Iceland

Related Stories