Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Possible BGP hijack of 1.1.1.1

bgpstream.com

Post reply on HN
Print view View original

11–20 of 158 posts

Re: Possible BGP hijack of 1.1.1.1

#12

Post by polpo »

highace wrote: post #2

What does this mean for those unfamiliar?

Cloudflare operates a public DNS server on 1.1.1.1 that has gotten a lot of attention since it was launched a few months ago. If a bad actor hijacks it, they can answer DNS queries with malicious answers, similar to the Amazon Route53 hijack that was used to redirect an Etherium wallet site to a fake server: https://www.internetsociety.org/blog/2018/04/amazons-route-5...

Re: Possible BGP hijack of 1.1.1.1

#15

Post by wmoses »

highace wrote: post #2

What does this mean for those unfamiliar?

In other words, some entity that is not cloudflare claimed to have the best route to (some of?) cloudflare's IP ranges, including 1.1.1.1.

If malicious, this could be someone trying to redirect 1.1.1.1 traffic elsewhere.

There have also been a lot of historical examples of misconfiguring BGP (the way big internet networks talk to each other and discuss where to send packets), such as a florida ISP accidentally claiming the best route to some major internet service and getting flooded with everyone's traffic until it died.

BGP is also really insecure (back in 2008 pakistan effectively brought down youtube for instance through BGP -- which doesnt require any authentication to claim you have the best route to X).

Re: Possible BGP hijack of 1.1.1.1

#16

Post by ddtaylor »

polpo wrote: post #12
highace wrote: post #2

What does this mean for those unfamiliar?

Cloudflare operates a public DNS server on 1.1.1.1 that has gotten a lot of attention since it was launched a few months ago. If a bad actor hijacks it, they can answer DNS queries with malicious answers, similar to the Amazon Route53 hijack that was used to redirect an Etherium wallet site to a fake server: https://www.internetsociety.org/blog/2018/04/amazons-route-5...

They could also simply log all the information and have made the server appeared to continue to operate as normal, since most fooling with the DNS packets would yield certificate errors for many sites (Google, YouTube, etc.) Most of the time someone comes out and says the BGP hijacking was an accident.

A bit of a Hanlon's razor situation.

Re: Possible BGP hijack of 1.1.1.1

#17

Post by HankB99 »

bonyt wrote: post #4
highace wrote: post #2

What does this mean for those unfamiliar?

Traffic meant to go to 1.1.1.1 (cloudflare DNS) could be routed elsewhere. Since this is a common DNS server, this could be used to alter domain resolution for people that use it.

I'm assuming this would/could be done by a malicious party in order to substitute different IP addresses for some sites in an attempt to direct traffic for nefarious purposes.

If my host is configured to use DNSSEC would that prevent sites from resolving?

If DNSSEC is not employed and a connection is directed to a malicious site (using https) wouldn't that prevent the connection?

(I'm afraid I'm out of my depth on the implications of this aspect of networking and wondering about the security implications for me since I'm using Cloudflare DNS servers.)

Re: Possible BGP hijack of 1.1.1.1

#18

Post by ancarda »

jpollock wrote: post #3
highace wrote: post #2

What does this mean for those unfamiliar?

If true it means that Cloudflare's DNS server can't be trusted.

Do you mean it can't ever be trusted? Or just right now? BGP hijacking isn't that difficult to pull off.

I hope you're not trusting 8.8.8.8 either: https://twitter.com/bgpmon/status/445266642616868864

Post reply on HN