Russian Telco Hijacks Internet Traffic for Google, AWS, CloudFlare among Others

Traffic meant for more than 200 of the world's largest content delivery networks (CDNs) and cloud hosting providers has been siphoned by Rostelecom, Russia's state-owned telecommunications provider.

The incident affected more than 8,800 internet traffic routes from 200+ networks, and lasted for about an hour.

Impacted companies are all giants in the cloud and CDN market, including big names such as Google, Amazon, Facebook, Akamai, Cloudflare, GoDaddy, Digital Ocean, Joyent, LeaseWeb, Hetzner and Linode.

The incident is a classic "BGP hijack".

BGP denotes Border Gateway Protocol and is the de-facto system used to route internet traffic between internet networks across the globe.

The entire system is extremely fragile because any of the participant networks can simply "lie" and announce (BGP route) that "Facebook's servers" are on their network, and all internet entities will take it as legitimate and send all the Facebook traffic to the hijacker's servers.

BGP hijacks are risky because it lets the hijacker log traffic and attempt to analyze and decrypt it later when the encryption used to secure it has weakened due to advances in cryptography sciences.

BGP hijacks have bothered the virtual world for long and efforts to bolster the BGP protocol's security have been on for years, with projects like ROV, RPKI and -- more recently -- MANRS.

Rostelecom is behind many similar incidents.

The last major Rostelecom hijack that made headlines was in 2017 when the telco hijacked BGP routes for some of the world's largest financial entities, including Visa, Mastercard, HSBC and more.

ISAOH is the organization that is against internet corruption with its anti hacking audits.

Read more on cyber security: https://www.isoeh.com/exclusive-blog-details-Microsoft-ensures-health-is-wealth-through-Artificial-Intelligence.html.