Possible BGP hijack | Hacker News Reader

Possible BGP hijack

bgpstream.com

95 pointsv4n4d1s20 comments

OMZ Global (AS34329) is an industrial process company (eg steel, manufacturing, ship building, etc). I'm going to assume someone who shouldn't have had access to BGP is trying to use it to block GoogleDNS or similar inside the corporation.

That or some pretty hilariously heavy-handed state-sponsored hijacking.

IIRC the only commonly access service hosted in that IP block is their DNS servers. There are easier ways to hijack DNS traffic than trying to hijack the entire prefix via BGP.

A casual browse through the other entries seems to suggest that people mess up BGP announcements all the time. My favourite one below involves the AS belonging to S & S Discount Market Pvt Ltd.

https://bgpstream.com/event/18050

Edit: It has happened previously

http://www.bgpmon.net/googles-services-redirected-to-romania...

> A casual browse through the other entries seems to suggest that people mess up BGP announcements all the time.

While true, incorrect bgp announcements happen all the time, I think this is one of the cases that Hanlon's Razor probably does not apply: most of the time they are not a result of people messing up - rather the bad announcements come from spammers/malware spreaders needing new IP space because their current (likely hijacked) IP space has gotten blacklisted and is no longer effective.

OMZ is also Russian, so state-sponsored isn't out of the running.

How is OMZ being Russian relevant to it possibly being state-sponsored?

Also, it's really not a major challenge to take over someone elses equipment to do this.

Oh come on, there's absolutely no reason for Russia to use a large Russian industrial company to perform BGP hijacking.

Nobody would be bringing up state sponsored attacks if it was a random US manufacturing company doing this.

It is Russian, and it delivers reactor containments and other heavy machinery for nuclear industry and military.

>and military

Do they still? Couldn't find anything post-1940s supporting that.

I'd be willing to bet this is the case; this only covers 8.8.8.0 to 8.8.8.255 so not 8.8.4.4 so it wouldn't be that effective at blocking Google DNS; only 1 IP would be blocked.

Why would they be blocking it? Google promotes 8.8.8.8 as the primary dns server, and, as far as I know, as long as it keeps answering, clients won't fall back to the secondary 8.8.4.4.

Some people don't use both.

Heads up this happened a few days ago, not currently hijacked.

Handy tool though, bookmarked it - using the event graph to display route changes as detected over time is a great visualization - would be really cool if there was the same event graph covering the entire internet (though I suspect without some cleverness in both design and implementation, the quantity of data would be prohibitively large for building a useful visualization).

There's a corresponding twitter feed:

https://twitter.com/bgpstream

Am I reading this right that leak lasted 2 hours?

These are often the result of mistakes. Even if OMZ were a tier 1 provider in RU, the impact would still be limited - I can't see how this could be intentional.

BGPStream [1] and RIPEstat[2], indicate that they also briefly announced prefix 87.23.14.0/24, belonging to a major Italian telco.

[1] https://bgpstream.com/event/17606

[2] https://stat.ripe.net/widget/announced-prefixes#w.resource=A...

The BGPlay visualization on that page appears to be open sourced: https://github.com/MaxCam/BGPlay

* Edited: Disregard this comment *

Ok, so if OMZ is Russian, do know this:

Russia currently is 'blocking' several websites. I.e. blocking at a DNS level, so this might be half witted attempt on keeping the censorship..

And as @swiley noted: some people only use the easier to remember 8.8.8.8 (I do that for instance)

Unlikely.

Especially since that's not really how Roskomnadzors blocking works.

Roskomnadzor "works" by publishing a list of IP addresses and domain names for ISPs to download. A copy of it is leaked to http://reestr.rublacklist.net/ in real time. Each ISP implements blocking in its own way: DNS blocking, transparent Squid proxy, firewalls or nothing at all sometimes. Nobody really cares if something is actually blocked. BGP hijacking for the purpose of blocking websites is really unlikely at this point.

Yes, you're right, I thought it was like here, in Portugal, but they actually block IP addresses and/or use deep packet inspection to do it, as far as I researched now.

I know it's not as sophisticated as the blocking in China, and a comment on reddit on a thread that I read yesterday (https://www.reddit.com/r/europe/comments/41s7z8/the_first_no...), made me think that it used DNS only. Nevermind

Reply on news.ycombinator.com