Ramblings of an old Doc
Published on March 27, 2011 By DrJBHL In Personal Computing

 

Well, a weird thing happened the other day (and not for the first time).

Turns out if you visited/commented on Facebook, you (and 10% of web traffic) took a trip to China, South Korea and back. Yep: Route-Jacking.

Facebook traffic for AT&T customers was routed through Chinese and Korean servers for some unspecified amount of time, raising privacy concerns.

Some of the network traffic heading to Facebook’s servers in Palo Alto, Calif., was re-routed to first pass through Chinese and Korean servers, on March 22. and was thought probably an accident.

“A similar incident surfaced almost exactly a year ago on April 8, 2010, when a Chinese ISP incorrectly published a set of BGP (Border Gateway Protocol) instructions that could have potentially affected 37,000 networks. The incident lasted only 18 minutes, and China Telecom, the country’s largest ISP, denied trying to hijack Internet traffic. Experts speculated it was an accident because of how quickly it was fixed.”

If you’ll remember, I discussed BGP’s and how the net could be brought down by simply increasing the length of time in reporting ‘backups’ or ‘busy’ signals causing a massive net clog up.

I think you should take a look at the article. For me, I’d really like to know that when I’m communicating from inside the US, with a site inside the US, my info-packets won’t be “inspectable” by a country whose policies I eschew and be (perhaps) put on a list for questioning should I ever decide to visit there as a tourist. I also want none of my personal information in their hands.

Source article: http://www.eweek.com/c/a/Security/Facebook-Traffic-Diverted-to-China-Raising-Privacy-Concerns-130825/


Comments (Page 2)
4 Pages1 2 3 4 
on Mar 28, 2011

Scoutdog
The fact that we've all heard about it so quickly makes me think it's probably an innocent glitch. The life expectancy of a coverup is usually a few years.

Not necessarily.  You can determine your route to those sites with a simple traceroute.  Cross referencing the IP numbers with Arin will tell you what servers you are passing through.  Most do not do that, but for those who run these networks, they do it as routine (to make sure just such a thing is not happening).  So the people that did it may have done so innocently, but they may also not be the ones that reported it (and probably were not).  figuring out WHY it happened would help in determing if it was intentional, but that is not conclusive even then.

For me, if it was "innocent", why have we not been routed through Germany or Brazil to those sites in the past?  The routing quacks like a duck and swims like one.  if it walked like one as well, there would be no doubt.  So far, we do not know how it walks.

on Mar 28, 2011

DrJBHL
Some software to trace your path:

http://internet.software.informer.com/download-internet-explorer-graphical-trace-route/

http://www.infopackets.com/news/internet/2002/20020917_using_trace_route_and_ping_to_trace_pathways_on_the_internet.htm

http://route-tracing.softplatz.net/

Just an FYI from the doc.

Cool!  Cut out the middle man (cross referencing).

on Mar 28, 2011

Yep... figured someone might like it.

on Mar 28, 2011

Dr Guy
For me, if it was "innocent", why have we not been routed through Germany or Brazil to those sites in the past? The routing quacks like a duck and swims like one. if it walked like one as well, there would be no doubt. So far, we do not know how it walks.
With a purely isolated incident like this one, it's impossible to establish any comparison. But China has a huge population with relatively good internet connectivity (even if the information they can access over that connectivity is restricted) so if something were to happen randomly, I'd say it would most likely end up in China.

on Mar 28, 2011

Scoutdog
so if something were to happen randomly, I'd say it would most likely end up in China.

My mom told me to quit digging or I would end up there as well.

on Mar 28, 2011

Scoutdog
With a purely isolated incident like this one, it's impossible to establish any comparison.

So, from the OP:

“A similar incident surfaced almost exactly a year ago on April 8, 2010, when a Chinese ISP incorrectly published a set of BGP (Border Gateway Protocol) instructions that could have potentially affected 37,000 networks. The incident lasted only 18 minutes, and China Telecom, the country’s largest ISP, denied trying to hijack Internet traffic. Experts speculated it was an accident because of how quickly it was fixed.”

 

"In March 2010, traffic to sites such as YouTube, Twitter, and Facebook was redirected to servers in China, giving Web surfers around the globe a glimpse of what Chinese Internet users see when they try to access those blocked sites. In November 2010, traffic for 15 percent of the world’s destinations, coming from military and civilian government networks in the UK, the US, Australia, and South Korea started re-directing through China Telecom.

It’s not clear if all of this rerouting is being done on purpose to help China collect intelligence. The Chinese government of course denies such allegations. Experts are still trying to figure out how it happens and how to prevent it in the future."

Source: http://www.zdnet.com/blog/facebook/us-facebook-data-passed-through-chinese-south-korean-isps/970

 

 You see it wasn't, and I'm far from convinced it was innocent.

on Mar 28, 2011

Passing this one around.

on Mar 28, 2011

Although the existence of a second incident also linked to China makes it a bit of an odd coincidence, I don't particularly see why the Chinese government would want to be doing this. It's not as though they can get a lot of actionable intelligence from YouTube and the like, and if they wanted to make some money by data-mining they could just do that off of their own citizens. The amount of disruption and attention caused by this just doesn't seem to be justified by its potential benefit. Compared to what we've seen of China's cybersecruty and cyberwarfare capabilities, this sort of thing seems clunky and somewhat amateurish. I have no doubt that every major power is monitoring the others' civilian and military internet traffic. I just don't think that any of them are doing it with these "hiccups".

on Mar 28, 2011

Coincidence?

DrJBHL
In November 2010, traffic for 15 percent of the world’s destinations, coming from military and civilian government networks in the UK, the US, Australia, and South Korea started re-directing through China Telecom.

Scoutdog
I have no doubt that every major power is monitoring the others' civilian and military internet traffic. I just don't think that any of them are doing it with these "hiccups".

So, is it a coincidence or not? Three times? I don't think so.

on Mar 28, 2011

The Chinese are of a different mindset. Do not make the mistake of attributing to them western values. They can learn more about us just by observing our habits. What we do and how do it. Likes and dislikes. Uncle Sam may not be the best in the world but he isn't stupid. And yes, common sense says that each country that can will monitor civilian and military traffic. That's a no-brainer. Even allies do it to each other. Not too long ago an individual was caught, in the country, gathering data for Israel, sensitive data. Sorry Doc. I'm no anti-Semite. Its a matter of public record. It was reported in all the major papers. Arrested yes. Convicted of spying, no. Sent back home with a slap on the wrist. Anyone else would have been jailed. Between the US and China its brinksmanship. Who can outdo the other. The Soviet Union tried and got spent under the table. Such will not be the case with China. Far better for the US and China to enter into an alliance which has already been offered and which China is considering. A combined US and Chinese military would be the greatest defense this planet has ever seen bar none.

on Mar 28, 2011

As I've said before, China is a heavily-populated, well-wired country, so the odds of these things being rerouted there by random chance are actually pretty good. And as I've said before, this seems far too clumsy for the Chinese. A good metaphor would be that the Gulf oil disaster could have been caused by Saudi Arabian saboteurs, and I don't doubt that it worked in Saudi oil's favor... but it's much more likely that it's just an accident.

Besides, I'm not too worried about China potentially employing this particular method, precisely because it is so broad and directionless. Data mining happens all the time, by a lot of unscrupulous people, and if some Chinese Intelligence analyst sees that you watched "2Girls1Cup" 3,000 times... well... Google, hackers, your ISP and the NSA can get ahold of that information too and will probably care about it a lot more than the PRC. Any sensitive data that they're actually looking for in corporate or government traffic that is being sent unencrypted and unsecured through outside servers is more than vulnerable enough as is. We live in an information sieve, but (un?)fortunately the sheer volume of stuff a self-respecting spy agency is going to collect on a day-to-day basis serves as a very good cover for both your credit card number and price-fixing deals.

on Mar 28, 2011

MadDeez
my rig doesn't know how to do facebook or any other social network crap. she's a good girl

And so are you, "John".

IROKONESS

Quoting Savyg, reply 11 Holy shit there are a lot of old and paranoid people around here. 
Ah to be young and innocent again. Wait young man, one day you'll be a dad and eat those words. Worry will be your middle initial also.

Uhm.... What's parenthood got to do with Facebook/social networks?
I've been a dad for 17 years now, and do not waste my time worrying where my kids surf. I'm not that friggin' paranoid. They've got brains themselves.
Just because you're young and uses the interweb doesn't mean that the whole world is out to hack you.

on Mar 28, 2011

MadDeez
my rig doesn't know how to do facebook or any other social network crap. she's a good girl

At least that should keep her from catching a few extra STD's..LoL.

on Mar 29, 2011

Scoutdog
Although the existence of a second incident also linked to China makes it a bit of an odd coincidence, I don't particularly see why the Chinese government would want to be doing this.

Why is easy.  Besides the turmoil of a disruption, the Chinese are also struggling with making the Internet a private net for its citizens.  The turmoil in the Mid east is partially being reflected in China as well, and some people in China are by passing the censors.  By diverting the traffic through their routers, they can capture all the data (no way can they analyze it real time), and then take their leisure to analyze it and figure out how their censorship is being bypassed.  They then create stronger rules that stop the bypassing thus keeping their populace ignorant.

The North Korea angle is merely a disruptive attempt.  Little Kimmy does anything his Chinese masters tell him to.

on Mar 29, 2011

Doesn't using HTTPS alleviate much of these concerns?  While the snooping systems might know where you are going (ie Facebook, Twitter, Battle.Net), the encrypted connection should prevent them from reading any of your personal data in a timely manner .

You can either enable HTTPS within Facebook by changing a setting in your user profile, or by manually adding the "S" to the address bar yourself.

4 Pages1 2 3 4