Russian DNS Gobbling Up Internet Traffic
BGPMON researchers have found that Russian DNS servers redirected Internet traffic through Russia several times earlier this month. The question is whether it's a test or a harbinger of things to come.
Two incidents that occurred over three hours on December 12 showed how vulnerable the Internet remains to misrouting.
Security firm BGPMON found that for the two incidents of three minutes each, traffic for 80 high-volume sites such as Facebook , Google (Nasdaq: GOOG), Microsoft Corp. (Nasdaq: MSFT) and Apple Inc. (Nasdaq: AAPL) were rerouted to Russia before being transmitted out. Researchers posted notice of this occurrence on their blog.
This unusual routing was done by rewriting the global Border Gateway Protocol (BGP) routing tables used by the Domain Name System (DNS) to push Internet traffic through itself. The BGP makes routing decisions based on paths, network policies or rule-sets that are configured by a network administrator, who is involved in making core routing decisions.
What happened was significant since it was picked up by a large number of other routing ISPs that connected to this rogue path, and several new more specific prefixes that are not normally seen on the Internet were generated by it.
(Source: Bilder_meines_Lebens via Pixabay)
High-volume prefixes were being broadcast; the kind that would attract high levels of traffic.
Now, the Origin Autonomous System (AS) 39523 (DV-LINK-AS) hasn't been seen announcing any prefixes for many years, except for one incident involving Google and Verizon that was also strange. The incident had traffic on its way to Verizon routed through Google, which can't handle it. There were some massive outages because of it.
BGPMON described the node's behavior at that time in this way:
"In August Google learned a path to 66.232.224.0/24 (Kohls Department store) with origin 39523. Without knowing more about this prefixes, it looks strange and unexpected for Google to learn a 'Kohls Department store' Prefix via this path."
Now, this latest incident may have been some sort of test run. Considering the already announced plan by Russia to have its own "backup" DNS servers, this current effort could have been some sort of proof of concept that was run to see if the country could do it.
It did.
All of this shows that the connecting ISPs will have to accept that they can never totally trust the DNS routing tables they may get, but will have to add their own filters to the stream. Mistakes can happen due to Intent or from human error. The DNS system is based on trust, and that trust may be fraying.
Related posts:
— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.
Read more about:
Security NowAbout the Author
You May Also Like
Unleashing AI to Assess Cyber Security Risk
Nov 12, 2024Securing Tomorrow, Today: How to Navigate Zero Trust
Nov 13, 2024The State of Attack Surface Management (ASM), Featuring Forrester
Nov 15, 2024Applying the Principle of Least Privilege to the Cloud
Nov 18, 2024The Right Way to Use Artificial Intelligence and Machine Learning in Incident Response
Nov 20, 2024