Catch up on stories from the past week (and beyond) at the Slashdot story archive


Forgot your password?
Encryption The Internet Networking Security IT

For 18 Minutes, 15% of the Internet Routed Through China 247

olsmeister writes "For 18 minutes this past April, 15% of the world's internet traffic was routed through servers in China. This includes traffic from both .gov and .mil US TLDs." The crazy thing is that this happened months ago, and nobody noticed. Hope you're encrypting your super-secret stuff.
This discussion has been archived. No new comments can be posted.

For 18 Minutes, 15% of the Internet Routed Through China

Comments Filter:
  • The crazy thing is that this happened months ago, and nobody noticed.

    Odd, Slashdot reported the day afterward: Chinese ISP Hijacks the Internet (Again) [].

    • by interkin3tic ( 1469267 ) on Tuesday November 16, 2010 @03:31PM (#34246250)

      That summary and article didn't report the .mil or .gov traffic.

      I guess we just assumed it was only youtube videos or pokes on facebook.

      • by Sepodati ( 746220 ) on Tuesday November 16, 2010 @03:39PM (#34246392) Homepage

        They hijacked prefixes, not data. At least not directly. If you sent a packet during that time, it may have been routed to China. I doubt they stood up a big infrastructure to close TCP sessions with all of that incoming traffic and actually capture anything. Perhaps for a very targetted attack they could have, but then there'd be better ways than this to do it, I imagine.

        • by Yvanhoe ( 564877 )
          I don't understand, why couldn't they just log all the data that went through ? Unencrypted passwords, http authentications, emails sent... It would have the potential to bring a lot of valuable informations. If I was the Chinese CIA, I would have only one goal : make it happen again.
          • They did not become a transit network where all of this information was just flowing through waiting to be logged.

            They falsely announced that they owned certain prefixes and asked the Internet (web of trust) to forward packets with those destinations to their network.

            In order for them to capture an email you sent during that time, they'd have to maintain a TCP connection with you and a fake email server that matches the destination IP address you were using. For a website, they'd likely capture the initial

        • by Anonymous Coward on Tuesday November 16, 2010 @07:07PM (#34249460)

          Sorry to be AC.

          as an IP engineer at a major backbone provider, I can safely comment on the hyperbole of this incident.

          China Telcom -4134- would have to either send very/more specific routes and get max prefixes blown out, or send very general routes and loose to smaller routes.

          yes, for a little while any "tier 1" player, or major government player, can convince another provider to send routes to an inappropriate AS, the game soon ends. anyone who isn't running at the very least a max prefix is a cluetard and needs their peering revoked anyway. From my 20%, 4134 is always a hair's breath away from getting a smackdown.

          tldr; they can't really steal the whole internet, but we need to watch out for smaller route hyjacking.

      • That summary and article didn't report the .mil or .gov traffic.

        Big friggin deal. Any traffic captured from those TLD's would be external traffic. So now China know that Private Bloggins is, and his girlfriend just dumped him. Quick, everybody panic!

    • by MaskedSlacker ( 911878 ) on Tuesday November 16, 2010 @03:31PM (#34246260)

      You think the /. editors RTFA?

    • It's hard enough for Slashdot to keep up with the news, now you want them to keep up with what they keep up with? :P

    • In China the headline was: China Triumphs (Again) Imperial Denial of Services Attack Thwarted after only 18 Minutes of Disruption.

      I would link to the article, but it's all in Chinese.

  • by elrous0 ( 869638 ) * on Tuesday November 16, 2010 @03:24PM (#34246112)

    All my emails started showing up with fortunes and free eggrolls.

  • ...that one internet isn't really enough.

    • by arivanov ( 12034 ) on Tuesday November 16, 2010 @03:42PM (#34246436) Homepage

      Or it is.

      It is just that the USA has forgotten the Internet basics. It has also forgotten major past incidents like that case from 10 years back when one small ISP in Florida directed most of the Internet traffic through itself and fell over.

      USA internet has very little redundancy. Most of the peering is private, in very few locations and the routes announced by ISPs to each other are not filtered based on declared ISP announcement policy. As the few remaining ISPs are so big the announcement lists have grown to a size where filtering them poses a technical difficulty. In addition to that because the ISPs are big they trust each others change control that routes for blocks which are "somebody's elses will not be announced". Bad Idea (TM). And that is why this was possible in the first place.

      Compared to that in Europe most of the peering is public and nearly all ISPs heavily filter the route announcements coming from other peers. A Chinese ISP which would announce blocks it does not own would simply be ignored. It is of course possible for the ISP in question to add the policy to its official export list, post it to RIPE, get it propagated to other ISPs and then announce the routes, but that will take time and will have a big chance to be noticed. It will also be clear that there is "no mistake" there so the ISP in question will really get kicked off the internet for this one.

    • by Sta7ic ( 819090 )
      At the risk of feeding the trolls,
      "Dark fiber". VPN tunnels. Modems. There are still a lot of ways data gets from point A to B without going through the normal routing rules, so near as I can tell, we already have more than one internet.
  • by Anonymous Coward on Tuesday November 16, 2010 @03:26PM (#34246160)

    I had just finished torrenting a 10gig 1080p mkv and 18 minutes later I was hungry for more downloads.

  • As designed (Score:5, Insightful)

    by Neil Watson ( 60859 ) on Tuesday November 16, 2010 @03:29PM (#34246192) Homepage

    Isn't that what the Internet was designed to do; route as need to get bits to their destination?

    • Re: (Score:3, Interesting)

      by janeuner ( 815461 )

      Yes. It worked as designed. That is the crazy thing.

    • by vxice ( 1690200 ) on Tuesday November 16, 2010 @04:17PM (#34246980)
      Depends, what is the normal average for traffic going through China? Among other things such as did China just happen to have the best routes for this anyways? This summary doesn't give the basic necessary information, oh wait this is slashdot I though I was in a different tab for a min.
  • by js3 ( 319268 ) on Tuesday November 16, 2010 @03:30PM (#34246220)

    when that 18mins is over and all their stuff goes through American servers

  • by Christianfreak ( 100697 ) on Tuesday November 16, 2010 @03:30PM (#34246234) Homepage Journal

    There are plenty of reasons to use encryption but the Chinese government just isn't one of them for me. If I view something they don't like, what exactly are they going to do? I suppose they could block my access but it's not like I would get thrown in a Chinese prison.

    I have a lot more to worry about from identity thieves, scams and heck, my own government.

    • Re: (Score:3, Insightful)

      Of course, you could be a human rights activist providing anonymizing proxy for some oppressed, sadly now recently deceased, soul in Beijing.
    • by LWATCDR ( 28044 ) on Tuesday November 16, 2010 @03:39PM (#34246390) Homepage Journal

      Depends. Sending any igs files of that new project to anybody?
      How about that source code.
      I fear we are getting way too comfortable with email for my taste.

      • What would Internet Go Server files matter for a project? And don't you use SGF for simple game format saves these days anyway?
      • Re: (Score:3, Insightful)

        by MikeBabcock ( 65886 )

        If you're sending any type of sensitive data without PGP or other good encryption, you're a fool.

        Protect your own data, any idiot at the ISP can read your E-mails -- not just China.

        • by LWATCDR ( 28044 )

          I do know that. But all the same I have gotten IGS files from contractors in email. I have tried to inform people that email is as secure as a postcard but no one listens. We have even had people send credit card info to us in email.
          We have a policy to contact them when they do and suggest they cancel that card. I wonder how many do.

    • by Tridus ( 79566 ) on Tuesday November 16, 2010 @03:43PM (#34246452) Homepage

      Yeah, seriously. I'm a lot more concerned about what the US government and the molestation department at TSA might do then I am about the Chinese government.

      This story is interesting from a tech perspective, but the commentary at the end is BS on a site from a country with ever decreasing privacy standards.

      • Re: (Score:3, Insightful)

        it is true that the usa has decreasing privacy standards

        it is also true that china's privacy standards are orders of magnitude below the usa's standards, firmly entrenched in the toilet

        so i don't understand a point of view that is more concerned with flawed standards, but much better standards, than they are with a country that is an actual, no-apologies firmly authoritarian "i tell you who your master is and what you can can cannot think" regime

        it makes me wonder at your critical thinking skills

        when you ca

        • it makes me wonder at your critical thinking skills

          You might wonder at his critical thinking skills, while I wonder at your listening skills. The idea that one should be more concerned about the privacy policies of one's own government than of the Chinese is a perfectly valid viewpoint. Perhaps he's more concerned about the policies of the US because
          a) They actually impact him personally
          b) They are something he can actually do something about

        • so i don't understand a point of view that is more concerned with flawed standards, but much better standards, than they are with a country that is an actual, no-apologies firmly authoritarian "i tell you who your master is and what you can can cannot think" regime

          Because as US citizens we do have a say about what our country does, but there is practically nothing we can do to affect China's policies.

          My country, right or wrong.
          If right to be kept right.
          If wrong to be set right.

        • by Tridus ( 79566 )

          The other replies have it right. I travel to the US on a semi regular basis. The Department of Molestation (sorry, TSA) and the increasingly paranoia driven policies of the US government impact me. China does not.

          The US is also full of hypocritical politicians who get up on the world stage and talk about "freedom" this and that, while letting their own country slide into the toilet on that very thing. This nonsense has to be stood up. China doesn't spend as much time being holier-then-thou.

          Finally, Slashdot

      • by Chicken_Kickers ( 1062164 ) on Tuesday November 16, 2010 @04:45PM (#34247470)

        Chineeese! It's ALIVE! It's coming for YOU and your family! Hide in your bomb shelters! Wrap wet towels on your heads! Cover your bedrooms in tin foils. The Chineeese Terror is coming!!!

        Seriously, what is wrong with you Americans? Can't you and your government live through life without manufacturing an enemy to hate? What is it in your national psyche that requires an opponent? Is it because you actually bought into your own "we're the Good Guys(TM)" propaganda that the only way to validate this absurd world view is to manufacture "bad guys". My theory is that you are so hung up on WWII, the last "good war" that you fought in, that you and your leaders are subconsciously trying to recreate it so that you can feel good about yourselves again. Hence, the Axis of evil, war on terror, and now a more traditional enemy, the Red Peril. Get over it.

        • by Tridus ( 79566 )

          Well, I'm Canadian. And I think the commentary at the end is retarded. So I agree with your rant. :)

          The story is actually interesting on a technical level. Stuff happened, and a lot of traffic got rerouted to China. Without the commentary nonsense it'd be a fine article.

  • Hope you're encrypting your super secret stuff.

    I always encrypt sensitive data no matter if it routes through China, Sweden, the USA or any other country that may tap it.

    • That's best, among other things, but particularly given how the US government already has a track record of wholesale tapping of internet communications.

      • That's best, among other things, but particularly given how the US government already has a track record of wholesale tapping of internet communications.

        And China's doesn't? I mean ... really?

    • Re: (Score:3, Insightful)

      by Anonymous Coward

      If you only encrypt sensitive data it attaches a huge neon light to it.

      • Re: (Score:3, Funny)

        This is why I only anonymize and encrypt nonsensitive data, like MySpace traffic, dating sites, etc. You want my shopping wish list on Amazon?! CRACK MY ENCRYPTION, NSA!!! But that stuff about overthrowing the government is wide open. Throws 'em way off.
      • Re: (Score:3, Insightful)

        by Amouth ( 879122 )

        you know i just had that conversation with my general manager.

        except it was about shredding documents - they couldn't imagine someone going though a bag of strip shredded paper trying to find something.

        my comment was - it takes effort and a reason.. important info that shouldn't be public is a good reason.. and if you only shred important things it makes the effort all that much easier..

        needless to say we will be investing in a large capacity cross cut shredder - with hopes to put all our outgoing paper th

  • Invalid Certificates (Score:4, Informative)

    by Bios_Hakr ( 68586 ) <> on Tuesday November 16, 2010 @03:32PM (#34246284)

    From National Defense Magazine: []

    "If China telecom intercepts that [encrypted message] and they are sitting on the middle of that, they can send you their public key with their public certificate and you will not know any better," he said. The holder of this certificate has the capability to decrypt encrypted communication links, whether it's web traffic, emails or instant messaging, Alperovitch said. "It is a flaw in the way the Internet operates," said Yoris Evers, director of worldwide public relations at McAfee.

    What makes this really annoying is that a lot of .mil sites use self-signed certificates. When doing mil-2-mil browsing, you just get used to clicking whatever to get into the site. So, I can easily see how China could do a MITM without alarming any of the end users.

    • by Amouth ( 879122 )

      you know - i knew a lot of mil sites used self signed but i ASSUMED it was a government CA they where using.. not just server self signed..

      If i was the US government i would fix that.. make a US Government CA.. force all government sites to use it.. and to make sure that all computers belonging to me do not accept the China CA..

      • There was a funny thing at Brazil. Our government did go through that route, created a governemnt CA, ordered governamental sites to use it, but didn't do the small step of offering the certificates free of charge. That way, governamental entities must do a full selection process (a 6 month process, with luck) to get a certificate that is valid for a year. Guess what, most government sites at Brazil use a self signed cert.

    • Who is modding this informative? No mil sites use self signed certs. Please get your facts straight.
      • by bartwol ( 117819 )

        Who is modding this informative?

        In most cases, Slashdot posts are moderated by ignorant kids who harbor unsubstantiated biases, and consider "informative" any position that confirms what they already believe.

        Facts will rarely get in the way of beliefs.

      • Who is modding this informative? No mil sites use self signed certs. Please get your facts straight.

        From verifying a particular public-facing military website I have cause to frequent:

        $ openssl s_client -CApath /etc/ssl/certs -showcerts -connect [somecommand].mil:443
        depth=0 /C=US/O=U.S GOVERNMENT/OU=DOD/OU=PKI/OU=DISA/CN=[somecommand].mil
        verify error:num=20:unable to get local issuer certificate
        verify return:1
        depth=0 /C=US/O=U.S GOVERNMENT/OU=DOD/OU=PKI/OU=DISA/CN=[somecommand].mil
        verify error:num=27:certificate not trusted
        verify return:1
        depth=0 /C=US/O=U.S GOVERNMENT/OU=DOD/OU=PKI/OU=

        • Re: (Score:3, Informative)

          by Mr 44 ( 180750 )

          Hint: that issuer ain't Verisign. I don't know whether that's the official DoD cert or if that's one created by that particular organization, but I do know that it doesn't ship with any popular browser by default

          No, its not verisign. And of course they aren't self-signed, thats retarded. The US military has the largest PKI deployment in the world, they know a thing or two about certs. The DOD has their own root certificates which don't ship by default with commercial browser, since they aren't relevant f

  • by digitaldc ( 879047 ) * on Tuesday November 16, 2010 @03:33PM (#34246298)
    It remains unclear whether the redirection was intentional, the report says, but it demonstrates that it is possible for malicious actors to seize control of the Internet and redirect traffic.
    On April 8, according to Web security specialists, a small Chinese Internet service provider published a set of instructions under the Border Gateway Protocol, that directed Web traffic from about 37,000 networks to route itself via computer servers in China.
    The list was republished by China Telecom and briefly propagated itself across the global Web, which works on a trust system, with each server updating its routing instructions based on data provided by others in the network.

    What the hell is a 'trust system' anyway? Is that part of the Border Gateway Protocol? []
    Maybe someone needs to take a closer look at this 'trust system.'
    • by Amouth ( 879122 ) on Tuesday November 16, 2010 @04:19PM (#34247014)

      with BGP if I advertise my self as a route to a subnet others around me will try to send me that traffic IF they trust me.

      now with a small company like mine.. my telco doesn't accept any routes other than my own subnets so instead i would just black hole my self.

      now take a large telco or backbone provider .. say Level 3.. if they started advertising a route to my subnets then everyone who is closer to them then me (basically everyone) they will send L3 the traffic..

      this type of attack/what ever you want to call it - only works if you are a big enough player for your neighbors to believe what you are advertising.

      with my L3 example.. not every telco (or any really) would review that route change.. as for all they know i got a leased line from L3 or set up a peering agreement..

      the cardinal sin of BGP is to advertise a route that isn't yours. but that is all it is.. and advertisement.

    • Re: (Score:3, Insightful)

      What the hell is a 'trust system' anyway? Is that part of the Border Gateway Protocol? []

      Maybe someone needs to take a closer look at this 'trust system.'

      This is a classic example of the guy who doesn't know wtf he's talking about being the only one asking the questions that actually need to be asked.

      • No, the people that do know what they are talking about have been asking each other that question for a while. The problem is that there's no practical answer right now.

  • by schlachter ( 862210 ) on Tuesday November 16, 2010 @03:34PM (#34246308)
    Chinese Headlines claim for a period of nearly 21,018,240 minutes...nearly 100% of Internet traffic has been routed through the United States....wonder if they're worried about the balance of power?
  • Hope you're encrypting your super secret stuff.

    considering where it usually gets routed through.

  • Wasn't IPSec supposed to protect against stuff like this, so even if someone was able to route internal traffic through a hostile source, all that could be done would be traffic analysis (finding which machines put more packets on the wire than others)?

    • by blair1q ( 305137 )

      Works when your session is already established before the man gets in the middle.

      Gives you a false sense of security otherwise.

  • by thesandbender ( 911391 ) on Tuesday November 16, 2010 @03:39PM (#34246384)
    Well, maybe not 100% but it's established that the bulk of US traffic is trunked off to closets in AT&T (and other) switch rooms. This is going to include any communications going to points outside the US and (more importantly) any traffic that happens to be routed through the US while going between two points outside the US.
  • by techmuse ( 160085 ) on Tuesday November 16, 2010 @03:52PM (#34246588)

    There are two problems here:

    1) Can China redirect traffic through its network by advertising that it has the lowest cost routing path? (Apparently, yes.) This is a wormhole attack, and is well documented in research literature.

    2) Can China record or alter any traffic that passes through its network? If the data is sufficiently well encrypted, it can not read that data, although it can record the cyphertext. The fact that China can issue a certificate does not mean that it can read *your* data. It only means that encrypted data sent to Chinese servers can be read by the holder(s) of the encryption keys used by those servers.

    If you are sending data over the net, and want to protect it, be sure that it is encrypted. If you don't care, be aware that anyone might be able to monitor it, even governments of other countries. If you don't trust the Chinese root CA to certify the identity of servers that you go to, don't accept their CA's certificate as an authority for that purpose.

    • by RobNich ( 85522 )

      If the data is sufficiently well encrypted, it can not read that data, although it can record the cyphertext. The fact that China can issue a certificate does not mean that it can read *your* data.

      If they used a Man-In-The-Middle attack during the routing change, creating signed certificates using a top-level CA, they won't even need to decrypt anything. In addition, having the cypher text means that they can spend a few months or years using brute-force to decrypt it (or less, now that they have the fastest supercomputer in the world). Once they do, they'll have the keys for those sessions. Using that, they may even be able to derive the server's private key.

      At the very least, they have a copy of th

      • Breaking modern encryption algorithms using current techniques would take somewhere around the lifetime of the universe. The number of computations required to break a well designed algorithm increase exponentially with the key length. You should always use an algorithm and key length that can be expected to protect your data for longer than the data will remain valuable.

        As I indicated in my explanation below, being able to create a certificate does not mean that they can trick you into trusting their sit

    • 2) Can China record or alter any traffic that passes through its network? If the data is sufficiently well encrypted, it can not read that data, although it can record the cyphertext. The fact that China can issue a certificate does not mean that it can read *your* data. It only means that encrypted data sent to Chinese servers can be read by the holder(s) of the encryption keys used by those servers.

      I don't think you understand MITM attacks.

      Take a moment to look at the list of trusted root certificate authorities in your web browser right now.
      FF Preferences > Advanced > Encryption > View Certificates

      Notice the Chinese ones? The Chinese government can compel any of those root CAs to produce a certificate for any domain they choose. For example, let's say CNNIC [] creates rogue certs for

      1) You request a secure page ""
      2) MITM intercepts the request and makes their own connection to using the real cert.
      3) MITM uses the fake cert to encrypt it's connection to you, and pass you the data.
      4) Firefox validates the cert chain and gives you a big "look it's secure" bar, and you just got pwned.

      The real problem is with the retarded cert system. Any CA can create certs for any domain without the domain's permission; If the CA is trusted your browser won't complain at all.

      This is why it's important to view the certs that you are using (in Firefox, click or hover over the "secure" bar).
      Note: If you had a cookie that kept you signed in to gmail, its too late to check the cert after the MITM is logged into your account.

      • Re: (Score:3, Insightful)

        Please excuse the reply to myself, but I'd like to point out that I'm not trying to single out China here, the above statements apply to USA, UK, Canada, or government that a trusted Root CA company resides within.

        Eg: The US Government could compel (and also gag-order) Thawte into creating fake certs for (or any other domain), and in Google's case, you wouldn't even find out you've been pwned by checking the cert...

        Honestly, HTTPS / SSL is The Ultimate Theater of Security.

      • Certificates aren't used to encrypt anything. The certificate contains a set of assertions about the subject of the certificate, signed by the certificate issuer. One of those assertions is typically the subject's public key. All the certificate is claiming is that a certain public key is associated with a certain identity, where that identity is claimed by the certification chain starting at some root (in this case, the Chinese CA). If you trust a certain root CA, then you also must trust any assertion

        • by gazbo ( 517111 )
          ...and why exactly would they want to use Google's private key instead of, say, the one they just created a signed certificate with?
  • We can't afford the cost to administrate secrets. With all the current data gathering and monitoring techniques, the only people who can afford the cost of keeping actual secrets are professional sleuths or top level government and corporate people. They hold secrets on and from each other, but mostly from us. It seems the game is inverted now - by fighting to protect our right to illusory privacy, in practice we mosly protect their right to keep secrets from us.
    • by Dunbal ( 464142 ) *

      and corporate people.

            Hah, just today my significant other responded to an email from someone lower down the ladder that read something like "if you don't want me to publish information X on the grounds that it was confidential, then why did you send it to me to be published?"

            No, I wouldn't put all my money on the corporate world being able to keep secrets.

  • by antifoidulus ( 807088 ) on Tuesday November 16, 2010 @03:59PM (#34246690) Homepage Journal
    If you manage to end up in China when driving a station wagon full of tapes from North Carolina to DC you REALLY are doing it wrong.
  • In China, only 15% of everyone is famous for 18 minutes.

  • They were designed years ago, for an environment where it was actually somewhat sensible for everyone to trust everyone else. Major routing screwups like this, DNS cache poisoning exploits, the type of attack demonstrated by FireSheep, and even plain ol' spam are all possible largely because the underlying protocols are not secure.

  • For US citizens: Chinese government spying on your traffic is way less harmful than US government spying on your traffic. I mean, what can they do with that data? Sending you spam?
  • If you want to know if China is hijacking your data just looks for the bits that are shifted left.

    Ah ha! I found you, Comrade Ping!

  • This story is rooted in ridiculous xenophobia.

    You have more to fear from your wi-fi or cable snooping neighbor than from China.

    Security must be end-to-end. There is no such thing as a trusted ISP or country.

    • The point isn't that it was routed through China per se; the point is that it is so easy to hijack the traffic of a large portion of the 'net. As has already been pointed out, anything sensitive should be encrypted anyway.
    • Security must be end-to-end.

      And how can that be achieved? At some point you have to trust your Browser, OS or hardware vendor / manufacturer.

      There is no such thing as a trusted ISP or country.

      Tell that to all the "Trusted Root CAs" installed in your browser. Who did you trust to put them there? The governments that those CAs reside in can coerce them into creating fake certs; This requires an implied trust in the country those CAs reside in.

      IMO, "end to end" security is not used at all during a HTTPS connection, it's inheretly a 3 party process: You, Them, The CA. Encrypted data m

  • It would explain the increase in Chinese spam that I see since April 18th ;)

  • 15% went into China. 9% came out???
  • by 93 Escort Wagon ( 326346 ) on Tuesday November 16, 2010 @04:58PM (#34247648)

    But I thought Richard Nixon and Rosemary Woods were both dead...

  • I attended a Unisys presentation in July (or so). They presented 256-bit encryption, which (by the sound of it) is out there already, used by the US Military (and suchlike) and allows the messages to go over the common internet.

    As for my own stuff - they're welcome to see that I've ordered such-and-such a book, or that Cousin Thomas's measles are clearing up. Face it folks - most people's lives aren't that interesting. Except to themselves.

  • It doesn't matter if the traffic was hijacked by China or the NSA, All traffic should be encrypted by default!

Any sufficiently advanced technology is indistinguishable from a rigged demo.