Google Services down due to BGP leak, traffic hijacked through Russia, China, and Nigeria
13.11.2018 securityaffairs BigBrothers

Google services were partially inaccessible on Monday due to a BGP leak that caused traffic redirection through Russia, China, and Nigeria.
A BGP leak caused unavailability of Google service on Monday, the traffic was redirected through Russia, China, and Nigeria.

At the time it is not clear if the incident was the result of an error or a cyber attack on the BGP protocol.

It’s unclear if the incident was caused by a configuration issue or if it was the result of a malicious attack.

Route hijacking, also known as BGP hijacking, occurs when the routing tables for groups of IP addresses are intentionally or accidentally corrupted.

Recently security researchers Chris C. Demchak and Yuval Shavitt revealed that over the past years, China Telecom has been misdirecting Internet traffic through China.

China Telecom is currently present in North American networks with 10 points-of-presence (PoPs) (eight in the United States and two in Canada), spanning major exchange points.

The two researchers pointed out that the telco company leverages the PoPs to hijack traffic through China, it has happened several times over the past years,

“Within the BGP forwarding tables, administrators of each AS announce to their AS neighbors the IP address blocks that their AS owns, whether to be used as a destination or a convenient transit node.” states the paper.

“Errors can occur given the complexity of configuring BGP, and these possible errors offer covert actors a number of hijack opportunities. If network AS1 mistakenly announces through its BGP that it owns an IP block that actually is owned by network AS2, traffic from a portion of the Internet destined for AS2 will actually be routed to – and through – AS1. If the erroneous announcement was maliciously arranged, then a BGP hijack has occurred.”

The latest BGP leaks were first reported by the network monitoring firm ThousandEyes, the traffic to Google services, including Search, G Suite, and various Google Cloud services, was directed through TransTelecom in Russia, Nigerian ISP MainOne, and China Telecom.

ThousandEyes
@thousandeyes
BREAKING: Potential hijack underway. ThousandEyes detected intermittent availability issues to Google services from some locations. Traffic to certain Google destinations appears to be routed through an ISP in Russia & black-holed at a China Telecom gateway router.

445
10:57 PM - Nov 12, 2018
552 people are talking about this
Twitter Ads info and privacy
“On November 12th, 2018, between 1:00 PM and 2:23 PM PST, ThousandEyes noticed issues connecting to G Suite, a critical application for our organization. Reviewing ThousandEyes Endpoint Agent stats, we noticed this was impacting all users at the ThousandEyes office.” reads the analysis published Thousandeyes.

“The outage not only affected G Suite, but also Google Search as well as Google Analytics. What caught our attention was that traffic to Google was getting dropped at China Telecom. Why would traffic from a San Francisco office traversing to Google go all the way to China? We also noticed a Russian ISP in the traffic path, which definitely sparked some concerns.”

According to the BGP routing monitoring firm BGPmon, 212 unique Google prefixes were impacted.

ThousandEyes speculate the origin of this leak was the BGP peering relationship between the Nigerian provider MainOne and China Telecom, anyway it is unclear if the BGP leaks were the result of an intentional attack or a misconfiguration at MainOne

BGPmon.net
@bgpmon
In addition to @Google downstream networks from The Nigerian ISP AS37282 Mainone, were affected. Including for example this @Cloudflare prefixhttps://stat.ripe.net/172.69.12.0%2F22#tabId=routing&routing_bgplay.ignoreReannouncements=false&routing_bgplay.resource=172.69.12.0/22&routing_bgplay.starttime=1542053570&routing_bgplay.endtime=1542062570&routing_bgplay.rrcs=0,1,2,5,6,7,10,11,13,14,15,16,18,20&routing_bgplay.instant=null&routing_bgplay.type=bgp …

20
1:48 AM - Nov 13, 2018
25 people are talking about this

@bgpmon
This is a good visual replay of the incident, in this case for the prefix 104.196.64.0/19. Clearly visiable is the leak via AS 4809 and 37282 https://stat.ripe.net/104.196.64.0%2F19#routing_upstream-visibility.resource=104.196.64.0/19&tabId=routing&routing_bgplay.ignoreReannouncements=false&routing_bgplay.resource=104.196.64.0/19&routing_bgplay.starttime=1542053570&routing_bgplay.endtime=1542062570&routing_bgplay.rrcs=0,1,2,5,6,7,10,11,13,14,15,16,18,20&routing_bgplay.instant=null&routing_bgplay.type=bgp …

52
12:28 AM - Nov 13, 2018
29 people are talking about this
Twitter Ads info and privacy
.“This incident at a minimum caused a massive denial of service to G Suite and Google Search. However, this also put valuable Google traffic in the hands of ISPs in countries with a long history of Internet surveillance,” continues the analysis published by ThousandEyes.

“Overall ThousandEyes detected over 180 prefixes affected by this route leak, which covers a vast scope of Google services. Our analysis indicates that the origin of this leak was the BGP peering relationship between MainOne, the Nigerian provider, and China Telecom. “

“Our analysis indicates that the origin of this leak was the BGP peering relationship between MainOne, the Nigerian provider, and China Telecom. MainOne has a peering relationship with Google via IXPN in Lagos and has direct routes to Google, which leaked into China Telecom,”.

@bgpmon
This affected 212 unique Google Prefixes. All Google prefixes that were affected can be found here: https://portal.bgpmon.net/data/google-leak-nov2018.txt …

18
11:55 PM - Nov 12, 2018
Twitter Ads info and privacy
20 people are talking about this
Twitter Ads info and privacy
Google confirmed that the root cause of the incident was external to the company systems and launched an internal investigation on it.

“Throughout the duration of this issue Google services were operating as expected and we believe the root cause of the issue was external to Google. We will conduct an internal investigation of this issue and make appropriate improvements to our systems to help prevent or minimize future recurrence,” reads the Google Cloud Platform status page.

Researchers Chris C. Demchak and Yuval Shavitt described many other BGP hijacking attacks involving China Telecom. They are pushing to adopt solutions to protect BGP, Cloudflare for example, sustains that Resource Public Key Infrastructure (RPKI) could secure BGP routing.