<story><title>Someone’s Been Siphoning Data Through a Huge Security Hole in the Internet</title><url>http://www.wired.com/threatlevel/2013/12/bgp-hijacking-belarus-iceland/?cid=co15315354</url></story><parent_chain></parent_chain><comment><author>PhantomGremlin</author><text>Bah. Real simple cure for this nonsense. Too bad it&amp;#x27;s unlikely to happen.&lt;p&gt;Back when Usenet mattered, there used to be something called a &amp;quot;Usenet Death Penalty&amp;quot;. What we need here is an &amp;quot;Autonomous System Death Penalty&amp;quot;.&lt;p&gt;BGP works between &amp;quot;Autonomous Systems&amp;quot; (aka AS). ISPs almost invariably are. Bigger companies usually are. Anyone who wants to be independent of their upstream IP connection gets an AS number. The only way some ISP in Belarus can interfere with your IP packets is to announce over BGP that packets should be sent to their AS.&lt;p&gt;So anyone who was affected by some rogue ISP in Belarus should simply tell their BGP routers to totally ignore anything from that AS. Forever. And if they&amp;#x27;re a govt agency they simply tell Comcast, Verizon, AT&amp;amp;T, etc to drop any and all packets from that AS. To anywhere! And if it&amp;#x27;s a govt agency making this &amp;quot;request&amp;quot;, there&amp;#x27;s a good chance that the Tier 1 IP providers will comply.&lt;p&gt;Done. That podunk ISP in Belarus has now been disconnected from a large part of the Internet. And good luck with them trying to get Verizon etc to undo that.&lt;p&gt;So, what the death penalty means is &amp;quot;you get to intentionally mess around with routing just once, then you go away forever&amp;quot;. Now that podunk ISP can either go out of business or it can go begging IANA for a new AS number. And since ICANN (which operates IANA) answers (at least for now) to the US Dept of Commerce, it might not be too easy to get a new AS.&lt;p&gt;Yes I know the propeller-head nerds who operate the &amp;quot;technical&amp;quot; Internet would immediately think my proposal is much too harsh. But, ultimately, nerds need to understand that sometimes things are done for &amp;quot;political&amp;quot; rather than &amp;quot;technical&amp;quot; reasons. And the managers who sign the nerds&amp;#x27; paychecks are political creatures; they almost invariably aren&amp;#x27;t nerds.</text></comment>
<story><title>Someone’s Been Siphoning Data Through a Huge Security Hole in the Internet</title><url>http://www.wired.com/threatlevel/2013/12/bgp-hijacking-belarus-iceland/?cid=co15315354</url></story><parent_chain></parent_chain><comment><author>r0h1n</author><text>Here&amp;#x27;s the post at Renesys upon which this article is based: &lt;a href=&quot;http://www.renesys.com/2013/11/mitm-internet-hijacking/&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.renesys.com&amp;#x2F;2013&amp;#x2F;11&amp;#x2F;mitm-internet-hijacking&amp;#x2F;&lt;/a&gt;&lt;p&gt;FWIW, I found the renesys post more informative than the Wired article (though on a standalone basis it is pretty good too).</text></comment>