Newsgroup: it.fan.marco-ditri
Titolo: Hacking Team and a case of BGP hijacking

After just a few hours the Hacking Team emails archive[0] has already
provided many tasty leaks. I want to focus on a routing security issue
since this is my main research activity for this year.
 
Short summary: if these emails are true, and so far nobody has found
any credible reason to believe that they are not, then some major
italian ISPs hijacked the IP addresses of a foreign ISP on request of
the section of the Carabinieri which investigates terrorism and
organized crime[1].
 
The goal was to recover access to some copies of the Hacking Team
malware which were controlled by "anonymizer" VPSes hosted on the
hijacked network and that were abruptly disabled by their provider.
 
Thanks to the great RIPEstat service[2] I have been able to verify that
indeed the network 
46.166.163.0/24
 was announced by AS31034[3]
(
aruba.it
, a large italian hosting company) in 2013, from august 15 to
22.
 
Then I downloaded from the RIPE RIS archive a BGP table dump for august
20 2013[4] and processed it with my zebra-dump-parser[5] software to
extract the relevant routes. It shows that AS31034 did not just
advertise the hijacked network to the two italian ISPs mentioned in the
emails, but apparently to all their other peers since the announce was
also accepted by Hurricane Electric at MIX-IT. This means that the
hijacking was not limited to a couple of local networks but involved
many others all over the world.
 
As an italian network operator I am seriously concerned that some of my
BGP peers appear to be involved in what would usually be considered a
criminal activity.
 
As all operators know, there is still too much mutual trust involved in
global BGP routing, and in some cases it is misplaced: we need better
best practices[6], tools[7] and protocols to make this kind of things
impossible in the future.
 
(Some of the relevant leaked emails:
1[8]2[9]3[10]4[11]5[12]6[13]7[14]8[15]9[16].)
 
 
[0] 
https://www.wikileaks.org/hackingteam/emails/
 
[1] 
https://en.wikipedia.org/wiki/Raggruppamento_Operativo_Speciale
 
[2] 
https://stat.ripe.net/
 
[3]
https://stat.ripe.net/widget/routing-history#w.resource=46.166.163.0%2F24
 
[4] 
http://data.ris.ripe.net/rrc00/2013.08/bview.20130820.0000.gz
 
[5] 
https://github.com/rfc1036/zebra-dump-parser
 
[6] 
http://www.routingmanifesto.org/
 
[7] 
https://github.com/rfc1036/rpsltool
 
[8] 
https://www.wikileaks.org/hackingteam/emails/emailid/319305
 
[9] 
https://www.wikileaks.org/hackingteam/emails/emailid/364004
 
[10] 
https://www.wikileaks.org/hackingteam/emails/emailid/304632
 
[11] 
https://www.wikileaks.org/hackingteam/emails/emailid/357697
 
[12] 
https://www.wikileaks.org/hackingteam/emails/emailid/342441
 
[13] 
https://www.wikileaks.org/hackingteam/emails/emailid/355248
 
[14] 
https://www.wikileaks.org/hackingteam/emails/emailid/347856
 
[15] 
https://www.wikileaks.org/hackingteam/emails/emailid/329016
 
[16] 
https://www.wikileaks.org/hackingteam/emails/emailid/224113
 
 
Permalink: 
http://blog.bofh.it/id_456
 

 hijacked the IP addresses
Che utilita hanno queste tecniche oltre il problema descritto di riprendere il controllo perso di agenti?
Visto che l'attacco man in the middle e' previsto ormai da tutti i protocolli sicuri?
 
Giulia