Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Is Google Compute down?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 80 posts

Re: Ask HN: Is Google Compute down?

#51

Post by raesene9 »

dasm wrote: post #44
CydeWeys wrote: post #34

We urgently need a solution for routing traffic to IP addresses that is better than BGP.

Agreed. This appears to be a repeat of the attack covered here: https://news.ycombinator.com/item?id=18385920 I'm not familiar with BGP routing attacks; the article above seems to imply the attacker needs to compromise certs in order to glean useful data from the attack. If that's accurate, is this Google-oriented traffic vulnerable to this type of attack?

for Google traffic, assuming certificate pinning is in place, I can't see this being that successful.

However for more general traffic, well look at the trusted root list in your browser/OS. Realise that every single one of those trusted routes can issue certificates for a given domain...

Re: Ask HN: Is Google Compute down?

#53

Post by sterlind »

jamalex wrote: post #19

Despite the subdomain, the IP for ChinaTelecom-gw.transtelecom.net (217.150.59.249) seems to be based in Russia, as does the carrier: https://en.wikipedia.org/wiki/TransTelekom

Seems likely to be TT's gateway to CT. New theory: TransTelecom brought up a new gateway to ChinaTelecom, which incorrectly gossiped all advertisements from ChinaTelecom. This caused a leak, since CT has bgp highjacking of Google IP ranges for the GFW within China, but ordinarily doesn't leak them outside the country. TransTelecom misconfigured the gateway to broadcast everything advertised by ChinaTelecom, bringing external traffic into the GFW.

Re: Ask HN: Is Google Compute down?

#54

Post by dasm »

raesene9 wrote: post #51
dasm wrote: post #44

Earlier quoted context omitted.

Agreed. This appears to be a repeat of the attack covered here: https://news.ycombinator.com/item?id=18385920 I'm not familiar with BGP routing attacks; the article above seems to imply the attacker needs to compromise certs in order to glean useful data from the attack. If that's accurate, is this Google-oriented traffic vulnerable to this type of attack?

for Google traffic, assuming certificate pinning is in place, I can't see this being that successful. However for more general traffic, well look at the trusted root list in your browser/OS. Realise that every single one of those trusted routes can issue certificates for a given domain...

Thanks. Since it appears all this traffic is Google-related, any guesses as to what the attacker could have gained here?

Re: Ask HN: Is Google Compute down?

#55

Post by almost_usual »

raesene9 wrote: post #48
konschubert wrote: post #31

Earlier quoted context omitted.

EDIT: This is a general statement, I am not complaining to google here. This kind of thing should not be possible. Are there any protocol proposals or other kind of upgrades to the routing protocols that would prevent these kind of mistakes/attacks?

yeah there's been proposals on improving BGP security for at least 14 years that I've been aware of :) Getting the big ISPs/Telcos to adopt them... that's another matter

I'm thinking 1998 and Peiter Zatko

Re: Ask HN: Is Google Compute down?

#56

Post by amingilani »

sethvargo wrote: post #18

Hi all - Seth from Google here. Our team is aware and we are working on mitigation. In short, a third party telco provider is advertising on one of our IP blocks. Unfortunately that's all the information I can share at this time.

Reminds me of the time Pakistan knocked YouTube offline by hijacking their IPs globally[0]

Edit: Didn't someone recently share a tool to monitor BGP hijack attempts?

[0]: https://www.cnet.com/news/how-pakistan-knocked-youtube-offli...

Re: Ask HN: Is Google Compute down?

#57

Post by QML »

cm2187 wrote: post #38
konschubert wrote: post #31

Earlier quoted context omitted.

EDIT: This is a general statement, I am not complaining to google here. This kind of thing should not be possible. Are there any protocol proposals or other kind of upgrades to the routing protocols that would prevent these kind of mistakes/attacks?

I am surprised how fragile is the internet given how our society is increasingly becoming critically reliant on it.

The internet was not really built with security in mind. Look at DNSSEC or BGPSEC.

Re: Ask HN: Is Google Compute down?

#58

Post by raesene9 »

dasm wrote: post #54
raesene9 wrote: post #51

Earlier quoted context omitted.

for Google traffic, assuming certificate pinning is in place, I can't see this being that successful. However for more general traffic, well look at the trusted root list in your browser/OS. Realise that every single one of those trusted routes can issue certificates for a given domain...

Thanks. Since it appears all this traffic is Google-related, any guesses as to what the attacker could have gained here?

This could just be a mistake of course, malicious intent isn't needed :)

Of the top of my head, assuming malicious intent, well not all browser (especially older ones) do certificate pinning, so perhaps then Chinese users of Google services using old browsers would find their traffic being intercepted?

Past that the leakage would seem fairly minor, a list of source IP addresses and destination hosts.

Re: Ask HN: Is Google Compute down?

#59

Post by QML »

docker_up wrote: post #35
regnerba wrote: post #8

Google IPs seem to be being routed to China for us. We have servers in San Jose that cannot access Google services. Trace route shows everything going to China when leaving the San Jose data center. We can access the same services from Vancouver just fine.

How many times does this have to happen before China's privileges to do things like this get revoked? At this point, it can't be just a mistake and must be some state-sponsored hacking. Seems like a great way to find out where a particular Spotify user's IP address is.

What are you going to do? Divide the internet in half? I say that in a joking way but it’s a possibility.
Post reply on HN