I'm using AnchNet's services.
And We've asked AnchNet when I recieved a e-mail from our BGPMon.
They said their staff was configured a wrong config on router.
Also they don't know 1.1.1.0/24 is used by CloudFlare&APNIC.
So they used this prefix to test.
Possible BGP hijack of 1.1.1.1
41–50 of 158 posts
Re: Possible BGP hijack of 1.1.1.1
#42Would this affect certificate-validating clients doing DNS-over-HTTPS to 1.1.1.1 — doesn’t it have an ipAddress certificate and demand HTTPS resolution only?
For dnscrypt-proxy, definitely not.
In addition to a signature of the parent cert, the DNS stamp for Cloudflare DNS says that validation must be done against dns.cloudflare.com so this would require getting a certificate for cloudflare.com.
Re: Possible BGP hijack of 1.1.1.1
#43What does this mean for those unfamiliar?
1.1.1.1 is a DNS resolver that does not track activity. A BGP compromise means that someone could have compromised it and redirect/intercept traffic of those trusting it to be Cloudflare.
A BGP attack does not compromise the destination host. It reroutes (some) traffic destined for the host. Any traffic using TLS to establish destination authenticity (e.g DNS TLS, DNS over HTTP) or content authenticity (e.g. DNSSEC) would detect the attack, while other types of traffic (traditional DNS) could be exploited.
Re: Possible BGP hijack of 1.1.1.1
#44[deleted]
Re: Possible BGP hijack of 1.1.1.1
#45Earlier quoted context omitted.
Is the BGP hijack over?
As a data point - your site still isn't loading for me. IP : 79.69.113.214 Time: Tue May 29 15:28:30 BST 2018
I wonder if it is a resolution issue or an access issue.
What happens when you go to: http://62.129.133.242/ ? That should come up with a 'domain for sale' page, that's the same server.
Re: Possible BGP hijack of 1.1.1.1
#46Network engineer here: I'm going to guess that this is a mistaken effort on the part of a Chinese ISP or the GFW to hijack traffic to 1.1.1.1 internally within China, but probably not intended to propagate beyond the major Chinese international-transit-ISP's connections to the global Internet. BCP38 is your friend.
Re: Possible BGP hijack of 1.1.1.1
#47What does this mean for those unfamiliar?
Significantly simplified:
BGP4, which is one of the fundamental building blocks of the global Internet, relies on trust between BGP peers. ISP A says to ISP B, their peer, "hey I'm responsible for this chunk of publicly routable IP space, please send all traffic to ASN number N for this particular block".
This works as long as everyone configures their IP space announcements and prefix-list filters correctly.
A lot of less clueful ISPs in the world do not verify the IP space announced to them by their peers (BCP38 is your friend!). This results in things like the time that a telecom in Pakistan hijacked the IP space for most of Youtube about ten years ago and successfully DDoSed themselves, while also causing a major youtube outage.
https://www.google.com/search?q=pakistan+bgp+hijack+youtube&...
This will keep happening until various ISP peers properly implement prefix-list filtering, ACLs on their edge BGP connections, and verifying peer announcements via things like various route registries.
Re: Possible BGP hijack of 1.1.1.1
#48How effective is this? Looking at https://bgp.he.net/ip/1.1.1.1 , 1.1.1.0/24 is apparently "ROA Signed and Valid". I don't know a lot about BGP. Does this mean hijacking this subnet is a bit harder than unsigned ones because some or all ISPs verify this announcement? Or is it faster/easier to detect? Maybe a wider question: is there some way to prevent BGP hijacking?
RADb or some other RIR database registration is what my company requires. This wont really stop bad actors, however.
Re: Possible BGP hijack of 1.1.1.1
#49Earlier quoted context omitted.
As a data point - your site still isn't loading for me. IP : 79.69.113.214 Time: Tue May 29 15:28:30 BST 2018
I wonder if it is a resolution issue or an access issue. What happens when you go to: http://62.129.133.242/ ? That should come up with a 'domain for sale' page, that's the same server.
Not loading for me from MA, USA.
$ httpstat http://62.129.133.242/
2018/05/29 10:54:04 unable to connect to host 62.129.133.242:80: dial tcp 62.129.133.242:80: connect: connection timed outRe: Possible BGP hijack of 1.1.1.1
#50How effective is this? Looking at https://bgp.he.net/ip/1.1.1.1 , 1.1.1.0/24 is apparently "ROA Signed and Valid". I don't know a lot about BGP. Does this mean hijacking this subnet is a bit harder than unsigned ones because some or all ISPs verify this announcement? Or is it faster/easier to detect? Maybe a wider question: is there some way to prevent BGP hijacking?
Basically, the bigger Chinese ISPs that are upstream of this small one which is making the false 1.1.1.0/24 announcement are not actually verifying that this small ISP is allowed to announce the space.
As for prevention, the only thing that will work is proper use of IRR/route registries and RPKI validation of peer announcements. Which a great many ISPs do not currently do.
https://www.noction.com/blog/bgp-hijacking
The other method is more blunt, and can be more effective if the people with 'enable' on various ASNs' core and edge routers actually have a spine. ISPs which repeatedly announce space that they're not allocated (as per RIPE, ARIN, APNIC, AFRINIC records) should be depeered by their local peers, and their owners/operators publicly shamed. It's a reputation thing. As a neighbor of other, more clueful ISPs, it's basically the same thing as being a bad neighbor by leaving garbage all over your front lawn and causing a public nuisance with loud parties and trashy behavior.