Hacking Team and a case of BGP hijacking

http://blog.bofh.it/id_456

by rolux • 11 years ago

171 30 11 years ago

blog.bofh.it

diafygi• 11 years ago

For those who are curious, 46.166.163.0/24 (the hijacked IPs) belong to balticservers.com, which is based out of Lithuania[1].

http://wikiscan.org/plage-ip/46.166.163.0/24?submenu=whois

Laforet2• 11 years ago

Interesting choice, I don't recall many malware C&C servers hosted in Lithuania

toyg• 11 years ago

The Italian "Special Branch" were hosting a "legal" cnc with a security-oriented ISP there -- not really classic malware.

rudolf0• 11 years ago

This is pretty crazy. I wonder how the route hijack didn't get noticed by anyone at the time, though? Or at least if someone did notice, they didn't make a fuss about it.

gr0wln1n2• 11 years ago

That frightended me a little to.. It seems like these things can fly by if operators don't fuck up on a major scale like recently with Malaysia(?).

spydum• 11 years ago

as long as they continue to route traffic out to the real destination.. who would notice latency jump from 50ms to say.. 120ms? I don't know if they did this, but you could absolutely be covert about this, and be nearly transparent to the victim.

gr0wln1n2• 11 years ago

Can somebody explain how they got the police to help them?

"You remember the RAT we sold you? Yea... That's broken because ... Help us or people might notice." If that's it.. Wow. This whole story gets more fishy by the minute.

rurban• 11 years ago

Exactly, how can the police order an ISP to commit a crime? Why did the ISP committed the crime? Hopefully both will be charged now.

The only one thing I trust here is the independence of the Italian prosecution system.

curiousjorge• 11 years ago

I'm not surprised, in Italy the Mafia blew up or assassinated prosecutors and lawyers threatening them. In countries where the government is not the law, anything can happen with the right sized envelops of cash.

Laforet2• 11 years ago

So they hijacked an entire C block because they hard coded IP addresses into their wares. Wonderful.

acaloiar2• 11 years ago

As someone who works in technology, but has only a cursory understanding of BGP, I find BGP's trust mechanism flabbergasting. Would anyone like to explain why it remains the preferred protocol and what improvements are in the works to mitigate the effect of these sort of hijacks?

seiji2• 11 years ago

Would anyone like to explain why it remains the preferred protocol

Legacy.

BGP is a policy mechanism and sometimes the policies are either misconfigured or we can't trust hostile actors with access to wide open Internet (e.g. backwards countries null routing all of YouTube because censorship and it propagates outwards instead of inwards).

In most cases, if you are talking BGP to your ISP, your ISP filters your BGP traffic to only allow specific routes you can claim ownership of to be updated. Normally, non-infrastructure-level villains can't do bad BGP things if they have responsible upstream ISPs doing filtering correctly (kill you on flapping, kill routes you shouldn't be originating, etc). But, as we've seen with ISPs not even verifying UDP source address spoofing that allows you to generate multi-hundred-gigabit DDoS attacks, many ISPs are still run by morons.

BGP is also the magic behind anycast since you can intentionally duplicate any routes with no oversight (besides any upstream filtering in place).

what improvements are in the works

Good luck upgrading every embedded peering router in the world?

noja• 11 years ago

This sounds like open SMTP relays all over again, and then came automated open relay testing and blacklisting.

Is there a project like that for BGP?

toast0• 11 years ago

AFAIK, there is no alternate routing protocol in wide use to switch to. The problem isn't actually with the protocol, which seems to be a reasonable way to advertise routes.

The problem is how do you know which routes you should trust. Most ISPs should have a reasonable idea of what netblocks most of their customers should be advertising and should be filtering there; but between large ISPs, I don't think there's a reasonable way to determine if you should trust a given advertisement for a small block. The owner could have gotten alternate transit, or sold the block, or many other things.

pyvpx• 11 years ago

it works, and the alternatives are far too costly from an opex/HR perspective.

tptacek• 11 years ago

BGP is a mess, but the real problem is the underlying policy. No matter how good the routing protocol is, it's going to be hamstrung by the complexity of who's supposed to announce for what, and how often that changes.

acaloiar2• 11 years ago

It seems that the policy angle is being addressed in lieu of a technical solution. FTA: http://www.routingmanifesto.org/

EthanHeilman• 11 years ago

What improvements are in the works to mitigate the effect of these sort of hijacks?

I happen to have published research in this area[0]. There are two systems being developed to secure BGP.

The first is the RPKI which aims to provide a Public Key Infrastructure to attest to the origination of IP addresses. To grossly oversimplify it: everyone would get a certificate that says "AS X is allowed to originate IP prefix Y". Many routers already support the RPKI[1] and the RPKI is currently undergoing deployment[2], but it should take some time before operators begin using it to make routing decisions. Once used the RPKI offers substantial security benefits[3].

The second protocol is BGPSEC which is designed secure routing paths. It will use the RPKI as its foundation.

[0] https://www.cs.bu.edu/~goldbe/papers/sigRPKI.pdf

[1] http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp...

[2] http://rpki-monitor.antd.nist.gov/

[3] http://arxiv.org/pdf/1307.2690v1.pdf

nly• 11 years ago

And presumably the only organisation issuing the certs will be the organisation issuing IP space, right? RIGHT?... Guys?

nitinics• 11 years ago

BGP's transitive trust mechanism involves 2 parties. The router making an "announcement" or "withdrawal" and the router "accepting" or "origin validating" these. If one of the party announces a false/hijacked route to its upstreams it could have an adverse effect to the entire Internet routing table.

BGP itself, is a path vector protocol (came from standard and vetted Graph Theory algorithms) and therefore for the scalability of the Internet Prefixes - works perfectly with many network devices talking the standard protocol.

Work has always been done within the IETF wg on BGP attributes that the protocol carries for many use-cases and so far BGP has been the preferable choice for many networks, both within an AS and outside an AS(Autonomous System).

You wouldn't want the Internet be controlled by a central authority, that is an absolute NO - at the same time - you have to work together to make sure the "global routing table" or the "default free zone" is not polluted with unnecessary updates and churn and overseeing misbehavior from other ASes.

I believe with so many disparate organizations and networks around the world - we could not have built a common talking "language"/"protocol" without having accountability into it and constantly monitoring it.

acd• 11 years ago

You can take over other providers IP space by announcing their IPs via BGP from well connected high ranked tier ISPs, but just because you can do one thing does not mean you should exercise it.

Internet was built on the premise that you can trust other organisations such as good willed universites, it was not built for a landscape of internet crime and state sponsored hackers.

BGP and central certificate authorities is flawed in princicple and this sense. Its very easy to create fake certificates for big organisations if you have the power of a state.

Diginotar is such an Epic fail of CA which shows exactly why you cannot trust central trust when there is state hackers at work.

So you either hijack BGP, DNS or Central certificate authority then you steal peoples cookies. Since most does not use two factor authentication that is enough to take ownership of their email accounts. Once the email accounts is compromised all other accounts can be compromised through password resets.

cft• 11 years ago

I do not undertsand this. We recently had to change our announcement to upstream ISPs from/23 to /22 and our ISPs verified with ARIN that the entire /22 belonged to us, before changing their filters. Also, there's RADb database.

pki• 11 years ago

your isps were competent maybe

spamlord2• 11 years ago

I used to work at a spam company and we did this and similar techniques.

One similar technique was we basically created our own fake ISPs, disguised as rural wireless Internet providers. Paid yearly ARIN fees, had or own /20 blocks of IP space allocated, etc. We specifically requested ip filtering completely removed from our peering connection with major upstream/backbone ISPs. They did so without question. This allowed us to source route any IP out to the Internet. Then, we would purchase large blocks of IPs (a couple of /20s a month) from Romania and Argentina. We would create GRE tunnels over to RO and route them back to the US. It's been years since I was involved so my memory of the technical details is hazy now...

lawnchair_larry• 11 years ago

Did anyone ever notice?

vultour• 11 years ago

Everyone should just blackhole any traffic to and from the Aruba ISP. They have failed to maintain the trust relationship needed at high-tier ISPs and should no longer be operational.

based2• 11 years ago

http://www.bortzmeyer.org/bgp-malaisie.html

Hacking Team and a case of BGP hijacking

Related Stories