Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

2/24/2008
12:00 AM
Commentary
Commentary
Commentary
50%
50%

A Bad Day at Pakistan Telecom

Sometimes I think I should have been a network engineer. I love all that "belly of the internet beast" stuff—giant high-speed routers, huge data pipes, and all things close to the backbone of the Internet. But then I remember my grades from my engineering classes, and why I dropped engineering, and switched my major to English. Perhaps the engineer who broke both YouTube and the Pakistani Internet yesterday should have switched his major, too, before it was too late. I mean, I

Sometimes I think I should have been a network engineer. I love all that "belly of the internet beast" stuff—giant high-speed routers, huge data pipes, and all things close to the backbone of the Internet. But then I remember my grades from my engineering classes, and why I dropped engineering, and switched my major to English. Perhaps the engineer who broke both YouTube and the Pakistani Internet yesterday should have switched his major, too, before it was too late. I mean, I wouldn't want to be that guy right now. Would you want to be the guy who kept Pervez Musharraf from getting to his MySpace page?

It all stems, of course, from Pakistan's recent directive to its country's ISPs to block YouTube because of videos of those supposedly blasphemous Dutch cartoons. Yes, that again. Won't die, will it? In a nutshell, when someone in Pakistan modified some routing tables to direct all Pakistani traffic to YouTube into a black hole, the routing information escaped national boundaries by way of Hong Kong, and began routing worldwide YouTube traffic to that Pakistani black hole. Whoopsie. I give credit to Ars Technica for a detailed and fascinating explanation of the underlying problem.

Apparently, the problem was corrected in a couple hours, and the consensus seems to be that it was an accident. If it was a concerted attack, or a test of attack methods, it certainly would have been a clumsy one, since it essentially resulted in a DDOS attack on the hypothetical attacker's own country. About as effective as a lit stick of dynamite strapped to a boomerang, really.

But that doesn't mean there isn't a huge vulnerability underlying this whole incident. It's conceivable that an attacking country (or other entity), if it were well prepared and didn't care all that much if innocent bystanders got cut off from the world, could use this routing vulnerability to strike at an enemy. It all depends on how desperate they are, and how willing they are to cripple the Internet as a whole. Gee, it doesn't seem too difficult to think of one or two groups who might fit that bill.

I suppose there's reason to hope that this incident will throw the spotlight back on a vulnerability that we've known about for years, but have never gotten around to fixing. That fix won't be easy, but clearly it's necessary.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Hacking It as a CISO: Advice for Security Leadership
Kelly Sheridan, Staff Editor, Dark Reading,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15596
PUBLISHED: 2020-08-12
The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Disclosure attacks via a "fake" DLL file.
CVE-2020-15868
PUBLISHED: 2020-08-12
Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.
CVE-2020-17362
PUBLISHED: 2020-08-12
search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.
CVE-2020-17449
PUBLISHED: 2020-08-12
PHP-Fusion 9.03 allows XSS via the error_log file.
CVE-2020-17450
PUBLISHED: 2020-08-12
PHP-Fusion 9.03 allows XSS on the preview page.