TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Someone’s Been Siphoning Data Through a Huge Security Hole in the Internet

103 点作者 texan超过 11 年前

14 条评论

PhantomGremlin超过 11 年前
Bah. Real simple cure for this nonsense. Too bad it&#x27;s unlikely to happen.<p>Back when Usenet mattered, there used to be something called a &quot;Usenet Death Penalty&quot;. What we need here is an &quot;Autonomous System Death Penalty&quot;.<p>BGP works between &quot;Autonomous Systems&quot; (aka AS). ISPs almost invariably are. Bigger companies usually are. Anyone who wants to be independent of their upstream IP connection gets an AS number. The only way some ISP in Belarus can interfere with your IP packets is to announce over BGP that packets should be sent to their AS.<p>So anyone who was affected by some rogue ISP in Belarus should simply tell their BGP routers to totally ignore anything from that AS. Forever. And if they&#x27;re a govt agency they simply tell Comcast, Verizon, AT&amp;T, etc to drop any and all packets from that AS. To anywhere! And if it&#x27;s a govt agency making this &quot;request&quot;, there&#x27;s a good chance that the Tier 1 IP providers will comply.<p>Done. That podunk ISP in Belarus has now been disconnected from a large part of the Internet. And good luck with them trying to get Verizon etc to undo that.<p>So, what the death penalty means is &quot;you get to intentionally mess around with routing just once, then you go away forever&quot;. Now that podunk ISP can either go out of business or it can go begging IANA for a new AS number. And since ICANN (which operates IANA) answers (at least for now) to the US Dept of Commerce, it might not be too easy to get a new AS.<p>Yes I know the propeller-head nerds who operate the &quot;technical&quot; Internet would immediately think my proposal is much too harsh. But, ultimately, nerds need to understand that sometimes things are done for &quot;political&quot; rather than &quot;technical&quot; reasons. And the managers who sign the nerds&#x27; paychecks are political creatures; they almost invariably aren&#x27;t nerds.
评论 #6861685 未加载
评论 #6860694 未加载
评论 #6860088 未加载
评论 #6860092 未加载
评论 #6859986 未加载
评论 #6860207 未加载
评论 #6860312 未加载
评论 #6861050 未加载
评论 #6860767 未加载
评论 #6861021 未加载
评论 #6888864 未加载
评论 #6870895 未加载
r0h1n超过 11 年前
Here&#x27;s the post at Renesys upon which this article is based: <a href="http://www.renesys.com/2013/11/mitm-internet-hijacking/" rel="nofollow">http:&#x2F;&#x2F;www.renesys.com&#x2F;2013&#x2F;11&#x2F;mitm-internet-hijacking&#x2F;</a><p>FWIW, I found the renesys post more informative than the Wired article (though on a standalone basis it is pretty good too).
评论 #6859816 未加载
ds9超过 11 年前
Let&#x27;s assess the damage. Says the article:<p>&quot;The stakes are potentially enormous, since once data is hijacked, the perpetrator can copy and then comb through any unencrypted data freely&quot;<p>Apparently then, the harm amounts to:<p>H1. The method is a little stealthier than the NSA&#x27;s other modus operandi, the badge + &quot;national security letter&quot; + secrecy order, and similar conduct of other state actors.<p>H2. The reach extends surveillance capabilities outside the attacker&#x27;s territory.<p>On the other hand:<p>M1. There is no new MITM that was not possible before. Well-encrypted traffic is still opaque, and plaintext traffic is still vulnerable, regardless whether it is hijacked BGP-wise or by the on-premises tactics.<p>M2. This does not go unnoticed, there is no way to force affected parties to shut up about it, and like the other wiretapping, this will bring on countermeasures. It&#x27;s self-limiting.
Anon84超过 11 年前
Related discussion <a href="https://news.ycombinator.com/item?id=6773889" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=6773889</a>
stevehawk超过 11 年前
a map where blue is land?<p>who the hell made this map? Buster?
ak217超过 11 年前
Very interesting - is BGP fundamentally vulnerable to this attack? Is there a way to put the equivalent of a certificate revocation list on top of BGP?
评论 #6859515 未加载
评论 #6859530 未加载
coldcode超过 11 年前
Someone or the NSA? If I was them I would hijack some poor country ISP and siphon everything through them. At this point assuming it&#x27;s the NSA should be the default assumption. Remember that Snowden&#x27;s encrypted data (assuming it&#x27;s real) includes everything not yet public. So likely we only know a fraction. Thus assuming NSA is probably safe.
评论 #6862605 未加载
评论 #6862559 未加载
gwu78超过 11 年前
Off-topic: I alwyas liked the idea of like loose source routing. And the original netcat supports it. Does your kernel support it? Would you use it if you could?
ommunist超过 11 年前
That someone in Minsk may well be US operative working at huge IBM facility in Minsk.
cpsempek超过 11 年前
I love the picture of Iceland.
callesgg超过 11 年前
Is this realy a bug?
apierre超过 11 年前
Maybe Dr Evil in his secret volcano lair.
question612超过 11 年前
I can&#x27;t understand it.It seems to be business so, why did`nt make`em pay ?
windexh8er超过 11 年前
<i>sigh</i><p>Another BGP finger-pointing article that still doesn&#x27;t get it right.
评论 #6859476 未加载
评论 #6859641 未加载