Some years back, Russia hijacked a BGP belonging to a major transit provider. For a few hours, international traffic was rerouted thru Russian networks where it could be cloned (like the NSA does in the states) and examined.
They could have been after something specific in the traffic but my unqualified guess is that it was a test or they were showing off.
Surely OpenNet/ClassNet/NIPRNet/SIPRNet/GWAN/JWICS aren't accepting BGP updates, where they even touch public network infrastructure.
If i understand, the article is not so much a typical bgp hijack but the attacker gaining control of their account that controls routing. Seems like private networks would be just as vulnerable to that.
As they stated, European gov networks (plus military and universities OFC) had and still have their private backbone. In Spain, RedIris was for scientific research, universities and such. IDK about the rest, but for sure they'd have a similar approach.
Comments
Some years back, Russia hijacked a BGP belonging to a major transit provider. For a few hours, international traffic was rerouted thru Russian networks where it could be cloned (like the NSA does in the states) and examined.
They could have been after something specific in the traffic but my unqualified guess is that it was a test or they were showing off.
Curious to speculate about.
If you could temporarily redirect BGP at an arbitrary time, at diplomatic risk, what would be the best use of that?
Surely OpenNet/ClassNet/NIPRNet/SIPRNet/GWAN/JWICS aren't accepting BGP updates, where they even touch public network infrastructure.
And I can't think of anything outside those huge spheres that would be worth burning a capability like that on a lark.
Maybe bulk sensitive data transfer? I.e. some site-to-site backup?
Or you're just looking at the metadata of where-to-where, with the goal of finding future targets.
I went back and looked up the event. Rostelecom has been behind a few of these. I might be conflating two of them.
In 2017, Rostelecom grabbed financial & other network data for a few minutes. https://www.thousandeyes.com/blog/rostelecom-route-leak-targ...
In 2020 Rostelecom announced lots of networks they didn't own and got that traffic for an hour. Early analysis felt it was accidental. Not sure about later analysis. https://www.zdnet.com/article/russian-telco-hijacks-internet... https://news.ycombinator.com/item?id=22789754
But 2 months ago, Rostelecom grabbed a chunk of Apple's network (which I missed) https://cybernews.com/apple-network-traffic-went-through-rus...
If i understand, the article is not so much a typical bgp hijack but the attacker gaining control of their account that controls routing. Seems like private networks would be just as vulnerable to that.
In the case of the article / Orange, possibly.
Though I'd hope that Orange doesn't provide network management services for the Spanish military! Some things are better kept in-house.
Less familiar with how European sensitive networks are architected.
As they stated, European gov networks (plus military and universities OFC) had and still have their private backbone. In Spain, RedIris was for scientific research, universities and such. IDK about the rest, but for sure they'd have a similar approach.
Some governments have physical tunnel networks to move people who matter around. Computer networks follow pretty much without a loss of generality.
Indeed, RedIris in Spain, since late 80's or maybe early 90's, can't remember.