BGPMON researchers have found that Russian DNS servers redirected Internet traffic through Russia several times earlier this month. The question is whether it's a test or a harbinger of things to come.

Larry Loeb, Blogger, Informationweek

December 15, 2017

2 Min Read

Two incidents that occurred over three hours on December 12 showed how vulnerable the Internet remains to misrouting.

Security firm BGPMON found that for the two incidents of three minutes each, traffic for 80 high-volume sites such as Facebook , Google (Nasdaq: GOOG), Microsoft Corp. (Nasdaq: MSFT) and Apple Inc. (Nasdaq: AAPL) were rerouted to Russia before being transmitted out. Researchers posted notice of this occurrence on their blog.

This unusual routing was done by rewriting the global Border Gateway Protocol (BGP) routing tables used by the Domain Name System (DNS) to push Internet traffic through itself. The BGP makes routing decisions based on paths, network policies or rule-sets that are configured by a network administrator, who is involved in making core routing decisions.

What happened was significant since it was picked up by a large number of other routing ISPs that connected to this rogue path, and several new more specific prefixes that are not normally seen on the Internet were generated by it.

(Source: Bilder_meines_Lebens via Pixabay)

(Source: Bilder_meines_Lebens via Pixabay)

High-volume prefixes were being broadcast; the kind that would attract high levels of traffic.

Now, the Origin Autonomous System (AS) 39523 (DV-LINK-AS) hasn't been seen announcing any prefixes for many years, except for one incident involving Google and Verizon that was also strange. The incident had traffic on its way to Verizon routed through Google, which can't handle it. There were some massive outages because of it.

BGPMON described the node's behavior at that time in this way:

"In August Google learned a path to 66.232.224.0/24 (Kohls Department store) with origin 39523. Without knowing more about this prefixes, it looks strange and unexpected for Google to learn a 'Kohls Department store' Prefix via this path."

Now, this latest incident may have been some sort of test run. Considering the already announced plan by Russia to have its own "backup" DNS servers, this current effort could have been some sort of proof of concept that was run to see if the country could do it.

It did.

All of this shows that the connecting ISPs will have to accept that they can never totally trust the DNS routing tables they may get, but will have to add their own filters to the stream. Mistakes can happen due to Intent or from human error. The DNS system is based on trust, and that trust may be fraying.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Read more about:

Security Now

About the Author(s)

Larry Loeb

Blogger, Informationweek

Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek. He has written a book on the Secure Electronic Transaction Internet protocol. His latest book has the commercially obligatory title of Hack Proofing XML. He's been online since uucp "bang" addressing (where the world existed relative to !decvax), serving as editor of the Macintosh Exchange on BIX and the VARBusiness Exchange. His first Mac had 128 KB of memory, which was a big step up from his first 1130, which had 4 KB, as did his first 1401. You can e-mail him at [email protected].

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights