China Web hijacking shows Net at risk 
 
 Posted: Wednesday, November 17 2010 at 06:48 pm CT by Bob Sullivan 
 
 The cyber cold war between China and the U.S. just got a little chillier. Twice this year, China demonstrated its ability to "substantially manipulate" the Internet, a congressional commission said in a report issued on Tuesday. In one incident, traffic headed to 15 percent of the world's websites was redirected through Chinese servers for about 20 minutes. 
 
 The high-level hijacking included bits and bytes headed for the U.S. Senate, the Army, the Navy, the Marine Corps, the Air Force, the secretary of defense, NASA, and other government offices, along with commercial entities like Dell, Yahoo, Microsoft, and IBM, the report said. 
 
 Chinese officials disputed the findings. But several technology firms said they charted the hijacking in April. 
 
 In a prior incident in March, the Chinese censorship firewall was temporarily extended to block some U.S. users from visiting websites like Twitter and YouTube, the report said. 
 
 "Computer security researchers observed both incidents but were not able to say conclusively whether the actions were intentional," concluded the report, by the U.S.-China Economic And Security Review Commission. "Nonetheless, each incident demonstrates a capability that could possibly be used for malicious purposes." 
 
 The Internet, we are frequently reminded, is a shockingly fragile creation. These incidents, both of which took advantage of well-known vulnerabilities, are a wake-up call for U.S. authorities, who need to insist on security upgrades to protect U.S. interests, said Dmitri Alperovitch, a security researcher with McAfee. His firm supplied the U.S. government with a list of 53,000 websites that were hijacked for 18 minutes on April 8. 
 
 "This is a troubling development. It could be innocuous, and China is claiming it's an accident, but this has a pretty wide-ranging set of implications," he said. "That traffic could be eavesdropped upon." 
 
 The report comes near the end of a tumultuous year for China and the Internet. Beijing had a very public spat with Google early in the year, and the nation was ultimately accused of spying on Google employees. It was also accused of a sophisticated plot to use the Internet to spy on the Dalai Lama and other detractors. 
 
 The March incident involved a flaw in the way the Internet converts friendly website addresses -- like msnbc.com -- into their reference IP addresses – such as 128.206.11.1. The conversions occur through a system of networked computers called Domain Name Servers. A key tool in China's internal "Great Firewall" censorship tool is the rerouting of Web page requests through Domain Name Servers away from potentially subversive Web sites. Requests for some Web sites are simply dropped; others are redirected to China-friendly sites. 
 
 But domain name conversion tables, when handled incorrectly, can spread themselves upstream on the Internet. In March, some domain servers around the world were "poisoned" with China's censored list, causing some users in Chile and the United State to be blocked from social networking sites for about a day. The problem was readily fixed, and some researchers believe the cause might have been an honest mistake. 
 
 Bad 'route announcements' 
 
 But the April incident is far more mysterious, and consequently makes some security experts more nervous. It involved what are called "route announcements," which are made by telecom providers to the wider Internet. Servers can advertise that they offer the best route for Internet traffic headed to specific destinations, and like obedient bits and bytes, the traffic automatically follows -- even if the advertisements are incorrect. That means an e-mail sent from Congress to the White House could be tricked into traveling through China, if a server were configured that way. 
 
 That's what happened in April, according to the report. A massive amount of Web traffic worked its way around the world through Chinese-controlled computers. According to McAfee’s Alperovitch, only workers at China Telecom know why. But the most disturbing thing about the April incident, he said, is that almost no one noticed. China Telecom absorbed the traffic and redistributed it to its destinations without so much as an Internet blip. 
 
 While it's possible an honest mistake was to blame, it's easy to conjure up other possibilities. 
 
 "That they are able to take in that much traffic without breaking a sweat, I find that almost unimaginable," Alperovitch said. "The capacity built into their networks must be astonishing. ... Things worked miraculously." 
 
 The report speculated that the mammoth data slurp might have been committed to obfuscate a more targeted Web attack. And an entity in possession of that much data might eventually be able to decrypt encrypted Web traffic -- in addition to the fishing expedition that a government agency could enjoy by simply searching all that data for valuable secrets. 
 
 "The spokesman of China Telecom Corp. Ltd. denied any hijack of Internet traffic," Chinese officials said in statement e-mailed Tuesday to the Reuters news service. 
 
 This is not the first time route announcements led to World Wide Web trouble. In 2008, Pakistani censorship efforts of YouTube went awry, leading to a temporary blackout of the video service. In 2004, Turkish servers accidentally told the world that all Web traffic should travel through its borders; widespread outages followed. 
 
 But this the first time such a large traffic rerouting was conducted without noticeable impact on Web traffic. 
 
 "The methods used during these activities are generally more sophisticated than techniques used in previous exploitations," the report concluded. 
 
 The Cold War was full of menacing military exercises and accidental airspace violations. A cyber cold war will naturally produced similar incidents. If there is a grey area between honest mistakes and outright cyber attack, these incidents probably fall right in the middle – if not a pre-planned testing of the waters, then certainly a happy accident with valuable results to be studied by would-be cyber-attackers. Don't expect a cyber cold war thawing any time soon. 
 
 Tweet ||||| China today denied US allegations that it "hijacked" highly sensitive internet traffic – including emails sent to and from US military websites – earlier this year. 
 
 A state-owned telecoms company in China had access to 15% of global internet traffic, including confidential emails from Nasa and the US army, for 18 minutes in April, according to an annual security report delivered to the US congress on Wednesday. 
 
 The report warned that the capture "could enable severe malicious activities" by China. The state-owned company accused of "hijacking" the encrypted information, China Telecom, today denied "any hijack of internet traffic". 
 
 Online security experts say the capture represents "one of the biggest hijacks" of sensitive information in the history of the internet. 
 
 Relations between China and the US – number one and two in the world, respectively, in terms of internet users – have long been fraught when it comes to the web. 
 
 Earlier this year US technology giant Google said it was to stop censoring results on its Chinese search engine, following a sophisticated and allegedly state-sponsored cyber attack directed at the company. China earlier accused the US of making "groundless accusations" about restrictions on internet freedom against the country. 
 
 The US report said that some 15% of global internet traffic was routed through Chinese servers earlier this year, prompting worries that the country now has access to sensitive correspondence from US government bodies. US commissioner Larry Wortzel raised concerns on Wednesday that China would now "get the internet addresses of everybody that communicated" with the US armed services' chiefs of staff. 
 
 The rerouting began at a smaller Chinese ISP called IDC China before being passed on to China Telecom, the report compiled by the US-China economic and security review commission claimed. Encrypted correspondence from the US senate, the department of defence and "many others" were among the huge amount of traffic captured by China. 
 
 Dmitri Alperovitch, a threat research analyst at internet security firm McAfee, said the capture "is one of the biggest – if not the biggest hijacks – we have ever seen". 
 
 "No one except China Telecom operators" know what happened to the traffic during those 18 minutes, Alperovitch added. "The possibilities are numerous and troubling, but definitive answers are unknown." ||||| Links Blog Home Archive Edit in Browser /_layouts/images/icxddoc.gif /blog/_layouts/formserver.aspx?XsnLocation={ItemUrl}&OpenIn;=Browser 0x0 0x1 FileType xsn 255 Edit in Browser /_layouts/images/icxddoc.gif /blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn;=Browser 0x0 0x1 ProgId InfoPath.Document 255 Edit in Browser /_layouts/images/icxddoc.gif /blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn;=Browser 0x0 0x1 ProgId InfoPath.Document.2 255 Edit in Browser /_layouts/images/icxddoc.gif /blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn;=Browser 0x0 0x1 ProgId InfoPath.Document.3 255 Edit in Browser /_layouts/images/icxddoc.gif /blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn;=Browser 0x0 0x1 ProgId InfoPath.Document.4 255 View in Web Browser /_layouts/images/ichtmxls.gif /blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid;={ItemId}&DefaultItemOpen;=1 0x0 0x1 FileType xlsx 255 View in Web Browser /_layouts/images/ichtmxls.gif /blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid;={ItemId}&DefaultItemOpen;=1 0x0 0x1 FileType xlsb 255 Snapshot in Excel /_layouts/images/ewr134.gif /blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid;={ItemId}&Snapshot;=1 0x0 0x1 FileType xlsx 256 Snapshot in Excel /_layouts/images/ewr134.gif /blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid;={ItemId}&Snapshot;=1 0x0 0x1 FileType xlsb 256 Sponsors 
 
 
 
 National Defense > Blog > Posts > Cyber Experts Have Proof That China Has Hijacked U.S.-Based Internet Traffic: UPDATED Cyber Experts Have Proof That China Has Hijacked U.S.-Based Internet Traffic: UPDATED For 18 minutes in April, China’s state-controlled telecommunications company hijacked 15 percent of the world’s Internet traffic, including data from U.S. military, civilian organizations and those of other U.S. allies. 
 
 
 
 This massive redirection of data has received scant attention in the mainstream media because the mechanics of how the hijacking was carried out and the implications of the incident are difficult for those outside the cybersecurity community to grasp, said a top security expert at McAfee, the world’s largest dedicated Internet security company. 
 
 
 
 In short, the Chinese could have carried out eavesdropping on unprotected communications — including emails and instant messaging — manipulated data passing through their country or decrypted messages, Dmitri Alperovitch, vice president of threat research at McAfee said. 
 
 
 
 Nobody outside of China can say, at least publicly, what happened to the terabytes of data after the traffic entered China. 
 
 
 
 The incident may receive more attention when the U.S.-China Economic and Security Review Commission, a congressional committee, releases its annual report on the bilateral relationship Nov. 17. A commission press release said the 2010 report will address “the increasingly sophisticated nature of malicious computer activity associated with China.” 
 
 
 
 Said Alperovitch: “This is one of the biggest — if not the biggest hijacks — we have ever seen.” And it could happen again, anywhere and anytime. It’s just the way the Internet works, he explained. “What happened to the traffic while it was in China? No one knows.” 
 
 
 
 The telephone giants of the world work on a system based on trust, he explained. Machine-to-machine interfaces send out messages to the Internet informing other service providers that they are the fastest and most efficient way for data packets to travel. For 18 minutes April 8, China Telecom Corp. told many ISPs of the world that its routes were the best paths to send traffic. 
 
 
 
 For example, a person sending information from Arlington, Va., to the White House in Washington, D.C. — only a few miles away — could have had his data routed through China. Since traffic moves around the world in milliseconds, the computer user would not have noticed the delay. 
 
 
 
 This happens accidentally a few times per year, Alperovitch said. What set this incident apart from other such mishaps was the fact that China Telecom could manage to absorb this large amount of data and send it back out again without anyone noticing a disruption in service. In previous incidents, the data would have reached a dead end, and users would not have been able to connect. 
 
 
 
 Also, the list of hijacked data just happened to include preselected destinations around the world that encompassed military, intelligence and many civilian networks in the United States and other allies such as Japan and Australia, he said. “Why would you keep that list?” Alperovitch asked. 
 
 
 
 The incident involved 15 percent of Internet traffic, he stressed. The amount of data included in all these packets is difficult to calculate. The data could have been stored so it could be examined later, he added. “Imagine the capability and capacity that is built into their networks. I’m not sure there was anyone else in the world who could have taken on that much traffic without breaking a sweat,” Alperovitch said. 
 
 
 
 McAfee has briefed U.S. government officials on the incident, but they were not alarmed. They said their Internet communications are encrypted. However, encryption also works on a basis of trust, McAfee experts pointed out. And that trust can be exploited. 
 
 
 
 Internet encryption depends on two keys. One key is private and not shared, and the other is public, and is embedded in most computer operating systems. Unknown to most computer users, Microsoft, Apple and other software makers embed the public certificates in their operating systems. They also trust that this system won’t be abused. 
 
 
 
 Among the certificates is one from the China Internet Information Center, an arm of the China’s Ministry of Information and Industry. 
 
 
 
 “If China telecom intercepts that [encrypted message] and they are sitting on the middle of that, they can send you their public key with their public certificate and you will not know any better,” he said. The holder of this certificate has the capability to decrypt encrypted communication links, whether it’s web traffic, emails or instant messaging, Alperovitch said. “It is a flaw in the way the Internet operates,” said Yoris Evers, director of worldwide public relations at McAfee. 
 
 
 
 No one outside of China can say whether any of these potentially nefarious events occurred, Alperovitch noted. “It did not make mainstream news because it is so esoteric and hard to understand,” he added. It is not defined as a cyberattack because no sites were hacked or shut down. “But it is pretty disconcerting.” 
 
 
 
 And the hijacking took advantage of the way the Internet operates. “It can happen again. They can do it tomorrow or they can do it in an hour. And the same problem will occur again.” 
 
 
 
 CLARIFICATION: Alperovitch in a McAfee blog has clarified that 15 percent of the world's routes were directed to China, not 15 percent of the traffic. In an earlier interview he stated: “In terms of the overall traffic they took, it’s very hard to estimate, but it was a lot more than 15 percent of the world’s traffic [that] their pipes were able to handle without crashing.” 
 
 
 
 
 
 Read more about the increasingly sophisticated nature of cyberespionage and attacks in the January issue of National Defense Magazine. 
 
 
 
 
 
 For 18 minutes in April, China’s state-controlled telecommunications company hijacked 15 percent of the world’s Internet traffic, including data from U.S. military, civilian organizations and those of other U.S. allies.This massive redirection of data has received scant attention in the mainstream media because the mechanics of how the hijacking was carried out and the implications of the incident are difficult for those outside the cybersecurity community to grasp, said a top security expert at McAfee, the world’s largest dedicated Internet security company.In short, the Chinese could have carried out eavesdropping on unprotected communications — including emails and instant messaging — manipulated data passing through their country or decrypted messages, Dmitri Alperovitch, vice president of threat research at McAfee said.Nobody outside of China can say, at least publicly, what happened to the terabytes of data after the traffic entered China.The incident may receive more attention when the U.S.-China Economic and Security Review Commission, a congressional committee, releases its annual report on the bilateral relationship Nov. 17. A commission press release said the 2010 report will address “the increasingly sophisticated nature of malicious computer activity associated with China.”Said Alperovitch: “This is one of the biggest — if not the biggest hijacks — we have ever seen.” And it could happen again, anywhere and anytime. It’s just the way the Internet works, he explained. “What happened to the traffic while it was in China? No one knows.”The telephone giants of the world work on a system based on trust, he explained. Machine-to-machine interfaces send out messages to the Internet informing other service providers that they are the fastest and most efficient way for data packets to travel. For 18 minutes April 8, China Telecom Corp. told many ISPs of the world that its routes were the best paths to send traffic.For example, a person sending information from Arlington, Va., to the White House in Washington, D.C. — only a few miles away — could have had his data routed through China. Since traffic moves around the world in milliseconds, the computer user would not have noticed the delay.This happens accidentally a few times per year, Alperovitch said. What set this incident apart from other such mishaps was the fact that China Telecom could manage to absorb this large amount of data and send it back out again without anyone noticing a disruption in service. In previous incidents, the data would have reached a dead end, and users would not have been able to connect.Also, the list of hijacked data just happened to include preselected destinations around the world that encompassed military, intelligence and many civilian networks in the United States and other allies such as Japan and Australia, he said. “Why would you keep that list?” Alperovitch asked.The incident involved 15 percent of Internet traffic, he stressed. The amount of data included in all these packets is difficult to calculate. The data could have been stored so it could be examined later, he added. “Imagine the capability and capacity that is built into their networks. I’m not sure there was anyone else in the world who could have taken on that much traffic without breaking a sweat,” Alperovitch said.McAfee has briefed U.S. government officials on the incident, but they were not alarmed. They said their Internet communications are encrypted. However, encryption also works on a basis of trust, McAfee experts pointed out. And that trust can be exploited.Internet encryption depends on two keys. One key is private and not shared, and the other is public, and is embedded in most computer operating systems. Unknown to most computer users, Microsoft, Apple and other software makers embed the public certificates in their operating systems. They also trust that this system won’t be abused.Among the certificates is one from the China Internet Information Center, an arm of the China’s Ministry of Information and Industry.“If China telecom intercepts that [encrypted message] and they are sitting on the middle of that, they can send you their public key with their public certificate and you will not know any better,” he said. The holder of this certificate has the capability to decrypt encrypted communication links, whether it’s web traffic, emails or instant messaging, Alperovitch said. “It is a flaw in the way the Internet operates,” said Yoris Evers, director of worldwide public relations at McAfee.No one outside of China can say whether any of these potentially nefarious events occurred, Alperovitch noted. “It did not make mainstream news because it is so esoteric and hard to understand,” he added. It is not defined as a cyberattack because no sites were hacked or shut down. “But it is pretty disconcerting.”And the hijacking took advantage of the way the Internet operates. “It can happen again. They can do it tomorrow or they can do it in an hour. And the same problem will occur again.”Read more about the increasingly sophisticated nature of cyberespionage and attacks in the January issue of National Defense Magazine. Edit in Browser /_layouts/images/icxddoc.gif /blog/_layouts/formserver.aspx?XsnLocation={ItemUrl}&OpenIn;=Browser 0x0 0x1 FileType xsn 255 Edit in Browser /_layouts/images/icxddoc.gif /blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn;=Browser 0x0 0x1 ProgId InfoPath.Document 255 Edit in Browser /_layouts/images/icxddoc.gif /blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn;=Browser 0x0 0x1 ProgId InfoPath.Document.2 255 Edit in Browser /_layouts/images/icxddoc.gif /blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn;=Browser 0x0 0x1 ProgId InfoPath.Document.3 255 Edit in Browser /_layouts/images/icxddoc.gif /blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn;=Browser 0x0 0x1 ProgId InfoPath.Document.4 255 View in Web Browser /_layouts/images/ichtmxls.gif /blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid;={ItemId}&DefaultItemOpen;=1 0x0 0x1 FileType xlsx 255 View in Web Browser /_layouts/images/ichtmxls.gif /blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid;={ItemId}&DefaultItemOpen;=1 0x0 0x1 FileType xlsb 255 Snapshot in Excel /_layouts/images/ewr134.gif /blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid;={ItemId}&Snapshot;=1 0x0 0x1 FileType xlsx 256 Snapshot in Excel /_layouts/images/ewr134.gif /blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid;={ItemId}&Snapshot;=1 0x0 0x1 FileType xlsb 256 Edit in Browser /_layouts/images/icxddoc.gif /blog/_layouts/formserver.aspx?XsnLocation={ItemUrl}&OpenIn;=Browser 0x0 0x1 FileType xsn 255 Edit in Browser /_layouts/images/icxddoc.gif /blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn;=Browser 0x0 0x1 ProgId InfoPath.Document 255 Edit in Browser /_layouts/images/icxddoc.gif /blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn;=Browser 0x0 0x1 ProgId InfoPath.Document.2 255 Edit in Browser /_layouts/images/icxddoc.gif /blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn;=Browser 0x0 0x1 ProgId InfoPath.Document.3 255 Edit in Browser /_layouts/images/icxddoc.gif /blog/_layouts/formserver.aspx?XmlLocation={ItemUrl}&OpenIn;=Browser 0x0 0x1 ProgId InfoPath.Document.4 255 View in Web Browser /_layouts/images/ichtmxls.gif /blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid;={ItemId}&DefaultItemOpen;=1 0x0 0x1 FileType xlsx 255 View in Web Browser /_layouts/images/ichtmxls.gif /blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid;={ItemId}&DefaultItemOpen;=1 0x0 0x1 FileType xlsb 255 Snapshot in Excel /_layouts/images/ewr134.gif /blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid;={ItemId}&Snapshot;=1 0x0 0x1 FileType xlsx 256 Snapshot in Excel /_layouts/images/ewr134.gif /blog/_layouts/xlviewer.aspx?listguid={ListId}&itemid;={ItemId}&Snapshot;=1 0x0 0x1 FileType xlsb 256 Items on this list require content approval. Your submission will not appear in public views until approved by someone with proper rights. More information on content approval. Name: * eMail * Comment * Title Attachments Use this page to add attachments to an item. Name Name: * 
 
 eMail * 
 
 Comment * 
 
 
 
 The picture contains 6 characters. 
 
 Characters * ! ! Please enter the text displayed in the image.The picture contains 6 characters. Legal Notice * NDIA is not responsible for screening, policing, editing, or monitoring your or another user's postings and encourages all of its users to use reasonable discretion and caution in evaluating or reviewing any posting. Moreover, and except as provided below with respect to NDIA's right and ability to delete or remove a posting (or any part thereof), NDIA does not endorse, oppose, or edit any opinion or information provided by you or another user and does not make any representation with respect to, nor does it endorse the accuracy, completeness, timeliness, or reliability of any advice, opinion, statement, or other material displayed, uploaded, or distributed by you or any other user. Nevertheless, NDIA reserves the right to delete or take other action with respect to postings (or parts thereof) that NDIA believes in good faith violate this Legal Notice and/or are potentially harmful or unlawful. If you violate this Legal Notice, NDIA may, in its sole discretion, delete the unacceptable content from your posting, remove or delete the posting in its entirety, issue you a warning, and/or terminate your use of the NDIA site. Moreover, it is a policy of NDIA to take appropriate actions under the Digital Millennium Copyright Act and other applicable intellectual property laws. If you become aware of postings that violate these rules regarding acceptable behavior or content, you may contact NDIA at 703.522.1820. Related Content Clapper: United States Must Beef Up Information Warfare Capabilities Big Data, Software Continue to Stump Defense Programs Defending Networks Emerges As Top Battlefield Priority ODNI Technology Office Opens Up Dialogue With Private Sector Company Building System to Predict Cyber Attacks ||||| In a 300+ page report (PDF) today, the US-China Economic and Security Review Commission provided the US Congress with a detailed overview of what's been happening in China—including a curious incident in which 15 percent of the world's Internet traffic suddenly passed through Chinese servers on the way to its destination. 
 
 Here's how the Commission describes the incident, which took place earlier this year: 
 
 For about 18 minutes on April 8, 2010, China Telecom advertised erroneous network traffic routes that instructed US and other foreign Internet traffic to travel through Chinese servers. Other servers around the world quickly adopted these paths, routing all traffic to about 15 percent of the Internet’s destinations through servers located in China. This incident affected traffic to and from US government (‘‘.gov’’) and military (‘‘.mil’’) sites, including those for the Senate, the army, the navy, the marine corps, the air force, the office of secretary of Defense, the National Aeronautics and Space Administration, the Department of Commerce, the National Oceanic and Atmospheric Administration, and many others. Certain commercial websites were also affected, such as those for Dell, Yahoo!, Microsoft, and IBM. 
 
 The culprit here was "IP hijacking," a well-known routing problem in a worldwide system based largely on trust. Routers rely on the Border Gateway Protocol (BGP) to puzzle out the best route between two IP addresses; when one party advertises incorrect routing information, routers across the globe can be convinced to send traffic on geographically absurd paths. 
 
 This happened famously in 2008, when Pakistan blocked YouTube. The block was meant only for internal use, and it relied on new routing information that would send YouTube requests not to the company's servers but into a "black hole." 
 
 As we described the situation at the time, "this routing information escaped from Pakistan Telecom to its ISP PCCW in Hong Kong, which propagated the route to the rest of the world. So any packets for YouTube would end up in Pakistan Telecom's black hole instead." The mistake broke YouTube access from across much of the Internet. 
 
 The China situation appears to have a similar cause. The mistaken routing information came from IDC China Telecommunications, and it was then picked up by the huge China Telecom. As other routers around the world accepted the new information, they began funneling huge amounts of US traffic through Chinese servers, for 18 minutes. 
 
 As with many things involving cyberattacks and Internet security, it's hard to know if anything bad happened here. The entire thing could have been a simple mistake. Besides, Internet traffic isn't secure and already passes through many servers outside of one's control. Content that is sensitive but still suitable for the public Internet should be encrypted. Still, the Commission points out the many possible problems that such an IP hijack could cause. 
 
 Although the Commission has no way to determine what, if anything, Chinese telecommunications firms did to the hijacked data, incidents of this nature could have a number of serious implications. This level of access could enable surveillance of specific users or sites. It could disrupt a data transaction and prevent a user from establishing a connection with a site. It could even allow a diversion of data to somewhere that the user did not intend (for example, to a ‘‘spoofed’’ site). Arbor Networks Chief Security Officer Danny McPherson has explained that the volume of affected data here could have been intended to conceal one targeted attack. 
 
 What about encryption? 
 
 Perhaps most disconcertingly, as a result of the diffusion of Internet security certification authorities, control over diverted data could possibly allow a telecommunications firm to compromise the integrity of supposedly secure encrypted sessions. 
 
 The proliferation of certification authorities means that "untrustworthy" certification authorities are much harder to police, and there's speculation now that governments are involved in getting access to certificates in order to break encryption. 
 
 China has openly sought all sorts of encryption information for years, including the source code for routers, network intrusion systems, and firewalls. Those rules went into effect in May 2010, and they require foreign firms to submit this information to Chinese authorities before the government will purchase any such products. 
 
 But because the government review panels contain employees of rival Chinese firms, and because providing this information could make a company's worldwide products more susceptible to Chinese hacking or cyberattacks (which would in turn kill sales of said products in most countries), the Commission notes that no foreign firm has yet submitted to the new scheme.
– A report to Congress alleges that China briefly hijacked a chunk of the world's web traffic, including some from US military facilities, before sending it on its way. (The actual amount rerouted is in dispute.) China denies it, but tech writers are pretty sure it happened. Cause for alarm? A definite maybe. Bob Sullivan, MSNBC: "If there is a grey area between honest mistakes and outright cyber attack, these incidents probably fall right in the middle—if not a pre-planned testing of the waters, then certainly a happy accident with valuable results to be studied by would-be cyber-attackers." Nate Anderson, Ars Technica: "The culprit here was 'IP hijacking,' a well-known routing problem in a worldwide system based largely on trust." But as is usually the case with these things, "it's hard to know if anything bad happened here. The entire thing could have been a simple mistake. Besides, Internet traffic isn't secure and already passes through many servers outside of one's control." Jesus Diaz, Gizmodo: "Perhaps it wasn't a malicious move, but it certainly seems like a test to its network power. In any case, it seems like it can happen again at any time. I don't know about you, but I don't feel comfortable with the idea of China hijacking such a massive amount of information without explanation." Dmitri Alperovitch, McAfee: “This is one of the biggest—if not the biggest hijacks—we have ever seen," the security expert tells National Defense Magazine. "And it could happen again, anywhere and anytime. What happened to the traffic while it was in China? No one knows.”