if it's true, it's ridiculous BUT the cost is just the cost of downtime. is anyone under the impression that they'd actually be out these IP addresses permanently? obviously RIPE would fix the issue and get the IPs returned
If this really lead to an entire country losing access to GitHub, Twitter, Canva, etc for four hours, I wager that's a pretty substantial economic loss. Of course Orange doesn't suffer this cost directly, but the downtime and the surrounding revelations/rumours about their security posture might cost them a lot of business in the medium term (even outside Spain).
I mean, it didn't affect the _entire_ country. I am in Spain and didn't notice (neither did anyone I know) until I saw the news. Logically it should only affect Orange customers, maybe transiting traffic from other ISPs?
Yes and no, while RIPE can help they can only up to a point. For example, the assets are transferred to someone , up to that point RIPE can help but if another transaction has followed then sorry but they can't do much
Talking from experience in such a case, malicious actor transfers IP range from entity A to intermediate entity B and then entity B sells that range to entity C.
Entity C obtained the asset on a perfectly legal way as they don't know and care how entity B got the asset. Nothing entity A can do then when they discover it, they can't get assets back plus RIPE also can't do anything since they only offer the tool for tracking such transactions they don't take part on them . If you want follow any legal process you want to be reimbursed from entity B and the malicious actor but you are not getting your IP range back
I don't know the legal system in Spain or the wider EU, but in the US for example stolen goods are stolen goods no matter how many hands they pass through. Washing them through a fence doesn't suddenly make them legitimate
I didn't mention cost for that reason. It's just silly to put so much into assets and then not even put basic protections on them being accessed by others instead.
Comments
That's pretty loose protection on 10s of millions of dollars of asset.
if it's true, it's ridiculous BUT the cost is just the cost of downtime. is anyone under the impression that they'd actually be out these IP addresses permanently? obviously RIPE would fix the issue and get the IPs returned
If this really lead to an entire country losing access to GitHub, Twitter, Canva, etc for four hours, I wager that's a pretty substantial economic loss. Of course Orange doesn't suffer this cost directly, but the downtime and the surrounding revelations/rumours about their security posture might cost them a lot of business in the medium term (even outside Spain).
I mean, it didn't affect the _entire_ country. I am in Spain and didn't notice (neither did anyone I know) until I saw the news. Logically it should only affect Orange customers, maybe transiting traffic from other ISPs?
Yes and no, while RIPE can help they can only up to a point. For example, the assets are transferred to someone , up to that point RIPE can help but if another transaction has followed then sorry but they can't do much
This isn’t the blockchain. All of that can be easily reversed
Talking from experience in such a case, malicious actor transfers IP range from entity A to intermediate entity B and then entity B sells that range to entity C. Entity C obtained the asset on a perfectly legal way as they don't know and care how entity B got the asset. Nothing entity A can do then when they discover it, they can't get assets back plus RIPE also can't do anything since they only offer the tool for tracking such transactions they don't take part on them . If you want follow any legal process you want to be reimbursed from entity B and the malicious actor but you are not getting your IP range back
I don't know the legal system in Spain or the wider EU, but in the US for example stolen goods are stolen goods no matter how many hands they pass through. Washing them through a fence doesn't suddenly make them legitimate
A legal process can give them back the IP range but it's going to take a long time. They'll have to find other IP addresses until it's settled.
“I didn’t know it was stolen” doesn’t hold up well in court.
I didn't mention cost for that reason. It's just silly to put so much into assets and then not even put basic protections on them being accessed by others instead.