Shutting Down the BGP Hijack Factory

#1

Post by pedro84 » Tue, Jul 10, 2018, 7:12 PM UTC

Shutting Down the BGP Hijack Factory
dyn.com

Re: Shutting Down the BGP Hijack Factory

#2

Post by EthanHeilman » Tue, Jul 10, 2018, 7:31 PM UTC

http://www.bitcanal.com is down.

Did they host it in their AS and now their AS is unreachable?

Re: Shutting Down the BGP Hijack Factory

#3

Post by msumpter » Tue, Jul 10, 2018, 7:54 PM UTC

EthanHeilman wrote: post #2

http://www.bitcanal.com is down. Did they host it in their AS and now their AS is unreachable?

I'm getting a servfail when attempting to resolve their domain, according to DomainTools[1] the IP for the site was 185.215.113.235 announced from AS42229.

The ASN was mentioned in the article as being listed by Spamhaus ASN Droplist but wasn't mentioned earlier as one of the targeted ASNs.

Edit: reviewed the ASN more and it is the Ebony Horizon mentioned in the article, and it is only peered to BitCanal's primary AS197426, which is subsequently being de-peered, so I'd say that is the main reason bitcanal.com is down :) 1: http://whois.domaintools.com/bitcanal.com

Re: Shutting Down the BGP Hijack Factory

#4

Post by lossolo » Tue, Jul 10, 2018, 8:04 PM UTC

We have RIPE and other IANA organizations that have routing objects in their databases with information about through which ASN certain classes are announced, there are also LOAs. GTT and Cogent are huge Tier-1 providers, why they do not check which classes their clients are announcing? Am I missing something here?

Re: Shutting Down the BGP Hijack Factory

#5

Post by walrus01 » Tue, Jul 10, 2018, 8:07 PM UTC

lossolo wrote: post #4

We have RIPE and other IANA organizations that have routing objects in their databases with information about through which ASN certain classes are announced, there are also LOAs. GTT and Cogent are huge Tier-1 providers, why they do not check which classes their clients are announcing? Am I missing something here?

Many big ISPs are quite diligent about what blocks their downstream customers announce. If you're an NTT ip transit customer every new block you announce to them is vetted. They have a high degree of automation with IRR integration but also humans in the loop.

Any asshole can theoretically make a fraudulent LOA, but by producing one to an upstream a hijack factory opens itself up to criminal charges of fraud and forgery.

Re: Shutting Down the BGP Hijack Factory

#6

Post by zokier » Tue, Jul 10, 2018, 8:11 PM UTC

Well its nice that they are now shut down, although the process seems to been fairly slow and arduous. They were already identified as misbehaving in 2014, getting kicked out from deixp in 2017, and only now disconnected by transits. And even in the latest episode they could play this game of cat and mouse for a (short) while. And what if Guilmette wouldn't had noticed this, or bothered to rant on nanog, would that happened at all?

I'm not sure what to do improve the situation, but there definitely seems like a need for improvement.

Re: Shutting Down the BGP Hijack Factory

#7

Post by msumpter » Tue, Jul 10, 2018, 8:12 PM UTC

lossolo wrote: post #4

We have RIPE and other IANA organizations that have routing objects in their databases with information about through which ASN certain classes are announced, there are also LOAs. GTT and Cogent are huge Tier-1 providers, why they do not check which classes their clients are announcing? Am I missing something here?

According to a post by Job on nanog they have been known to submitted false or fabricated IRR information to RADB and RIPE: http://seclists.org/nanog/2018/Jun/379

At the end of the day, BGP is a very trusting protocol and it requires keeping the neighborhood clean and clear. IMO providers should be filtering prefixes their clients shouldn't be announcing (al la BCP38) but keeping up on the various IP blocks being shifted around is a paperwork nightmare I'm sure.

Re: Shutting Down the BGP Hijack Factory

#8

Post by walrus01 » Tue, Jul 10, 2018, 8:20 PM UTC

msumpter wrote: post #7

lossolo wrote: post #4

We have RIPE and other IANA organizations that have routing objects in their databases with information about through which ASN certain classes are announced, there are also LOAs. GTT and Cogent are huge Tier-1 providers, why they do not check which classes their clients are announcing? Am I missing something here?

According to a post by Job on nanog they have been known to submitted false or fabricated IRR information to RADB and RIPE: http://seclists.org/nanog/2018/Jun/379 At the end of the day, BGP is a very trusting protocol and it requires keeping the neighborhood clean and clear. IMO providers should be filtering prefixes their clients shouldn't be announcing (al la BCP38) but keeping up on the various IP blocks being shi…

BGP is still very much built on trust and reputation... At a local ix level if you were to show up at an ix like the ams-ix and regularly announce prefixes you have no right to, your company name and AS# would quickly develop the reputation of a rancid turd.

Re: Shutting Down the BGP Hijack Factory

#9

Post by duxup » Tue, Jul 10, 2018, 8:39 PM UTC

Bitcanal sounds like an appropriately terrible name as it sounds like root canal... but for bits.

BGP really needs some more organized security, but that's nothing new, and i'm sure not super easy to organize.

Re: Shutting Down the BGP Hijack Factory

#10

Post by lormayna » Tue, Jul 10, 2018, 8:46 PM UTC

I have worked for a medium size ISP for many years (3 upstream Tier-1 provider, presence on 2 IXP) and we sometimes suffer from BGP hijaking. We had developed a software that every hour checks the BGP prefix assigned to every peer and update the BGP filter automatically. It takes some time to engineering it and develop but after then, it works like a charm.