Russian DNS Gobbling Up Internet Traffic

BGPMON researchers have found that Russian DNS servers redirected Internet traffic through Russia several times earlier this month. The question is whether its a test or a harbinger of things to come.

Two incidents that occurred over three hours on December 12 showed how vulnerable the Internet remains to misrouting.
Security firm
BGPMON
found that for the two incidents of three minutes each, traffic for 80 high-volume sites such as Facebook , Google (Nasdaq: GOOG), Microsoft Corp. (Nasdaq: MSFT) and Apple Inc. (Nasdaq: AAPL) were rerouted to Russia before being transmitted out. Researchers posted notice of this occurrence
on their blog
.
This unusual routing was done by rewriting the global Border Gateway Protocol (BGP) routing tables used by the Domain Name System (DNS) to push Internet traffic through itself. The BGP makes routing decisions based on paths, network policies or rule-sets that are configured by a network administrator, who is involved in making core routing decisions.
What happened was significant since it was picked up by a large number of other routing ISPs that connected to this rogue path, and several new more specific prefixes that are not normally seen on the Internet were generated by it.
(Source:
Bilder_meines_Lebens via Pixabay
)
High-volume prefixes were being broadcast; the kind that would attract high levels of traffic.
Now, the Origin Autonomous System (AS) 39523 (DV-LINK-AS) hasnt been seen announcing any prefixes for many years, except for one incident involving Google and Verizon that was also strange. The incident had traffic on its way to
Verizon routed through Google
, which cant handle it. There were some massive outages because of it.
BGPMON described the nodes behavior at that time in this way:

In August Google learned a path to 66.232.224.0/24 (Kohls Department store) with origin 39523. Without knowing more about this prefixes, it looks strange and unexpected for Google to learn a Kohls Department store Prefix via this path.

Now, this latest incident may have been some sort of test run. Considering the already announced plan by Russia to have its own backup DNS servers, this current effort could have been some sort of proof of concept that was run to see if the country could do it.
It did.
All of this shows that the connecting ISPs will have to accept that they can never totally trust the DNS routing tables they may get, but will have to add their own filters to the stream. Mistakes can happen due to Intent or from human error. The DNS system is based on trust, and that trust may be fraying.
Related posts:
Small Businesses Need Secure ISPs
Dispatch From the CyberWar: An Interview With Joseph Carson
The New Nation-State Normal
— Larry Loeb has written for many of the last centurys major dead tree computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Last News
▸ Protecting the end system from cyber threats ◂ Discovered: 26/12/2024 Category: security	▸ Tackling The TDoS Threat. ◂ Discovered: 26/12/2024 Category: security	▸ Ruby On Rails Under Attack ◂ Discovered: 26/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Russian DNS Gobbling Up Internet Traffic