'Intentional' event redirects cloud traffic from Apple, Google & others through Russia
Internet traffic coming into and out of Apple, Facebook, Google, Microsoft, and other companies was briefly redirected through a Russian provider on Wednesday, in what appears to have been a deliberate move.
The incident involved the Border Gateway Protocol, or BGP, which funnels high-level traffic through nodes like internet backbones, according to Ars Technica, citing reports by monitoring services BGPMon and Qrator Labs. BGPMon recorded two three-minute hijacks, affecting 80 address blocks in total. Qrator Labs said the incident spanned two hours, with the number of address blocks fluctuating between 40 and 80.
Some reasons for suspicion include the prominence of the impacted companies, and the fact that IP addresses were split into smaller blocks than those announced by the companies -- something that doesn't normally happen with a BGP configuration error.
The autonomous Russian system that performed the hijack, known as AS39523, was previously inactive for years except for another BGP incident in August that involved Google.
It's unknown what might been done with data if the latest redirect was deliberate, since much or all of it would've been protected by encryption that has yet to be defeated, at least according to public knowledge. An attacker could conceivably have figured out decryption, attempted to crack it, or may be storing the data for future attacks.
The incident involved the Border Gateway Protocol, or BGP, which funnels high-level traffic through nodes like internet backbones, according to Ars Technica, citing reports by monitoring services BGPMon and Qrator Labs. BGPMon recorded two three-minute hijacks, affecting 80 address blocks in total. Qrator Labs said the incident spanned two hours, with the number of address blocks fluctuating between 40 and 80.
Some reasons for suspicion include the prominence of the impacted companies, and the fact that IP addresses were split into smaller blocks than those announced by the companies -- something that doesn't normally happen with a BGP configuration error.
The autonomous Russian system that performed the hijack, known as AS39523, was previously inactive for years except for another BGP incident in August that involved Google.
It's unknown what might been done with data if the latest redirect was deliberate, since much or all of it would've been protected by encryption that has yet to be defeated, at least according to public knowledge. An attacker could conceivably have figured out decryption, attempted to crack it, or may be storing the data for future attacks.
Comments
https://arstechnica.com/information-technology/2017/04/russian-controlled-telecom-hijacks-financial-services-internet-traffic/
https://dyn.com/blog/chinese-routing-errors-redirect-russian-traffic/
https://www.washingtontimes.com/news/2010/nov/15/internet-traffic-was-routed-via-chinese-servers/
https://www.computerworld.com/article/2532289/cybercrime-hacking/cyberattacks-knock-out-georgia-s-internet-presence.html
For its part Russia is actively and aggressively working to keep Russian internet traffic within Russia and under their control.
https://www.bleepingcomputer.com/news/government/russia-plans-to-keep-internet-traffic-inside-the-country-fearing-foreign-wiretaps/
In the end counties will begin to erect walled gardens to monitor and control extranet activities (Russia, China, Iran etc already have this in place). The end of the open internet as we had created and known it will unfortunately end.
Freedom, once lost is very difficult to restore. We will lose net neutrality today unless we continue to fight for it, and the same goes for the internet itself.
And, it is yet ANOTHER example of how our internet is not a private, for-profit network -- but a national asset essential to our future and our security.
Instead of being abandoned and turned over to others for their fun and profit, it needs to be carefully governed, regulated, protected and nurtured by our government.
Just took a quick peek at NetSol's site and didn't see anything, but they're such a godawful company I'm sure they wouldn't make their screwups easy to find. Used them for many horrible years, starting in the very earliest days, thankfully finally 100% netsol-free for the past 5 years or so. Good luck.
Also a sad state of affairs for NetSol, apparently. Did they publish any info whatsoever about the problem on their web site? Transparency is important! The thing is, a compromise like that, depending up on the nature of their customers' business, could be absolutely devastating. Or, even for some smaller mom&pop type businesses, they could easily be away on vacation, offline for a few days with the presumption of a turnkey operation just doing its thing. Return to find their business offline. I guess that could happen for a variety of reasons, but compromised certificates shouldn't be one. Mostly I'm just wondering about their public-facing transparency on this.