Does anyone else find it sort of beautiful watching replays of events like this? It's amazing to watch how the routers organise themselves, making and breaking connections when needed.
Possible BGP hijack of 1.1.1.1
21–30 of 158 posts
Re: Possible BGP hijack of 1.1.1.1
#22How effective is this? Looking at https://bgp.he.net/ip/1.1.1.1 , 1.1.1.0/24 is apparently "ROA Signed and Valid". I don't know a lot about BGP. Does this mean hijacking this subnet is a bit harder than unsigned ones because some or all ISPs verify this announcement? Or is it faster/easier to detect? Maybe a wider question: is there some way to prevent BGP hijacking?
In short, not many networks are checking signatures because not many networks are publishing them. Take a look at this presentation from 2009.
http://www.ausnog.net/sites/default/files/ausnog-03/presenta...
I've been out of the space for almost as long, so would love to be wrong, but I think its fair to say that not much has improved on this front since then.
Re: Possible BGP hijack of 1.1.1.1
#23Ah! That may have been the reason why my site wasn't resolving earlier today. It was the weirdest situation with people from all over the planet complaining without any apparent pattern, a RIPE check of the site from 10 different locations showed no issues in connectivity. Thanks for posting this.
No, the issue persists. While I can access your site from mobile and residential connection, any static business connection fails. No 1.1.1.1 involved. I tested this with two different Fibre connections (Berlin).
Re: Possible BGP hijack of 1.1.1.1
#24Would this affect certificate-validating clients doing DNS-over-HTTPS to 1.1.1.1 — doesn’t it have an ipAddress certificate and demand HTTPS resolution only?
Re: Possible BGP hijack of 1.1.1.1
#25Ah! That may have been the reason why my site wasn't resolving earlier today. It was the weirdest situation with people from all over the planet complaining without any apparent pattern, a RIPE check of the site from 10 different locations showed no issues in connectivity. Thanks for posting this.
No, the issue persists. While I can access your site from mobile and residential connection, any static business connection fails. No 1.1.1.1 involved. I tested this with two different Fibre connections (Berlin).
Is the BGP hijack over?
Re: Possible BGP hijack of 1.1.1.1
#26I doubt that this is a genuine hijacking attempt. All it takes is a Cisco router and some IT admin making up an address.
Has the hijacker previously hijacked other prefixes in the past, or is this a one-time event for them?
Re: Possible BGP hijack of 1.1.1.1
#27Would this affect certificate-validating clients doing DNS-over-HTTPS to 1.1.1.1 — doesn’t it have an ipAddress certificate and demand HTTPS resolution only?
Well, if you control the host behind the IP, you could have any CA issue a challenge, and successfully pass it (e.g. if Let's encrypt uses the erroneous routes).
So no. The only thing protecting you would be to have the expected hash of the certificate you expect to see (TOFU - Trust on First use, though you're screwed if you didn't contact 1.1.1.1 before the incident!).
Re: Possible BGP hijack of 1.1.1.1
#28What does this mean for those unfamiliar?
It’s like someone posting a “Turn left for Highway 123” road sign right next to a legitimate “Turn right for Highway 123” sign. Traffic snarls result, since most drivers don’t check the DOT security sticker on the back of both signs and find it missing from the fake Left one.
Re: Possible BGP hijack of 1.1.1.1
#29Re: Possible BGP hijack of 1.1.1.1
#30Would this affect certificate-validating clients doing DNS-over-HTTPS to 1.1.1.1 — doesn’t it have an ipAddress certificate and demand HTTPS resolution only?
They use a named certificate, validated against the standard CAs. Unless the hijackers were able to get a certificate with the name 'cloudflare-dns.com.' then the TLS session would fail.