China Telecom Hijacks US, Canadian Internet Traffic On a Regular Basis, Report Says (itnews.com.au) 64
Bismillah writes: China Telecom is up to no good with Border Gateway Protocol (BGP) shenanigans researchers have discovered. The state-owned telco is hijacking and rerouting internet traffic to China via it's U.S. and Canadian points of presence (PoPs). As for how the researchers came to their conclusion, they reportedly "built a route tracing system that monitors BGP announcements and which picks up on patterns suggesting accidental or deliberate hijacks and discovered multiple attacks by China Telecom over the past few years," reports iTNews.
In one example occurring in 2016, "China Telecom diverted traffic between Canada and Korean government networks to its PoP in Toronto," the report says. "From there, traffic was forwarded to the China Telecom PoP on the U.S. West Coast and sent to China, and finally delivered to Korea. Normally, the traffic would take a shorter route, going between Canada, the U.S. and directly to Korea." The telecommunications company is able to reroute the traffic by announcing fake routes via the BGP, which "governs data flow between Autonomous Systems, the large networks operated by telcos, internet providers and corporations."
In one example occurring in 2016, "China Telecom diverted traffic between Canada and Korean government networks to its PoP in Toronto," the report says. "From there, traffic was forwarded to the China Telecom PoP on the U.S. West Coast and sent to China, and finally delivered to Korea. Normally, the traffic would take a shorter route, going between Canada, the U.S. and directly to Korea." The telecommunications company is able to reroute the traffic by announcing fake routes via the BGP, which "governs data flow between Autonomous Systems, the large networks operated by telcos, internet providers and corporations."
Re: (Score:1)
So what do we do about it? (Score:3, Interesting)
Is anyone going to impose any actual consequences, or are they just too damn big?
Re: (Score:2)
Re: So what do we do about it? (Score:1)
My hunch is that they are doing this at peering exchanges where you normally have wide open filters with a prefix limit.
If they keep pulling these kind of route highjacking, you could probably set up bgbmon and setup a script to auto block any prefixes they are hijacking.
Re:So what do we do about it? (Score:5, Insightful)
Oh, I have an idea. How about we stop allowing border gateway maintenance to be policed exclusively by the honor system?
Re: (Score:2)
There are moves afoot to address this, but not currently going so well: https://blog.apnic.net/2018/10... [apnic.net]
Re: (Score:2)
All the purchase orders for the billions of things we buy and depend upon could not be processed. Store shelves would be empty and hyperinflation would take root due to the scarcity of supply of pretty much everything.
Re: (Score:2)
Enough hand-wringing. Your contention is simply fear-mongering. The BS of ecosystem betrays your sense of fragility, and not the reality of the situation.
There would be a disruption. Alibaba and more would rapidly crater. Supply chains would be broken. Apple might have a bad quarter. Poor Apple.
On the ground in the USA, some farmers would be selling bacon and soybeans really inexpensively. Other markets would be found. The ASEAN currencies would go like rollercoasters as new supply chains are made. The pric
Re: (Score:2)
I don't like that the US is so heavily dependent on foreign trade but that is the mess we are in right now. I agree we must act.
My company manages software for a number of major retailers that I'm sure you and most everyone else shops at all the time. We manage all their product data and purchase order systems. Most of our customers are healthcare, hardware, crafts, sporting goods retailers and transportation parts. I'm not fear mongering, I
Re: (Score:3)
Are the tariffs stupid? Didn't comment on that.
This morning I looked at some of the website my organizations manage. The attacks came 84% from China origin. Pakistan, Albania, Azerbaijan, and even France trailed well behind.
I try to specifically not buy Chinese goods, especially Chinese foods. Certainly others do. I try to put my money where it will do the most good, and that's as local as possible. This said, the dependency that US Corporate industry has put on China now enslaves them to a regime that supp
Re: (Score:2)
The automotive manufacturing system would continue to run for a short time while the already in-transit materials were coming in.
Re: (Score:2)
I won't argue vast supply chain. You over-estimate the size and demand and impact. So we must disagree. There is no doubt that a disruption would occur. The magnitude and outcomes would crash a decided number of businesses. Would it cause a burden? Yep. Could it be surmounted? Certainly not easily, but in certainty, what has been woven into a cloth of low-cost labor fealty can be unwoven. Given the madness of their current regime, it may have to be. Extricating supply chain from China would be onerous, but
so use RPKI (Score:5, Informative)
the canadian government is surprised to find china did exactly the same thing to them as they did to china...
come on just implement signing and validation...
https://blog.benjojo.co.uk/post/are-bgps-security-features-working-yet-rpki
also get on your DNSSEC and DANE implementations
Re: (Score:3, Insightful)
Re: so use RPKI (Score:5, Informative)
Using BGP is the normal way routes are exchanged between carriers on the Internet. It is absoloutely normal for carriers in different countries to have BGP sessions with each other.
The problem is a combination of laziness and resource limitations mean that carriers and other networks end up trusting each other. Sure filters can be put in place in theory but on a link where thousands of prefixes are normally exchanged maintaining those filters is both a a PITA and a resource drain on the routers.
Adding to that many networks are cheapskates. Rather than take the shortest path to a destination they will take the cheapest. i.e. they will prefer sending the traffic to a peer or downstream over sending it to an upstream.
The result of this is it's easy for traffic to get diverted, either accidentally or maliciously, and as long as the traffic reaches it's destination without undue delays it is very likely that no one will notice.
Re: so use RPKI (Score:4, Informative)
Not only that, but traffic going from canada to korea via china isn't unreasonable, it could be the cheapest route or the direct routes could be unavailable for whatever reason. If the traffic was destined from canada to the us and went via china that would be far more suspicious.
Re: (Score:2)
If the traffic was destined from canada to the us and went via china that would be far more suspicious.
Not necessarily. I know Virgin Media used to route traffic from one of our customers about 5 miles away across the Atlantic and back.
Re: (Score:2)
Going to CHina would be one of the more expensive routes.
Look at this map. VERY FEW Chinese locations are shared between America, and South Korea. [submarinecablemap.com]If looking for a 3rd indirect hop, Japan would be far more likely. In fact, it was obviously designed for just that. Multiple links from America go to Japan. In every location that has an American link, also has links to S. Korea.
Re: (Score:2)
Repeat after me (Score:5, Interesting)
As an Internet user you have no control over where your packets go or how they are routed. China could re-route them. The NSA could re-route them. Your ISP could re-route them. The only "guarantee" you get is the Internet will try really hard to get your packets there by any means necessary. Because there is no way to know where your packets are going to go, you should assume that *anyone* could be reading your packets. ("Packets" meaning the web pages your browse, the credit card details you enter on a website, the emails you send, etc.)
This of course doesn't matter because you encrypt everything you send across the Internet right?
Re: (Score:2)
Tor in a VPN in another VPN.
Re: (Score:1)
Encryption is not a fix-all measure.
It can be hacked or circumvented (corrupted certificate system for example).
You do not always have the choice to select your desired level of encryption (accessing internet based services)
And metadata is data too.
Stopped even trying.. (Score:2, Interesting)
I've given up trying to tell ISP's when their networks are hijacked (it happens, a lot). It's not just China either, Comcast likes to engage in it's own hijacking for example. Many networks simply don't give a shit or want free consulting.
I'm sure there are some of you here that understand BGP but for the rest, in short it's not necessarily a case of Provider C announces Provider A's networks such that Provider B routes through C. There are quite a few metrics that go into how routers decide one route
Neat, but doesn't matter. (Score:2, Informative)
Just encrypt your traffic.
Man in the Middle has Always Been a Risk (Score:2)
USA is worse. (Score:1, Flamebait)
>> China Telecom Hijacks US, Canadian Internet Traffic On a Regular Basis, Report Say
Stop whining when others follow your bad example it !
"USA Government Hijacks Worldwide Internet Traffic On a Constant Basis"
Everybody.
All the time.
Consistently.
Get real solid open encryption, and stop whining.
I wonder if data was modified? (Score:2)
I am from China, but ... (Score:1)
well, you see the beginning of the story. I am a client of China-telecom, but I find my CN-2-CN traffic is routed via China-Taiwan node (yep. you can say it is china), which makes no sense at all. Judging from this report, it is some Canada-China-(another AS)-(perhaps China again)-specified destination. In my understanding it is now a Tor-like relaying structure.
To make it worse, in order to protect China's internet censor system (content review on .., e.g,, similar to china's version of whatisup message, n
IPV6? (Score:3)
sanctions (Score:3)
I still wonder why instead of current economic sanctions on Russia, USA did not enforce "cut all BGP traffic to Russia; if 3rd country operator transfers BGP traffic for Russia, it gets cut away". Just like in 2001 they forced nearly all nations to join "battle on terrorism".
It would be much more efficient, resulting in:
- cutting Russian hackers
- cuttting Russian troll factories influencing US politics
- cutting Russian espionage
Just profit. Losses minimal compared to profits.
With China such sanction would be more difficult, on the other hand it would make making business with China much more diffiult, so easier to replace Chinese products with local ones.
Simple solution (Score:2)
The solution to this is of course not allowing the China Telecom to add anything to the BGP. Very simple.
Okay, that does it! (Score:2)
I'm going to write a very angry letter to Ottawa!
Signed,
a Canadian.