On Wednesday, large chunks of network traffic belonging to MasterCard, Visa, and more than two dozen other financial services companies were briefly routed through a Russian government-controlled telecom under unexplained circumstances that renew lingering questions about the trust and reliability of some of the most sensitive Internet communications.
Anomalies in the border gateway protocol—which routes large-scale amounts of traffic among Internet backbones, ISPs, and other large networks—are common and usually the result of human error. While it’s possible Wednesday’s five- to seven-minute hijack of 36 large network blocks may also have been inadvertent, the high concentration of technology and financial services companies affected made the incident “curious” to engineers at network monitoring service BGPmon. What’s more, the way some of the affected networks were redirected indicated their underlying prefixes had been manually inserted into BGP tables, most likely by someone at Rostelecom, the Russian government-controlled telecom that improperly announced ownership of the blocks.
“I would classify this as quite suspicious,” Doug Madory, director of Internet analysis at network management firm Dyn, told. “Typically accidental leaks appear more voluminous and indiscriminate. This would appear to be targeted to financial institutions. A typical cause of these errors [is] in some sort of internal traffic engineering, but it would seem strange that someone would limit their traffic engineering to mostly financial networks.”
Normally, the network traffic bound for MasterCard, Visa, and the other affected companies passes through services providers that the companies hire and authorize. Using BGP routing tables, the authorized providers “announce” their ownership of the large blocks of IP addresses belonging to the client companies. On Wednesday afternoon at around 3:36pm Pacific time, however, Rostelecom suddenly announced its control of the blocks. As a result, traffic flowing into the affected networks started passing through Rostelecom’s routers. The hijacking lasted five to seven minutes. When it was over, normal routing was restored. The event is nicely captured in a graphic here, which uses BGPlay.
The hijacking could have allowed individuals in Russia to intercept or manipulate traffic flowing into the affected address space. Such interception or manipulation would be most easily done to data that wasn’t encrypted, but even in cases when it was encrypted, traffic might still be decrypted using attacks with names such as Logjam and DROWN, which work against outdated transport layer security implementations that some organizations still use.
Madory said that even if data couldn’t be decrypted, attackers could potentially use the diverted traffic to enumerate what parties were initiating connections to MasterCard and the other affected companies. The attacker could then target those parties, which may have weaker defenses.
According to shareholder information provided by Rostelecom, the Russian government owns 49 percent of the telecom’s ordinary shares. The US Department of Commerce lists Rostelecom as a state-owned enterprise and reports that one or more senior government officials have seats on Rostelecom’s board of directors. Rostelecom officials didn’t respond to e-mail seeking comment for this post.
The affected company networks also included those belonging to security provider Symantec and technology company EMC. A list of 36 affected network prefixes and registered owners and locations of those prefixes are:
- 22.214.171.124/24 Reliance Communications Bangalore State of Karnātaka IN
- 126.96.36.199/24 Euro-Information-Europeenne de Traitement de l’Information SAS Paris Île-de-France FR
- 188.8.131.52/24 Fortis Bank N.V. Brussels Bruxelles-Capitale BE
- 184.108.40.206/24 Servicios de Hosting en Internet S.A. ES
- 220.127.116.11/24 Norvik Banka LV
- 18.104.22.168/24 Modrium Mdpay Oy NUF Øy Nord-Trøndelag Fylke NO
- 22.214.171.124/24 NET_217_117_65 UA
- 126.96.36.199/24 REDSYS SERVICIOS DE PROCESAMIENTO SLU
- 188.8.131.52/24 Arcot Systems, Inc. Sunnyvale CA US
- 184.108.40.206/24 Savvis Singapore SG
- 220.127.116.11/24 VISA INTERNATIONAL CO US
- 18.104.22.168/24 HSBC banking and financial services Hong Kong HK
- 22.214.171.124/24 Internet Solutions Johannesburg Gauteng ZA
- 126.96.36.199/24 Savvis Arlington VA US
- 188.8.131.52/24 EMC Corporation Southborough MA US
- 184.108.40.206/24 UBS Card Center AG Glattbrugg Kanton Zürich CH
- 220.127.116.11/24 HSBC banking and financial services Hong Kong HK
- 18.104.22.168/24 Xand Corporation Farmingdale NY US
- 22.214.171.124/24 Bank Zachodni WBK S.A. Poznań Województwo Wielkopolskie PL
- 126.96.36.199/24 Servicios Para Medios De Pago S.A. ES
- 188.8.131.52/24 TIME DOTCOM BERHAD Shah Alam Selangor MY
- 184.108.40.206/24 Worldline France hosting FR
- 220.127.116.11/24 Euro-Information-Europeenne de Traitement de l’Information SAS Strasbourg Alsace FR
- 18.104.22.168/24 card complete Service Bank AG Vienna Wien AT
- 22.214.171.124/24 PROVUS SERVICE PROVIDER SA Bucharest București RO
- 126.96.36.199/24 Verisign, Inc. New York NY US
- 188.8.131.52/24 DOCAPOST BPO SAS FR
- 184.108.40.206/24 Worldline SA Frankfurt am Main Hessen DE
- 220.127.116.11/19 Servicios de Hosting en Internet S.A. Madrid Comunidad de Madrid ES
- 18.104.22.168/24 DNBNORD PLC LV
- 22.214.171.124/24 VISA INTERNATIONAL CO US
- 126.96.36.199/24 MasterCard Technologies LLC Wentzville MO US
- 188.8.131.52/24 SIA S.p.A. Milano Lombardia IT
- 184.108.40.206/24 Symantec Inc Mountain View CA US
- 220.127.116.11/24 Netcetera AG Zürich Kanton Zürich CH
- 18.104.22.168/24 Symantec Inc Mountain View CA US
The above list filtered out 14 Russia-based prefixes that Rostelecom announced around the same time.
Both Madory and the BGPmon blog post leave open the possibility that the hijacking was inadvertent. Assuming it wasn’t an accident, it wouldn’t be the first time BGP traffic was intentionally diverted. In 2013, Renesys—which was later acquired by Dyn—reported that huge chunks of Internet traffic belonging to financial institutions, government agencies, and network service providers had been repeatedly redirected to distant locations before finally being passed on to their final destination. Over a nine-month span, the Renesys researchers counted 38 distinct diversions to routers at Belarusian or Icelandic service providers. The hacks affected “major financial institutions, governments, and network service providers” in the US, South Korea, Germany, the Czech Republic, Lithuania, Libya, and Iran.
Such hijacks underscore the implicit trust governments and corporations all over the world place in BGP routing announcements. For years, engineers have proposed a variety of measures to ensure service providers can announce only those networks they’re authorized to carry. At the moment, however, there is no authoritative way to do so. Dyn, BGPmon, and similar services do a good job detecting when unauthorized announcements are made, but those detections inevitably come after improper redirections or hijackings have already occurred.