Live data from Hacker News

There were BGP anomalies during the Venezuela blackout

loworbitsecurity.com

421–430 of 476 posts

Re: There were BGP anomalies during the Venezuela blackout

#421

Earlier quoted context omitted.

there's a fair argument to make that a nation that drops a nuclear bomb on a city isn't "civilized"

I think that lesson from World War Two is that civilization is all the things we do to prevent another World War Two from happening. And that what we owe to all the people in Hiroshima, Tokyo, Nanjing, the Warsaw Ghetto, Katyn, Bengal, Manzanar, and a thousand other places is to prevent anything like that from happening again.

Exactly... and frankly, we're starting to fall asleep on the job.

Re: There were BGP anomalies during the Venezuela blackout

#422

Earlier quoted context omitted.

> That requires the client to only emit ECH So for example, Firefox since version 119. Or Chrome since 117 Now, for most services ECH doesn't have an encrypted target server. But the important choice in ECH was in this case it just fills that space with noise. An encrypted message also looks like noise. So you can block all the noise, in case it's secrets, or you can let through all the noise (some of which might be…

The great firewall was updated to support inspection of TLS 1.3. They didn’t just decide it was whatever and let everything through. It was easier to just update their parsing than to force everyone to turn it off, so they did that instead. Perfect forward secrecy was a thing before TLS 1.3, and they’ve found other methodology to accomplish what they want. For ECH, China can just require you turn it off. Or distribut…

> The great firewall was updated to support inspection of TLS 1.3.

To actually "inspect" TLS 1.3 you need the keys which are chosen randomly for each session by the parties - so either (1) you have a mathematical breakthrough, (2) you have secured co-operation from one or both parties (in which case they could equally tell you what they said) or (3) in fact you don't have inspection.

As you observe forward secrecy was already possible in TLS 1.2 and China's "Great firewall" didn't magically stop that either. In fact what we see is that China blocks IP outright when it doesn't want you to talk to an address, the protocol doesn't come into that. What we changed wasn't whether China can block connections, but how easy it is to snoop those connections.

> For ECH, China can just require you turn it off

So did they? Remember, I'm not talking about some hypothetical future, this technology is actively in use today and has been for some time.

Re: There were BGP anomalies during the Venezuela blackout

#423
post #32

Earlier quoted context omitted.

Let’s be honest, that was a crazy operation. I wonder whether they really secured all chances of success, or just winged it with chances of not depositing the leader, and him being able to summon his diplomatic relations into 50 countries declaring war to the USA. While on their way out, if the USA could set everything back to IPv6, that would be nice.

The outcome is less-crazy if one views it as assisting a palace-coup, partnering with a bunch of Venezuelan government and military insiders already seeking to depose Maduro, able to subtly clear the path and provide intel.

If they did that then they did a bad job considering Maduros vp assumed power while also saying Maduro remains the actual president.

Re: There were BGP anomalies during the Venezuela blackout

#424

Earlier quoted context omitted.

> him being able to summon his diplomatic relations into 50 countries declaring war to the USA. As if. Dictators only do things that benefit themselves, and deciding to attack the US is suicide and/or world ending.

Took a long time to catch up with Bin Laden after he attacked the US.

They almost had him early in afghanistan but let him go.

Re: There were BGP anomalies during the Venezuela blackout

#425

Earlier quoted context omitted.

If it's hot/cold, elderly/vulnerable people tend to die pretty quick. https://en.wikipedia.org/wiki/2025_European_heatwaves https://en.wikipedia.org/wiki/2021_Texas_power_crisis You'll get some food poisoning deaths from food that got too warm in fridges. People who rely on home medical equipment like oxygen concentrators. Car crashes in busy intersections that no longer have traffic lights. Fires from candles. etc.…

It feels like a stretch. It reminds me of when people claimed the whatsapp numbers leak put lives at risk because people might use it in countries where it is banned. In another sense, it is similar to arguments against tasers, where they are being evaluated in a vacuum instead of being evaluated against their alternatives. If you compare tasers to guns, or power outages to bombs, then they are safe rather than dange…

> In another sense, it is similar to arguments against tasers, where they are being evaluated in a vacuum instead of being evaluated against their alternatives. If you compare tasers to guns, or power outages to bombs, then they are safe rather than dangerous.

Nah, I disagree here.

Tasers do indeed offer an alternative to guns. But they allow more force in other situations, where officers would previously have had to deescalate because "just shoot them" wasn't justified.

Cops now use a taser where zero force might previously have been used.

Re: There were BGP anomalies during the Venezuela blackout

#426

Earlier quoted context omitted.

The great firewall was updated to support inspection of TLS 1.3. They didn’t just decide it was whatever and let everything through. It was easier to just update their parsing than to force everyone to turn it off, so they did that instead. Perfect forward secrecy was a thing before TLS 1.3, and they’ve found other methodology to accomplish what they want. For ECH, China can just require you turn it off. Or distribut…

> The great firewall was updated to support inspection of TLS 1.3. To actually "inspect" TLS 1.3 you need the keys which are chosen randomly for each session by the parties - so either (1) you have a mathematical breakthrough, (2) you have secured co-operation from one or both parties (in which case they could equally tell you what they said) or (3) in fact you don't have inspection. As you observe forward secrecy wa…

I don’t understand what your point about TLS 1.3 is. It’s only relevant if you’re doing a downgrade attack (or equivalently, using an active middleware box). TLS 1.3 itself is not vulnerable to this because it (a) doesn’t have non-PFS suites to downgrade to and (b) protects the cipher suites by including them in the key exchange material. But if the server supports TLS 1.2, an active MITM can still downgrade to it if the client doesn’t demand TLS 1.3 specifically (which browsers do not by default). It won’t matter to China until there are lots of TLS 1.3-only websites (which hasn’t happened yet).

China was already leaning on passive DPI and L3 blocking before TLS 1.3 complicated (but as I said, did not preclude) downgrading to PFS ciphers. The reason being that for about the last 10 years, many sites (including default CDN settings) used SSL profiles that only allowed PFS ciphers. For such a server, downgrade attacks are already not useful to the Great Firewall, so adding TLS 1.3 to the mix didn’t change anything.

> So did they? Remember, I'm not talking about some hypothetical future, this technology is actively in use today and has been for some time.

Google Chrome (for example) will now use ECH if the website has the relevant DNS record - but it doesn’t use the anti-censorship mechanism in the spec to make requests to servers that haven’t enabled it look like they may be using ECH. This, combined with the fact that China can just not serve the relevant DNS record by default, means it doesn’t really impact the great firewall.

This is actually a good example of the non-technical side of this: Chrome could send a fake ECH on every request, like the spec suggests. This would perhaps make China block all Chrome traffic to prevent widespread ECH. But then Chrome would lose out on the market share, so Google doesn’t do it. Technical solutions are relevant here, but even the most genius anti-censorship mechanism needs to content with political/corporate realities.

Re: There were BGP anomalies during the Venezuela blackout

#427
post #366

Earlier quoted context omitted.

Yeah but those people read the popularity polls as well. If you kill or capture the leader, there isn’t much upside in retaliation against a massively more powerful enemy. The best move is to cozy up to whomever is in power next.

> The best move is to cozy up to whomever is in power next. Why care whomever is in power next? You could just do your job. So, the solution is to press the nuclear button, get a couple hundred million dollars from an offshore account in Cyprus, and live in any country of your choice. Why care about polls in this hole, and what the US will do with this hole in response to the use of nuclear weapons?

Nuclear weapons aren’t automated enough for one person to launch them. “The button” is generally just sending orders to other people to launch them.

The chances of all of those people escaping the country after nuking the US is close to zero. The entire country would mostly likely be completely destroyed before you could make it out. Even if you did make it out, your friends and extended family definitely won’t.

And good luck spending that money when the US is intent on hunting you down. In this scenarios your boss wasn’t safe with a nuclear deterrent, you’re definitely not.

Re: There were BGP anomalies during the Venezuela blackout

#428

> When BGP traffic is being sent from point A to point B, it can be rerouted through a point C. If you control point C, even for a few hours, you can theoretically collect vast amounts of intelligence that would be very useful for government entities. The CANTV AS8048 being prepended to the AS path 10 times means there the traffic would not prioritize this route through AS8048, perhaps that was the goal? AS prependin…

CANTV (AS8048) is a correct upstream transit provider for Dayco (AS21980) as seen in both https://radar.cloudflare.com/routing/as21980#connectivity and https://bgp.tools/as/21980#upstreams What most likely happened, instead of a purposeful attempt to leak routes and MITM traffic, is CANTV had too loose of a routing export policy facing their upstream AS52320 neighbor, and accidentally redistributed the Dayco prefixes…

A closer look at the leak: https://news.ycombinator.com/item?id=46518731

Re: There were BGP anomalies during the Venezuela blackout

#429
post #293

Earlier quoted context omitted.

> On the other hand, it doesn’t matter how off the estimates were because they’re our people and their lives matter more. "Our" people? That kind of moral calculus simply doesn't track with me: I'm neither from the US nor Japan, plus I think considerations of "civilization" fly out the window once you start thinking like this. But also, it's a kind of goalpost shifting. Either the calculations were the justification,…

I am not following this rationale at all. Because you're not Japanese or American, Americans are uncivilized for using a weapon that caused lots of Japanese people to die after Japanese people attacked the United States (and Australia, China, the Philippines, and more) and wouldn't stop? > Either the calculations were the justification The person I responded to was trying to suggest the number of American lives saved…

> I am not following this rationale at all.

It was pretty simple: you said "they’re our people and their lives matter more" and I explained that they are not "our" people because you're not talking to an US American: you're talking to a South American. They are not "my" people.

I also claimed that, in any case, arguments out of "our" vs "their" people are fundamentally not about being civilized (which was the root of the argument, let me quote it for context: "dropping nukes was both barbaric and the more civilized option. Oppenheimer et al. deserve their acclaim.").

You can make "us vs them" arguments, but it has nothing to do with being civilized, and it doesn't save anyone from accusations of barbarism. I mean, Hitler also thought in terms of "us vs them", and look how he is regarded today.

> The person I responded to was trying to suggest the number of American lives saved was a lot fewer than estimates. Instead of saving 1,000,000 Americans it "only" saved 50,000 or something and because of that, the calculus to use the bomb wasn't as "good" as it otherwise would be if it had saved more lives.

The person you responded to was me. Your understanding of my argument is incorrect. I argued that the number mattered because the actual number is used to say "the invasion [Operation Downfall] would have caused more casualties than dropping the bomb, therefore the bomb 'saved' Japanese lives too". Please don't tell me you haven't heard this argument, which is very well known and in fact was mentioned by the original commenter I was responding to. This moral calculus has been quoted thousands of times; I'm pointing out it's misleading and dishonest.

You simply can't have your cake and eat it too. Either the numbers matter or they don't; and if they do matter, it matters that they are well justified and accurate. And it matters whether they were really thinking of these numbers when they decided to use the Bomb(s), or whether they are an a posteriori justification!

(Besides, as a sibling commenter argued, more aptly than I did: US planners wanted to use the Bomb because they had it and had spent a lot of effort developing it. They were primed to use it. They wanted to test it on a real city, with real humans, and they wanted to send a message to the Soviets, too. All excuses -- Operation Downfall, American vs Japanese lives, etc -- were a posteriori, retroactively deployed to not be portrayed as cold hearted).

> I say if it saved a single American life it was worth it, and was righteous, thus the shifting around of how many American lives saved is pointless because we know the lower bound is 1, and 1 was all you needed.

This is fundamentally wrong and doesn't support the argument from "civilization" which, again, was the argument I was responding to.

If you are going to argue American lives are worth preserving more than lives from other countries, not only do I disagree (how would you feel if I told you they are less worth preserving?), but it's also not about being civilized. So we can abandon that pretense!

Re: There were BGP anomalies during the Venezuela blackout

#430
post #418

Earlier quoted context omitted.

Most BGP peers have router filters in place. It's not 1996 anymore. I remember the days of logging into a Cisco connected to a Sprint T1 and seeing a coworker had fat fingered a spammer's route, sending it to null0. Oops. How did that happen?

Also RPKI has been available long time already. Considering the routing table size has been increasing and IPv6 need anyone shouldn't be running global routing with gear not supporting RPKI any more, the routing polices and announcing those RIR they operate. https://en.wikipedia.org/wiki/Resource_Public_Key_Infrastruc...

Many v4 prefixes in the ARIN region are legacy and don't support RPKI unless you sign the registration agreement. I have a legacy prefix and may eventually be forced to sign up.
Post reply on HN