Revealed: The Internet's Biggest Security Hole
 

Two security researchers have demonstrated a new technique to stealthily intercept internet traffic on a scale previously presumed to be unavailable to anyone outside of intelligence agencies like the National Security Agency.

The tactic exploits the internet routing protocol BGP (Border Gateway Protocol) to let an attacker surreptitiously monitor unencrypted internet traffic anywhere in the world, and even modify it before it reaches its destination.

The demonstration is only the latest attack to highlight fundamental security weaknesses in some of the internet's core protocols. Those protocols were largely developed in the 1970s with the assumption that every node on the then-nascent network would be trustworthy. The world was reminded of the quaintness of that assumption in July, when researcher Dan Kaminsky disclosed a serious vulnerability in the DNS system. Experts say the new demonstration targets a potentially larger weakness.

"It's a huge issue. It's at least as big an issue as the DNS issue, if not bigger," said Peiter "Mudge" Zatko, noted computer security expert and former member of the L0pht hacking group, who testified to Congress in 1998 that he could bring down the internet in 30 minutes using a similar BGP attack, and disclosed privately to government agents how BGP could also be exploited to eavesdrop. "I went around screaming my head about this about ten or twelve years ago.... We described this to intelligence agencies and to the National Security Council, in detail."

The man-in-the-middle attack exploits BGP to fool routers into re-directing data to an eavesdropper's network.

Anyone with a BGP router (ISPs, large corporations or anyone with space at a carrier hotel) could intercept data headed to a target IP address or group of addresses. The attack intercepts only traffic headed to target addresses, not from them, and it can't always vacuum in traffic within a network -- say, from one AT&T customer to another.

The method conceivably could be used for corporate espionage, nation-state spying or even by intelligence agencies looking to mine internet data without needing the cooperation of ISPs.

http://blog.wired.com/27bstroke6/200...ed-the-in.html

you lost me at "Two"...

Because we all have access to backbone BGP routing... why I'll just head on over to the datacenter and just walk right on in!

If anyone is capable of it, Mudge is the man for the job.

O.K. Then,, Ur, Oh Awe, Yawn..................

I posted this because theoretically a tech savvy adult provider can siphon off/monitor/intercept traffic headed to any other major website. OR have someone at an ISP do it for them

The implications could be devastating and ISP's don't really see the need to upgrade to SBGP at present.

Just letting you guys and gals know.

they can have all my bases

Does this mean that someone could be reading my letters to penthouse forum before they are published? cuz if so...DAMN!

No it can't. And something like this has been possible a long time ago. Security hole like this is the same as saying a security hole is that someone can intercept your traffic IF he steals one of the routers along the path in one of the datacenter... ORLY!

biggest security risk is the dork between the seat and the keyboard.
always has been, always will be.
and no software or hardware can fix that.

So the security risk is Sys admins? Well we are really screwed then aren't we.

Some Hosting Companies (one that isn't around anymore) use to steal/rip traffic from the sites at the router level. If you don't think some dirty hosts have ripped traffic, emails, member records, ect, then you are naive.

Technically I can steal virtually anything in a grocery store. :) It's another ordered sensational article. Wired is a commercial enterprise not a charity. Their mission #1 is making money.

http://ndn.newsweek.com/media/25/710...l-vertical.jpg

Don't surf the web, you will download a virus, may meet a pedophile, have your CC stolen, your intimate life exposed, your ID hijacked. Fuck. What are we all doing here?

Your kids are not safe, you are not either. Cut off the fucking internet. :)

The internet affects climate change, next month in Wired.

I also heard the internet has killed social life and the new Hitler may be a Counter Strike player.

I don't know if this is true or not, but I read somewhere that George Bush had somebody write some spy ware that is installed on just about every computer there is, and it tracks everyone and dumps the info to computers at the CIA.
They even made deals with the anti virus companies to not detect it in there software.
anybody think this is true?

and John Kerry voted for it before he voted against it.
now he is stuck in Iraq.

I would say it isn't true, the advanced levels and customizations that firewalls can take would easily be able to identify that something on the network was sending out information.

It would be a much higher chance that you confirm your windows with Microsoft, they gather the information, and hand it over to the Gov.

no its false. Main reason being is in order to actuallly save the info from every computer on earth you would need a hard drive capable of holding it , and a way to get it back out :)

what they did do though was to route almost all internet traffic through secret computers at backbone level, what they did with this info and what they are/were taking is anyone's guess.

Actually it is true, I intercept all that traffic through the BGP exploit :thumbsup

this is last months news isnt it

:1orglaugh :1orglaugh ...

No. THIS was.

And don't get me wrong. I'm not being "chicken little" here.

I'm simply passing on the information to those who can appreciate it - Especially those who may have access to BGP routers in their present job capacity.

The internet's biggest security hole is...

PUSSYSERVER!

This sounds like something more sophisticated, but with BGP it's quite easy to cause mischief, either intentionally or accidentally, because routes are not verified to have come from a trusted source (ie: the company that owns them). If your upstreams do not have the appropriate filters in place then you can pretty much broadcast any IP range you like.

Earlier this year a Pakistani ISP advertised/leaked Youtube's routes as if it were its own IP range, which resulted in a shitload of traffic that was supposed to go to Youtube heading in through their own link. The intent was to blackhole (censor) youtube for its customers, but the route was advertised to the big bad internet.

:1orglaugh :thumbsup