Possible BGP hijack of 1.1.1.1 • Hacker News Board

Re: Possible BGP hijack of 1.1.1.1

#121

Post by amaccuish » Tue, May 29, 2018, 6:29 PM UTC

moviuro wrote: post #31

amaccuish wrote: post #20

And that is why I'm using dns over tls :)

Not enough. You have to check the certificate's fingerprint, along with its validity. TLS is not a silver bullet. If an attacker controls the host behind what everyone believes to be 1.1.1.1, nothing is to prevent them from applying for a legit certificate.

I don't enforce pinning but I do enforce checking the TLS hostname. I assume that's good enough what with certificate transparency, 100% works against a passive attack anyway?

I looked into pinning but the big services warn against it as they could change their certs at anytime, which is fair enough.

They'd have to convince a large enough percentage of the internet to accept their routes. Automated DNS services like letsencrypt make sure to take measurements from many places around the world to prevent things like this right?

Re: Possible BGP hijack of 1.1.1.1

#122

Post by amaccuish » Tue, May 29, 2018, 6:32 PM UTC

peterwwillis wrote: post #94

tialaramex wrote: post #84

Earlier quoted context omitted.

Nothing prevents them from applying but... * They need to do that, and get the resulting certificate, and install it, during the attack. The weirder the product (and certificates for IP addresses are relatively weird) the more humans end up involved in your order, and humans are slow. * This leaves a smoking gun in the Certificate Transparency logs. So we all get to know (in maximum 24 hours but usually the reality w…

1) would take about 20 seconds, thanks to Let's Encrypt, but probably only marginally more time for some other CA with an API. 2) Who exactly is staring at CT logs and going "oh, I don't remember this domain using this CA, maybe I should investigate this" ? Sure there's a record of it. Doesn't really matter during an attack, because public attacks like this aren't intended to last long. All you need is a half hour or…

Ok ye the CA system isn't great, but as far as I'm aware, letsencrypt do DNS queries from multiple POPs, so that the route would have to propagate extremely widely to convince them to issue a cert.

Re: Possible BGP hijack of 1.1.1.1

#123

Post by stingraycharles » Tue, May 29, 2018, 6:40 PM UTC

namibj wrote: post #109

dice wrote: post #86

Earlier quoted context omitted.

>Usually If only... BCP 38[0] is nowhere near usual. Lots of networks, including some very problematic big ones ( cough Hurricane Electric cough ), do not implement it as a matter of course. The AWS Route53 hijack last month which resulted in downtime for a number of sites plus a six figure coin theft[1] could have been prevented by adequate filtering. 0: https://tools.ietf.org/html/bcp38 1: https://arstechnica.com/i…

Could one argue for tort/negligence against the ISP who should have filtered, but didn't, if one's coins were stolen through that? Or even possibly the same, but in criminal court?

Just as with the discussion about hackable routers yesterday, there are no laws for this.

Re: Possible BGP hijack of 1.1.1.1

#124

Post by MattSteelblade » Tue, May 29, 2018, 6:41 PM UTC

charonn0 wrote: post #106

MattSteelblade wrote: post #102

Earlier quoted context omitted.

It was assigned to APNIC in 2010 http://seclists.org/nanog/2010/Jan/776

Allocated, not assigned.

APNIC used that terminology in their analysis paper of 1.0.0.0/8, "1.0.0.0/8 has been assigned by IANA to APNIC on the 19th January 2010" [1]. To do this analysis, wouldn't they have had to advertise a route back in 2010?

[1] http://www.potaroo.net/studies/1slash8/1slash8.html

Re: Possible BGP hijack of 1.1.1.1

#125

Post by mastax » Tue, May 29, 2018, 6:41 PM UTC

majewsky wrote: post #111

walrus01 wrote: post #98

Earlier quoted context omitted.

I shake my head in bewilderment when I see stuff like this - just why would people make things harder for themselves. I very highly doubt that they are so large that they ran out of IP space in the enormity of 172.16/12 to encompass all of their OSPF/BGP router-id /32s and individual /30 OSPF router-to-router links.

> enormity What's enormous about an IPv4 /12? :) When the German army requested an allocation of IPv6 address space, they were given a /28, but complained that 2^100 IPs is not enough for them and they actually need a /22.

Thats mind boggling... I'd like to read that reasoning about that! (I'm sure there's some German-language publication somewhere...)

Did they want each bullet to have a /64?

Re: Possible BGP hijack of 1.1.1.1

#126

Post by MattSteelblade » Tue, May 29, 2018, 6:43 PM UTC

Joeri wrote: post #110

charonn0 wrote: post #106

Earlier quoted context omitted.

Allocated, not assigned.

What is the practical difference?

From RIPE, "An allocation is the block of IP addresses that is reserved by the RIPE NCC for your use now and in the future. An assignment is a block of IP addresses from your allocation that is used on an active network."

https://www.ripe.net/manage-ips-and-asns/resource-management...

Re: Possible BGP hijack of 1.1.1.1

#127

Post by walrus01 » Tue, May 29, 2018, 6:55 PM UTC

mastax wrote: post #125

majewsky wrote: post #111

Earlier quoted context omitted.

> enormity What's enormous about an IPv4 /12? :) When the German army requested an allocation of IPv6 address space, they were given a /28, but complained that 2^100 IPs is not enough for them and they actually need a /22.

Thats mind boggling... I'd like to read that reasoning about that! (I'm sure there's some German-language publication somewhere...) Did they want each bullet to have a /64?

I have both a /29 and a /32 of v6 space, and unless my ASN achieves total global domination on a scale never before seen by humankind, it should last a good long time. :-)

Re: Possible BGP hijack of 1.1.1.1

#128

Post by jacquesm » Tue, May 29, 2018, 6:58 PM UTC

arianvanp wrote: post #58

jacquesm wrote: post #5

Ah! That may have been the reason why my site wasn't resolving earlier today. It was the weirdest situation with people from all over the planet complaining without any apparent pattern, a RIPE check of the site from 10 different locations showed no issues in connectivity. Thanks for posting this.

Also not loading from any SURFNet IP in The Netherlands

Should work now, the problem apparently was in some errant router.

Re: Possible BGP hijack of 1.1.1.1

#129

Post by mmt » Tue, May 29, 2018, 6:59 PM UTC

namibj wrote: post #109

dice wrote: post #86

Earlier quoted context omitted.

>Usually If only... BCP 38[0] is nowhere near usual. Lots of networks, including some very problematic big ones ( cough Hurricane Electric cough ), do not implement it as a matter of course. The AWS Route53 hijack last month which resulted in downtime for a number of sites plus a six figure coin theft[1] could have been prevented by adequate filtering. 0: https://tools.ietf.org/html/bcp38 1: https://arstechnica.com/i…

Could one argue for tort/negligence against the ISP who should have filtered, but didn't, if one's coins were stolen through that? Or even possibly the same, but in criminal court?

I doubt it, since the argument you're suggesting is that the ISP didn't take the best possible care, whereas the standard for negligence is, I believe (IANAL), reasonable care.

They may also not even have a duty of care in the first place, as to the truth of any metadata they're passing on. As a sibling comment pointed out, it's not as if there are laws for this.

Re: Possible BGP hijack of 1.1.1.1

#130

Post by alberts00 » Tue, May 29, 2018, 7:06 PM UTC

walrus01 wrote: post #77

jedisct1 wrote: post #67

Earlier quoted context omitted.

Tell Cisco.

Both Cisco and Juniper use the standardized documentation IP ranges in their example/lab configurations and training materials. https://tools.ietf.org/html/rfc5735 https://tools.ietf.org/html/rfc5737

I have been going through Cisco Netacad materials for last 2 years and I've seen 1.1.1.1 in examples. Though I just did a search and did not see 1.1.1.1 mentioned anymore.