Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Recent BGP leak that redirected internet traffic through Russia

kentik.com

Post reply on HN
Print view View original

11–20 of 21 posts

Re: Recent BGP leak that redirected internet traffic through Russia

#11

Post by bmicraft »

Towaway69 wrote: post #9
Hikikomori wrote: post #6

Earlier quoted context omitted.

Much like C.

We won’t replace electricity but we’ll build on top of it. Electricity is fundamentally the same since ever: copper wires transport it and it flows between two poles. That’s a bit what C is - the basis of other languages and for that it works fine. We abstract up the chain of complexity. There will always be a fundamental basis for all technology and it will never be perfect. Tesla would have preferred to use DC curr…

> instead we have AC which is more dangerous

That's false. If you assume the same (effective) voltage, ac is considerably less dangerous.

Re: Recent BGP leak that redirected internet traffic through Russia

#12

Post by philistine »

Towaway69 wrote: post #9
Hikikomori wrote: post #6

Earlier quoted context omitted.

Much like C.

We won’t replace electricity but we’ll build on top of it. Electricity is fundamentally the same since ever: copper wires transport it and it flows between two poles. That’s a bit what C is - the basis of other languages and for that it works fine. We abstract up the chain of complexity. There will always be a fundamental basis for all technology and it will never be perfect. Tesla would have preferred to use DC curr…

DC was preferred by Edison, not Tesla, which is not more dangerous at all. That was propaganda by Edison to disparage *EDIT:AC current. DC is just as dangerous as AC.

Re: Recent BGP leak that redirected internet traffic through Russia

#13

Post by Arnt »

tilt_error wrote: post #8

This is an interception scenario, no? If issued intentionally, traffic will pass through hardware in… unfriendly territory.

Yes, but doing it intentionally isn't as simple as one might think. First, BGP generally prefers the shortest path and yours is going to be a little long, so unless the best original path is very long you need on some transit provider to use policy-based routing and trust you as transit. Second, if you want the traffic to pass through your hardware you have to have sufficient bandwidth, otherwise you'll just trigger packet loss and disrupt service (fine if disruption is your goal, not so fine if you want the traffic to pass through your hardware). Third, some people use signed routes, which also complicates your job.

Re: Recent BGP leak that redirected internet traffic through Russia

#14

Post by Towaway69 »

philistine wrote: post #12
Towaway69 wrote: post #9

Earlier quoted context omitted.

We won’t replace electricity but we’ll build on top of it. Electricity is fundamentally the same since ever: copper wires transport it and it flows between two poles. That’s a bit what C is - the basis of other languages and for that it works fine. We abstract up the chain of complexity. There will always be a fundamental basis for all technology and it will never be perfect. Tesla would have preferred to use DC curr…

DC was preferred by Edison, not Tesla, which is not more dangerous at all. That was propaganda by Edison to disparage *EDIT:AC current. DC is just as dangerous as AC.

Thanks for the correction.

> That was propaganda by Edison to disparage DC

But if he prefered it, why would he create progaganda against it?

> DC is just as dangerous as AC.

I assumed the alternating made it more dangerous but I stand corrected.

Re: Recent BGP leak that redirected internet traffic through Russia

#15

Post by philistine »

Towaway69 wrote: post #14
philistine wrote: post #12

Earlier quoted context omitted.

DC was preferred by Edison, not Tesla, which is not more dangerous at all. That was propaganda by Edison to disparage *EDIT:AC current. DC is just as dangerous as AC.

Thanks for the correction. > That was propaganda by Edison to disparage DC But if he prefered it, why would he create progaganda against it? > DC is just as dangerous as AC. I assumed the alternating made it more dangerous but I stand corrected.

I messed it up too. Edison wanted to disparage AC.

Re: Recent BGP leak that redirected internet traffic through Russia

#16

Post by e63f67dd-065b »

I don't work in networking, but seeing as most traffic is encrypted these days, does passing through unfriendly hardware matter as much as back in the days of plaintext everything? Sure they can drop packets, but they can't tamper/read it, or is there something I'm missing?

Re: Recent BGP leak that redirected internet traffic through Russia

#17

Post by Aachen »

e63f67dd-065b wrote: post #16

I don't work in networking, but seeing as most traffic is encrypted these days, does passing through unfriendly hardware matter as much as back in the days of plaintext everything? Sure they can drop packets, but they can't tamper/read it, or is there something I'm missing?

Who checks those encryption keys?

If you direct a CA's traffic through your server, you can answer the HTTP or DNS queries that prove domain ownership. And lots of people click past warnings because an IT disruption isn't a day off if they can work around it

Re: Recent BGP leak that redirected internet traffic through Russia

#18

Post by cedws »

e63f67dd-065b wrote: post #16

I don't work in networking, but seeing as most traffic is encrypted these days, does passing through unfriendly hardware matter as much as back in the days of plaintext everything? Sure they can drop packets, but they can't tamper/read it, or is there something I'm missing?

Russia could easily “convince” a CA based in their country to do them a favour to facilitate MITM. Or just gather the right kompromat needed to convince one overseas.

Re: Recent BGP leak that redirected internet traffic through Russia

#19

Post by workfromspace »

Arnt wrote: post #13
tilt_error wrote: post #8

This is an interception scenario, no? If issued intentionally, traffic will pass through hardware in… unfriendly territory.

Yes, but doing it intentionally isn't as simple as one might think. First, BGP generally prefers the shortest path and yours is going to be a little long, so unless the best original path is very long you need on some transit provider to use policy-based routing and trust you as transit. Second, if you want the traffic to pass through your hardware you have to have sufficient bandwidth, otherwise you'll just trigger…

About

> First, BGP generally prefers the shortest path and yours is going to be a little long, so unless the best original path is very long you need on some transit provider to use policy-based routing and trust you as transit.

the article states:

> The leaked route is likely preferable because of a localpref setting which would prefer sending traffic for free through a peer regardless of the AS path length, over paying to send traffic through a transit provider.

Re: Recent BGP leak that redirected internet traffic through Russia

#20

Post by throw0101d »

e63f67dd-065b wrote: post #16

I don't work in networking, but seeing as most traffic is encrypted these days, does passing through unfriendly hardware matter as much as back in the days of plaintext everything? Sure they can drop packets, but they can't tamper/read it, or is there something I'm missing?

> […] but they can't tamper/read it, or is there something I'm missing?

You could redirect traffic temporarily to get a Let's Encrypt (ACME) certificate issued and then use it to pretend to be some important site. Redirect attacks have been done in the past:

> Among all the scams and thievery in the bitcoin economy, one recent hack sets a new bar for brazenness: Stealing an entire chunk of raw internet traffic from more than a dozen internet service providers, then shaking it down for as many bitcoins as possible.

* https://archive.is/http://www.wired.com/2014/08/isp-bitcoin-...

This type of attack is why LE does "Multi-Perspective Validation":

> A potential issue with this process is that if a network attacker can hijack or redirect network traffic along the validation path (for the challenge request, or associated DNS queries), then the attacker can trick a CA into incorrectly issuing a certificate. This is precisely what a research team from Princeton demonstrated can be done with an attack on BGP. Such attacks are rare today, but we are concerned that these attacks will become more numerous in the future.

* https://letsencrypt.org/2020/02/19/multi-perspective-validat...

Post reply on HN