Internet’s new biggest threat? How web traffic can be secretly redirected
Internet experts say huge chunks of sensitive web traffic have been routinely hijacked by hackers and diverted to foreign computers, compromising the data of victims in at least 150 cities worldwide.
Researchers at New Hampshire-based global internet intelligence company Renesys say that they’ve witnessed a complex type of Man-in-the-Middle attack occur on computer networks no fewer than 60 days this year already, the likes of which they say should never have happened.
In incidents described in a report released by Renesys last month, the firm claims that web data from major financial institutions, government agencies and Internet Service Providers (ISPs) alike were all compromised when unidentified hackers exposed a rarely-discussed vulnerability in order to almost silently divert that information away from its intended destinations, and instead route it abroad to be collected, read and then re-sent to the rightful recipient.
The method of attack exploits a vulnerability in the Border Gateway Protocol, or BGP, and takes advantage of the fact that much of the information routed through the global system of networks considered to be the backbone of the internet is exchanged based off of little more than trust among administrators.
BGP is "essentially the glue that holds the disparate parts of the Internet together," Jennifer Rexford, a computer science professor at Princeton University, told the Washington Post’s Andrea Peterson last month.
"Each domain (AT&T, Princeton and so on) will tell its neighbors it connects to directly which destinations it can reach and over what paths," Rexford said of BGP. "Those neighbors will then choose amongst those set of paths that are offered by their respective neighbors, add themselves to the front of the path and tell their neighbors."
"By default your neighbor just believes you, and doesn't have a really reliable way to tell if you are actually telling the truth," Rexford added. Unfortunately for many, though, hackers are alleged to have taken advantage of this vulnerability and in turn exploited the trusting relationship between neighboring domains.
"Like a lot of the technologies underlying the Internet, it was designed without security in mind under this sort of implicit assumption that all the guys on the network are good guys, and all the bad guys -- if they exist at all -- are outside the network," Rexford added. "People worried about the network being vulnerable to physical attacks, but the idea of cyberattacks wasn't really in people's thinking at the time."
Decades later, the internet has emerged to become a beast that even the developers of the protocols it relies on wouldn’t have expected. Renesys says hackers took advantage of this, and were able to therefore hijack web data without relying on the sophisticated means conjured up by officials at, say, the National Security Agency.
While classified documents released this year suggest that the NSA has physically tapped into fiber optic cables carrying internet data and even developed methods of attack to compromise the most complex of encryption algorithms, the method identified by Renesys is a whole different sort of sneaky. What these hackers have been doing, the company claims, involves hijacking the route web traffic is intended to travel and diverting it elsewhere for analysis before sending it back on its right path.
“Why settle for simple denial of service, when you can instead steal a victim’s traffic, take a few milliseconds to inspect or modify it and then pass it along to the intended recipient?” Renesys co-founder Jim Cowie wrote last month. “This year, that potential has become reality.”
According to Cowie and company, hackers have been using their skills to take web data meant for certain servers and send it all the way to Belarus in one example, and Ireland in another. The victims, the company claims, were computer users in the United States, South Korea, Germany, the Czech Republic, Lithuania, Libya and Iran, who likely never knew that their internet transmissions were secretly diverted to unintended recipients during the normal transfer of bits and bytes.
In one example cited by Cowie, a computer that connects to the internet in Mexico willingly transmits data to Washington, DC that is carried over BPG by the networking firm PCCW.
“Mexican provider Alestra hands it to PCCW for transit in Laredo, Texas,” Cowie wrote, and then “PCCW takes it to the Washington, DC metro area, where they would normally hand it to Qwest/Centurylink for delivery.”
Instead, he continued, PCCW gives that data to another fiber cable owner, Level3, and that’s when hackers have their way with the information.
“Level3 . . . is advertising a false Belarus route, having heard it from Russia’s TransTelecom, who heard it from their customer, Belarus Telecom,” he says. “Level3 carries the traffic to London, where it delivers it to Transtelecom, who takes it to Moscow and on to Belarus. Beltelecom has a chance to examine the traffic, and then sends it back out on the ‘clean path’ through Russian provider ReTN. ReTN delivers it to Frankfurt and hands it to NTT, who takes it to New York. Finally, NTT hands it off to Qwest/Centurylink in Washington DC, and the traffic is delivered.”
“The recipient, perhaps sitting at home in a pleasant Virginia suburb drinking his morning coffee, has no idea that someone in Minsk has the ability to watch him surf the web,” Cowie said.
Renesys believes around 1,500 individual IP blocks from 150 cities around the world — including Chicago, Denver, Montreal and New York — were compromised in what the firm claims was not an accident, but indeed an attack.
“In practical terms, this means that Man-In-the-Middle BGP route hijacking has now moved from a theoretical concern to something that happens fairly regularly, and the potential for traffic interception is very real,” Cowie wrote. “Everyone on the internet — certainly the largest global carriers, certainly any bank or credit card processing company or government agency — should now be monitoring the global routing of their advertised IP prefixes.”
“This kind of attackshould not happen,” he added. “You cannot carry out this kind of hijacking without leaving permanent, visible footprints in global routing that point right back to the point of interception. We believe that people are still attempting this because they believe (correctly, in most cases) that nobody is looking.”
