On-Prem

Networks

OK Google, why was your web traffic hijacked and routed through China, Russia today?

BGP hijacking committed 'grand theft internet'


Updated People's connections in the US to Google – including its cloud, YouTube, and other websites – were suddenly rerouted through Russia and into China in a textbook Border Gateway Protocol (BGP) hijack.

That means folks in Texas, California, Ohio, and so on, firing up their browsers and software to connect to Google and its services were instead meandering through systems in Russia and China, and not reaching servers belonging to the Silicon Valley giant. Netizens outside of America may also have been affected.

The Chocolate Factory confirmed that for a period on Monday afternoon, from 1312 to 1435 Pacific Time, connections to Google Cloud, its APIs, and websites were being diverted through IP addresses belonging to overseas ISPs. Sites and apps built on Google Cloud, such as Spotify, Nest, and Snapchat, were also brought down by the interception.

Specifically, network connectivity to Google was routed through TransTelekom in Russia (mskn17ra-lo1.transtelecom.net), and into a China Telecom gateway (ChinaTelecom-gw.transtelecom.net) that black-holed the packets. Both hostnames have since stopped resolving to IP addresses.

The black-hole effect meant Google and YouTube, and apps and sites that relied on Google Cloud, appeared to be offline to netizens. It is possible information not securely encrypted could have been intercepted by the aforementioned rogue nodes, however, our understanding is, due to the black-hole effect, it's likely few if any connections were spied on: TCP connections would fail to establish, and no information would be transferred. That's the best case scenario, at least.

Suspicious

Essentially, someone advertised to the core systems that direct the internet's highways that packets bound for Google IP addresses would be best served by going through TransTelekom and into China Telecom. How exactly routes are commandeered is explained here, and the technique is not new – it's just that the world's backbone networks hope it doesn't happen too often. It's usually by accident, with one network inadvertently acting as a conduit for someone else's traffic, although it typically lasts a few seconds rather than more than an hour.

"Throughout the duration of this issue Google services were operating as expected and we believe the root cause of the issue was external to Google," said the web ad giant, which declined to name names. "We will conduct an internal investigation of this issue and make appropriate improvements to our systems to help prevent or minimize future recurrence."

The search goliath earlier noted:

We've received a report of an issue with Google Cloud Networking as of Monday, 2018-11-12 14:16 US/Pacific. We have reports of Google Cloud IP addresses being erroneously advertised by internet service providers other than Google. We will provide more information by Monday, 2018-11-12 15:00 US/Pacific.

While Google was hesitant to draw any conclusions, cloud security experts have little doubt that the BGP hijacking was intentional, rather than a brief typo in a config file or a fat finger in a terminal, and that the people behind it were almost certainly up to no good by intercepting Google Cloud connections.

Oracle 'net-watcher agrees, China Telecom is a repeat offender for misdirecting traffic

READ MORE

"Our analysis is, given the size and scope and given the countries involved, it is highly unlikely it was accidental," Ameet Naik, senior technical marketing manager at cloud networking monitoring biz ThousandEyes, told The Register today.

"When you have an attack involving Google in countries like Russia and China, you might call that grand theft internet."

Naik said the packet thieves could have been looking to do anything from temporarily disabling Google platforms and APIs, to potentially snooping on traffic from users on Google's services. He noted that the same technique was used back in April to reroute Amazon cloud traffic in an attempt to get at crypto-currency wallets. China Telecom also has form in misdirecting traffic by advertising new routes.

Such BGP attacks can be trivial to pull off for miscreants within ISPs, or governments holding guns to telco admins' heads, given the open nature of BGP, which networks use to effectively route traffic between service providers around the world.

"The internet is built on such an open chain of trust that it is not hard for anybody to inject fake information," Naik said. "It really is that simple." ®

Updated to add

The BGP hijack was caused by a blunder at a West African ISP.

Send us news
76 Comments

Broadcom in talks to buy VMware: multiple reports

Michael Dell could be the key to any deal

Broadcom is in early talks to buy VMware, according to The New York Times, Bloomberg, and Reuters.

VMware is not commenting on the matter.

This one is interesting, because the three sources we've linked to above all say they've got the news from "a person familiar with the matter." All say the deal is nowhere near done, a price has not been discussed, and a transaction is far from certain to happen.

Continue reading

Linus Torvalds debuts 'boring old plain' Linux kernel 5.18

Adds 'feature activation' for Intel silicon, but Chipzilla still isn't saying what that means

Linus Torvalds has released version 5.18 of the Linux kernel.

The maintainer-in-chief’s post announcing the release was typical of those he made for each of the eight release candidates: this time around he found no nasty surprises, additions were neither major nor complex, and no glitches impacted the development process.

Torvalds called for developers to "run boring old plain 5.18" before getting excited about the forthcoming version 5.19.

Continue reading

Robotics and 5G to spur growth of SoC industry – report

Big OEMs hogging production and COVID causing supply issues

The system-on-chip (SoC) side of the semiconductor industry is poised for growth between now and 2026, when it's predicted to be worth $6.85 billion, according to an analyst's report. 

Chances are good that there's an SoC-powered device within arm's reach of you: the tiny integrated circuits contain everything needed for a basic computer, leading to their proliferation in mobile, IoT and smart devices. 

The report predicting the growth comes from advisory biz Technavio, which looked at a long list of companies in the SoC market. Vendors it analyzed include Apple, Broadcom, Intel, Nvidia, TSMC, Toshiba, and more. The company predicts that much of the growth between now and 2026 will stem primarily from robotics and 5G. 

Continue reading

Deepfake attacks can easily trick live facial recognition systems online

Plus: Next PyTorch release will support Apple GPUs so devs can train neural networks on their own laptops

In brief Miscreants can easily steal someone else's identity by tricking live facial recognition software using deepfakes, according to a new report.

Sensity AI, a startup focused on tackling identity fraud, carried out a series of pretend attacks. Engineers scanned the image of someone from an ID card, and mapped their likeness onto another person's face. Sensity then tested whether they could breach live facial recognition systems by tricking them into believing the pretend attacker is a real user.

So-called "liveness tests" try to authenticate identities in real-time, relying on images or video streams from cameras like face recognition used to unlock mobile phones, for example. Nine out of ten vendors failed Sensity's live deepfake attacks.

Continue reading

Lonestar plans to put datacenters in the Moon's lava tubes

How? Founder tells The Register 'Robots… lots of robots'

Imagine a future where racks of computer servers hum quietly in darkness below the surface of the Moon.

Here is where some of the most important data is stored, to be left untouched for as long as can be. The idea sounds like something from science-fiction, but one startup that recently emerged from stealth is trying to turn it into a reality. Lonestar Data Holdings has a unique mission unlike any other cloud provider: to build datacenters on the Moon backing up the world's data.

"It's inconceivable to me that we are keeping our most precious assets, our knowledge and our data, on Earth, where we're setting off bombs and burning things," Christopher Stott, founder and CEO of Lonestar, told The Register. "We need to put our assets in place off our planet, where we can keep it safe."

Continue reading

Conti: Russian-backed rulers of Costa Rican hacktocracy?

Also, Chinese IT admin jailed for deleting database, and the NSA promises no more backdoors

In brief The notorious Russian-aligned Conti ransomware gang has upped the ante in its attack against Costa Rica, threatening to overthrow the government if it doesn't pay a $20 million ransom. 

Costa Rican president Rodrigo Chaves said that the country is effectively at war with the gang, who in April infiltrated the government's computer systems, gaining a foothold in 27 agencies at various government levels. The US State Department has offered a $15 million reward leading to the capture of Conti's leaders, who it said have made more than $150 million from 1,000+ victims.

Conti claimed this week that it has insiders in the Costa Rican government, the AP reported, warning that "We are determined to overthrow the government by means of a cyber attack, we have already shown you all the strength and power, you have introduced an emergency." 

Continue reading

China-linked Twisted Panda caught spying on Russian defense R&D

Because Beijing isn't above covert ops to accomplish its five-year goals

Chinese cyberspies targeted two Russian defense institutes and possibly another research facility in Belarus, according to Check Point Research.

The new campaign, dubbed Twisted Panda, is part of a larger, state-sponsored espionage operation that has been ongoing for several months, if not nearly a year, according to the security shop.

In a technical analysis, the researchers detail the various malicious stages and payloads of the campaign that used sanctions-related phishing emails to attack Russian entities, which are part of the state-owned defense conglomerate Rostec Corporation.

Continue reading

FTC signals crackdown on ed-tech harvesting kid's data

Trade watchdog, and President, reminds that COPPA can ban ya

The US Federal Trade Commission on Thursday said it intends to take action against educational technology companies that unlawfully collect data from children using online educational services.

In a policy statement, the agency said, "Children should not have to needlessly hand over their data and forfeit their privacy in order to do their schoolwork or participate in remote learning, especially given the wide and increasing adoption of ed tech tools."

The agency says it will scrutinize educational service providers to ensure that they are meeting their legal obligations under COPPA, the Children's Online Privacy Protection Act.

Continue reading

Mysterious firm seeks to buy majority stake in Arm China

Chinese joint venture's ousted CEO tries to hang on - who will get control?

The saga surrounding Arm's joint venture in China just took another intriguing turn: a mysterious firm named Lotcap Group claims it has signed a letter of intent to buy a 51 percent stake in Arm China from existing investors in the country.

In a Chinese-language press release posted Wednesday, Lotcap said it has formed a subsidiary, Lotcap Fund, to buy a majority stake in the joint venture. However, reporting by one newspaper suggested that the investment firm still needs the approval of one significant investor to gain 51 percent control of Arm China.

The development comes a couple of weeks after Arm China said that its former CEO, Allen Wu, was refusing once again to step down from his position, despite the company's board voting in late April to replace Wu with two co-chief executives. SoftBank Group, which owns 49 percent of the Chinese venture, has been trying to unentangle Arm China from Wu as the Japanese tech investment giant plans for an initial public offering of the British parent company.

Continue reading

SmartNICs power the cloud, are enterprise datacenters next?

High pricing, lack of software make smartNICs a tough sell, despite offload potential

SmartNICs have the potential to accelerate enterprise workloads, but don't expect to see them bring hyperscale-class efficiency to most datacenters anytime soon, ZK Research's Zeus Kerravala told The Register.

SmartNICs are widely deployed in cloud and hyperscale datacenters as a means to offload input/output (I/O) intensive network, security, and storage operations from the CPU, freeing it up to run revenue generating tenant workloads. Some more advanced chips even offload the hypervisor to further separate the infrastructure management layer from the rest of the server.

Despite relative success in the cloud and a flurry of innovation from the still-limited vendor SmartNIC ecosystem, including Mellanox (Nvidia), Intel, Marvell, and Xilinx (AMD), Kerravala argues that the use cases for enterprise datacenters are unlikely to resemble those of the major hyperscalers, at least in the near term.

Continue reading

US fears China may have ten exascale systems by 2025

China refuses to share benchmarks, US sharpens focus on developing optimized software

The US is racing to catch up with China in supercomputing performance amid fears that the country may widen its lead in exascale computers over the next decade, according to reports.

The Frontier supercomputer at Oak Ridge National Laboratory is expected to be the first exascale system in the US once it is fully operational, but China already has two exascale systems up and running since last year, as reported on our sister site The Next Platform.

This lead may widen as the US has three exascale systems in the pipeline, while China aims to have up to 10 operational systems by 2025, says a report in the Financial times.

Continue reading