Global Traffic to High-Profile Sites Believed Hijacked

Global internet traffic to IP addresses belonging to Google, Facebook, Microsoft, Apple and other high-profile tech companies was rerouted Tuesday through a little-known ISP in Russia. Researchers suspect the traffic was hijacked.

The incident lasted for more than two hours, from 4:44 UTC to 7:19 UTC, according to researchers from Russian DDoS mitigation company Qrator Labs. However, OpenDNS’ BGPmon service only observed two event windows of about three minutes each.

Both companies observed an obscure Russian ISP known as DV-LINK—identified in the global routing ecosystem as AS39523—announcing itself as the origin for around 80 prefixes owned by companies including Google, Facebook, Microsoft, Apple, Twitch, NTT Communications, Riot Games, and Vkontakte. A prefix is a block of publicly accessible IP addresses that identifies a computer network or subnetwork.

AS39523’s rogue announcements were accepted and propagated in the global routing table by its upstream provider, PJSC MegaFon. Other large providers including Level3, Cogent, Telstra, Hurricane Electric, Zayo and Nordunet accepted the announcements and routed traffic to and from those prefixes through the Russian ISP. DV-LINK essentially became a proxy between many users and the services they were trying to access.

Such incidents are known as BGP or prefix hijacking and are possible because the border gateway protocol (BGP), which is used to establish routing paths on the internet, is primarily based on trust between ISPs. Many times routing leaks can be caused by configuration errors or internal testing gone wrong, but there have been cases, like this one, where there’s a high probability the announcements were intentional and the data hijacked.

“What makes this incident suspicious is the prefixes that were affected are all high profile destinations, as well as several more specific prefixes that aren’t normally seen on the internet,” the BGPmon researchers said in a blog post. “This means that this isn’t a simple leak, but someone is intentionally inserting these more specific prefixes, possibly with the intent to attract traffic.”

Encrypted traffic to HTTPS-enabled websites or VPN connections should, in theory, be protected from snooping if properly implemented, even when the traffic is routed through a malicious actor. However, many attacks against TLS and other transport encryption protocols have been discovered over the years, so it’s not out of the question that someone might attempt to exploit an unknown bug using such a prefix hijacking technique.

“The central question is: why these path announcements propagated at all?,” researchers from Qrator Labs said in a blog post. “The fact that the hijacked prefixes propagated to every corner of the internet demonstrates an absence of proper filters between the AS39523 and its direct upstream AS31133 (Megafon), and between AS31133 (Megafon) and its adjacent networks and upstream providers.”

BGP was designed at a time when the Internet was very small and ISPs implicitly trusted each others’ announcements without any additional form of validation. However, as the internet grew larger and the number of prefix hijacking incidents—both intentional and accidental—increased, it became clear that this approach no longer works.

The Internet Engineering Task Force (IETF), together with the U.S. National Institute of Standards and Technology (NIST), the U.S. Department of Homeland Security and others have worked in recent years to secure BGP. A new BGPsec protocol adds AS path validation capabilities through a resource public key infrastructure (RPKI) that’s used to cryptographically sign and verify route announcements or claims of prefix ownership.

Unfortunately, BGPsec adoption is currently low because implementing the new protocol can impact performance and in some cases requires equipment upgrades, as routers need to be capable of cryptographic operations. But there are other less costly measures that can be implemented in the meantime, including filtering.

In 2014, the Internet Society, together with nine network operators, launched an initiative called MANRS, or Mutually Agreed Norms for Routing Security. The initiative has since grown with additional ISPs implementing the MANRS-mandated security controls that prevent the propagation of incorrect routing information through their networks.

The best way to convince more internet service providers to implement routing security is for their customers to ask for it. So, if you’re in a position to procure internet uplinks for your organization, add questions about BGP hijacking and overall routing security to your procurement process.

The results of a survey published in September by the Internet Society showed that over 70 percent of enterprises consider security as a core value and are concerned about traffic being hijacked. Once questioned organizations were introduced to MANRS, over 90 percent of them said they would be willing to pay a premium for internet service from an ISP that’s compliant with its principles. Meanwhile, over 70 percent of ISP respondents said they would consider implementing MANRS if such a requirement would be part of requests for proposal from potential customers.

Lucian Constantin

Lucian Constantin

Lucian has been covering computer security and the hacker culture for almost a decade, his work appearing in many technology publications including PCWorld, Computerworld, Network World, CIO, CSO, Forbes and The Inquirer. He has a bachelor's degree in political science, but has been passionate about computers and cybersecurity from an early age. Before he chose a career in journalism, Lucian worked as a system and network administrator. He enjoys attending security conferences and delving into interesting research papers. You can reach him at [email protected] or @lconstantin on Twitter. For encrypted email, his PGP key's fingerprint is: 7A66 4901 5CDA 844E 8C6D 04D5 2BB4 6332 FC52 6D42

lucian-constantin has 298 posts and counting.See all posts by lucian-constantin

One thought on “Global Traffic to High-Profile Sites Believed Hijacked

  • December 18, 2017 at 12:33 pm

    Regarding BGPsec (RFC 8205) deployability, performance, etc. there is some published work that addresses those issues. A lot more needs to be done, but some issues concerning crypto speedup and performance optimization are discussed in these studies:

    “High Performance BGP Security: Algorithms and Architectures (link is external),” North American Network Operators Group (NANOG 69), February 2017.

    “Design and analysis of optimization algorithms to minimize cryptographic processing in BGP security protocols,” Computer Communications, volume 106, pages 75-85, July 2017.

    Further, a proof of concept study (including practical deployment considerations) of RPKI-based route origin validation is just getting started:

Comments are closed.