Russian-Controlled Telecom Hijacks Traffic For Mastercard, Visa, And 22 Other Services (arstechnica.com) 76
An anonymous reader quotes the security editor at Ars Technica:
On Wednesday, large chunks of network traffic belonging to MasterCard, Visa, and more than two dozen other financial services companies were briefly routed through a Russian government-controlled telecom under unexplained circumstances that renew lingering questions about the trust and reliability of some of the most sensitive Internet communications.
Anomalies in the border gateway protocol -- which routes large-scale amounts of traffic among Internet backbones, ISPs, and other large networks -- are common and usually the result of human error. While it's possible Wednesday's five- to seven-minute hijack of 36 large network blocks may also have been inadvertent, the high concentration of technology and financial services companies affected made the incident "curious" to engineers at network monitoring service BGPmon. What's more, the way some of the affected networks were redirected indicated their underlying prefixes had been manually inserted into BGP tables, most likely by someone at Rostelecom, the Russian government-controlled telecom that improperly announced ownership of the blocks.
Anomalies in the border gateway protocol -- which routes large-scale amounts of traffic among Internet backbones, ISPs, and other large networks -- are common and usually the result of human error. While it's possible Wednesday's five- to seven-minute hijack of 36 large network blocks may also have been inadvertent, the high concentration of technology and financial services companies affected made the incident "curious" to engineers at network monitoring service BGPmon. What's more, the way some of the affected networks were redirected indicated their underlying prefixes had been manually inserted into BGP tables, most likely by someone at Rostelecom, the Russian government-controlled telecom that improperly announced ownership of the blocks.
So? (Score:5, Insightful)
I'm sure all the relevant important traffic for these sites was and is at least TLS encrypted, right? Right?
And it's not as if that espionage on banks isn't a totally normal thing:
https://www.wired.com/2017/04/... [wired.com]
http://www.spiegel.de/internat... [spiegel.de]
http://www.reuters.com/article... [reuters.com]
Not just a few banks or lowly consumer creditcard companies, but SWIFT itself, the system that all banks use to transfer money around the globe. Not just traffic but actual inside data.
Not to mention a ton of routers inside various banks all over the middle east.
Re: (Score:2)
Re: (Score:3, Insightful)
If the banking system uses the CA Network and CAs of consumer browsers as their web of trust, to secure financial transactions, then they need to be defrauded of every single penny they have so they can go bankrupt in the next 5 minutes hopefully. We'd all be better off, seriously.
Re: (Score:2)
For consumers, I'd expect them to use pinning as a supplementary measure. It would limit the damage if someone did manage to get hold of a valid certificate, hopefully giving the bank time to react before the theft progresses from hundreds of thousands of dollars and into the tens of millions.
Re: (Score:3)
I'm sure all the relevant important traffic for these sites was and is at least TLS encrypted, right? Right?
Yep, but it was auth-only TLS because adding confidentiality protection creates too much overhead and banks mostly care about auth/integrity, not confidentiality.
Empahsis noted -- "Russian-controlled" (Score:3, Insightful)
I wonder what the headline would have been if it were US entities doing the same thing; with no fact checking by main stream media.
Think about all the lies we've been fed on all this time...
Re: Empahsis noted -- "Russian-controlled" (Score:3, Informative)
They've done it before, go Google. Here's a piece from 2013, and funnily enough it's from rt.com.
https://www.rt.com/usa/mtm-renesys-redirect-internet-775/
Re: (Score:1)
Suggest that you read this guy's past comments before upvoting, to see if there's an agenda. Not that he's wrong, but, you know, smells like russian trolling nonetheless...
And how did such a mundane comment get so highly modded so fast? Curious.
Rostelecom = Russian Government (Score:1)
There's lots of these, e.g. you'll see VneshEconomBank used to bailout Putin projects and host spies in its offices abroad.
e.g. A Russian agent was caught and prosecuted in its New York office:
https://www.rawstory.com/2017/03/revealed-jared-kushner-met-with-head-of-russian-bank-that-hosted-spy-ring-busted-by-preet-bharara/
They really are a rogue nation at this point, ISIS kill a few people, but Russian *invades* allied countries, actively tries to take them over, it's government hackers constantly attacking
Re: (Score:2, Insightful)
You know when you use phrases like "no fact checking by main stream media" your entire argument is nullified by the fact it shows you be a conspiracy theorist kook right?
The mainstream media are the ones who fact check - it's the non-mainstream media that has thrived on fake news. I don't know how that hasn't been obvious, but I guess you're just a contrarian retard who likes to pretend his smarter than everyone by seeing the REAL story, rather than by, you know, actually being smart. Whatever floats your b
4 out of 30 are French (Score:2, Interesting)
Is it also coincidence that 4 out of 30 are French?
We got election in France with Le Pen with very close ties to Russia.
Did not Clinton lose thanks to Russian hackers that broke into her email?
Re: (Score:3)
Did not Clinton lose thanks to Russian hackers that broke into her email?
Clinton lost because the Democrat party lost.
br. The Democrat party lost because their leaders as a whole are the worst corporate tools that there has ever been.
Re: (Score:2, Interesting)
The election was so close that even the tiniest factor could have influenced the outcome. The email hacks revealed a little bit of dirt in the form of taking money from finance companies for speaking appearances, and it gave some information on DNC campaign plans to their Republican counterparts. It's possible that turned what would have been a narrow victory for Clinton into a narrow victory for Trump.
Remember that Clinton actually got more votes. Trump got less, but he did best in states which the elector
Re: (Score:2, Insightful)
So I am taking they would have taken the same stance on the Dewey - Truman election as well. They would have expressed such vitriol in that day and age where one would accept the loss and move on and ensure to do better the next time.
Honestly, I believe that we are fortunate to have documented proof of what most only had suspicions of in regarding how these people (e.g. career politicians) operate. I am still waiting for the Congressional Term Limits to at least be talked about. I would LOVE to see thi
Re: (Score:2)
Familiarity breeds typos.
Why shouldn't the metropolitan areas have a say proportional to their population? That's the obvious way to do it: Everyone gets a vote, all votes are equal. The electoral college says that people in some states, specifically those with lower population, are worth more in votes than someone in a more populated state.
If they are worth anything, that is. Another effect of the college system is the creation of safe and swing states: If you live in Texas or Alabama, you can be sure your
Re: (Score:3)
Yeah, swing states prove the electoral college is worthless. Rust Belt states like Pennsylvania, Michigan and Wisconsin are such safe Democratic strongholds that no presidential candidate with an (R) after their name should bother campaigning there.
Re: (Score:3)
I think a lot of people saw the election as "Douche v Asshole."
Re: (Score:2)
Now that I would agree on. I am sure there were quite a lot of people who saw that it really did come down to the lesser of the two evils.
Re: (Score:2)
Here is the real kicker.... Trump got more vote in Wisconsin than the loser in 2016 election. DOH!
Re: (Score:2)
Okay, then as a less populated states that are dedicated to feeding the overinflated egos of larger cities, we could vote to cut all foods going into your cities until you realize what is good for a metropolitan area is not necessarily good for the rural area (and yes both are important). Good luck with getting their bread, water and electricity. The only reason large cities still exist is because they are supported by everything outside their own domain.
Your comment on they should have more say is the rea
Re: (Score:3)
BTW, he did best in states where the electoral college, not collage, worked as designed.
This, btw, is false.
If the intention of the founders was to over-represent rural areas, then they would not have included the size of the House delegations in the number of Electoral College votes. Because it doesn't make any sense to have the difference in Electoral College vote size based on population if your intention was to represent states.
What's going on is an artifact of the size of the House, and the fact that we have not expanded the number of House members since the early 1900s.
It appears the fo
Re: (Score:2)
So the current process worked as it was devised even after the 435 limit was imposed in 1929. The purpose of the 435 limit was to address concerns about the more populous areas having too much influence thus eventually silencing the rural areas.
Re: (Score:2)
No on both counts.
The system is not working as devised, because the Electoral College was not intended to boost rural states beyond the +2 votes every state gets for Senators. Since every state gets the same +2, its an insignificant boost compared to House delegation size. To stick with CA vs WY, that's +53 votes for CA House delegation, and +1 vote for WY.
Second, the House is not the check on populous states dominating rural states. That's the Senate, where rural states do have massively out-sized power
Re: (Score:2)
It was not originally designed for a two party system but was that only lasted the first four presidents (16 years). It was later adapted to take that into account. So, that makes me NOT a liar and makes you misinformed. The limit is the 435 limit of the House that effect the number of electoral votes for each state. It's purpose was exactly that no populous area will attain so much influence that they will plow over any smaller area.
Re: (Score:1)
The election was so close that even the tiniest factor could have influenced the outcome.
If that's true, then the interference or subversion of democracy or whatever was tiny.
Are you disasterizing or minimizing? Pick one. This is not even motte-and-bailey; it's plain old vacillation and talking in circles.
Personally, I'm going with "hypothetical disaster":
- Russia could have hacked the voting results themselves, but probably didn't. [media.ccc.de]
In response, what we need is not McCarthyist Russia scapegoating. We need a voter-verifiable paper trail and laws that automatically
Re: (Score:2)
No, the "worst corporate tools that there has ever been" would be the Republican party in general. Lower taxes on corporations and the wealthy meanwhile slashing social programs? The Democrats are certainly not perfect and Clinton most assuredly so but the Republican's economic policy clearly puts them in favor of the oligarchs over the common person. Their economic policy could not be more tailor maid to reduce the middle class in favor of enriching the affluent.
Re: (Score:2)
The Democrat party lost because their leaders as a whole are the worst corporate tools that there has ever been.
What? And also what? The republicans are much worse. Much, much worse. Democrats occasionally try to help people. Republicans only try to help corporations. It's true that the Democrats lost because their leaders are corporate tools, but calm your hyperbole there, son.
The U.S. does this regularly (Score:2, Interesting)
in addition to all other spying on the world, but of course we're not allowed to talk about that. If something like this happens, most likely accidentaly, then all the shit-outlets on the Internet are quick to blow it up and point fingers.
They just wanted to say (Score:2)
Papers Please Comrade Data... before the data left Russian borders.
Collection network leaking into prod network (Score:3, Insightful)
Likely explanation:
- rostelcom is running a collection network spying on these netblocks.
- They use BGP within the collection network to limit what's collected and avoid DoSing themselves. BGP is a good protocol for custom stuff because it's simple to write and debug an endpoint, and it interoperates well.
- Misconfiguration leaked collection net prefixes onto the public Internet.
If that's true, the collection is ongoing.
No news here: NSA is collecting the same and more of both these networks and Russian financial networks. Go back to sleep, sheeple.
Oh great (Score:1)
"Russian-Controlled Telecom Hijacks Traffic For Mastercard, Visa, And 22 Other Services."
Well that's just fucking splendid.
5 to 7 minutes? (Score:2)
5 to 7 minutes sounds like the reboot time of a major router when the admin didn't understand the redundancy features.
MasterCard is connected to my local peering exchange via their DDoS protection provider. There is no way that route would go via Russia unless the DDoS provider globally dropped all their other routes. Some of the listed companies also have a large global peering presence as well.
The internet seems designed to be abused. (Score:2)
No fixes for BGP hijacks, no mandatory ingress/egress filtering for ISPs, all the major browser manufacturers refusing to implement DANE. Don't attribute to malice what you can attribute to incompetence I guess ... extreme fucking incompetence.
Build a new internet already, so we can let the old internet rot.