Does anyone else find it sort of beautiful watching replays of events like this? It's amazing to watch how the routers organise themselves, making and breaking connections when needed.
I mean, this is what BGP does.
Possible BGP hijack of 1.1.1.1
101–110 of 158 posts
Re: Possible BGP hijack of 1.1.1.1
#102Earlier quoted context omitted.
Why let people access BGP that don't even know that 1.0.0.0/8 or 1.1.1.0/24 are part of the public internet or that decide they can use random prefixes to "test" things? :-/
To be fair 1.1.1.1 had been unassigned/non-routable up until April.
It was assigned to APNIC in 2010 http://seclists.org/nanog/2010/Jan/776
Re: Possible BGP hijack of 1.1.1.1
#103Earlier quoted context omitted.
I'm assuming this would/could be done by a malicious party in order to substitute different IP addresses for some sites in an attempt to direct traffic for nefarious purposes. If my host is configured to use DNSSEC would that prevent sites from resolving? If DNSSEC is not employed and a connection is directed to a malicious site (using https) wouldn't that prevent the connection? (I'm afraid I'm out of my depth on th…
For DNSSEC: it depends, I don’t think many clients hardfail yet. For HTTPS: if you can BGP attack, theoretically you could get a TLS certificate issued. There’s a lot of ifs on both those roads, though.
Probably a good use case to pin the certificates for your upstream DNS resolvers if you're using DNS over TLS/HTTPS.
Re: Possible BGP hijack of 1.1.1.1
#104Earlier quoted context omitted.
Why let people access BGP that don't even know that 1.0.0.0/8 or 1.1.1.0/24 are part of the public internet or that decide they can use random prefixes to "test" things? :-/
To be fair 1.1.1.1 had been unassigned/non-routable up until April.
To be fair, unallocated or unassigned IP space isn't fair game to use for testing outside of an air gapped lab. I've never in my career thought it would be a good idea to "test" unallocated public unicast address space on my edge routers.
Re: Possible BGP hijack of 1.1.1.1
#105Re: Possible BGP hijack of 1.1.1.1
#106Re: Possible BGP hijack of 1.1.1.1
#107Does anyone else find it sort of beautiful watching replays of events like this? It's amazing to watch how the routers organise themselves, making and breaking connections when needed.
yes, what JS library does that graph drawing and animation? Or a similar one?
Looks like they are using https://bgplayjs.com/ for that graph.
Re: Possible BGP hijack of 1.1.1.1
#108Earlier quoted context omitted.
For DNSSEC: it depends, I don’t think many clients hardfail yet. For HTTPS: if you can BGP attack, theoretically you could get a TLS certificate issued. There’s a lot of ifs on both those roads, though.
Probably a good use case to pin the certificates for your upstream DNS resolvers if you're using DNS over TLS/HTTPS.
Yeah. As of right now there’s no absolutely fool proof way to ensure all clients aren’t possibly going to slip through some crack, and I’m not sure if we’ll ever get there.
Re: Possible BGP hijack of 1.1.1.1
#109Earlier quoted context omitted.
Usually upstream ISP providing transit accepts only a valid set of prefixes that they have agreed to advertise on the public internet from an ISP customer, they enforce a policy on the ingress to make this happen. Idea being, if the customer ISP ends up advertising an incorrect prefix, then the impact is only localised to his ISP and not to the whole world. But some ISPs don't follow this and implicitly trust the cus…
>Usually If only... BCP 38[0] is nowhere near usual. Lots of networks, including some very problematic big ones ( cough Hurricane Electric cough ), do not implement it as a matter of course. The AWS Route53 hijack last month which resulted in downtime for a number of sites plus a six figure coin theft[1] could have been prevented by adequate filtering. 0: https://tools.ietf.org/html/bcp38 1: https://arstechnica.com/i…
Could one argue for tort/negligence against the ISP who should have filtered, but didn't, if one's coins were stolen through that?
Or even possibly the same, but in criminal court?