L'assenza di Putin probabilmente e dovuta a questo fatto fuori dall'ordinario.
In poche parole in quei giorni c'è stato un route hijacking (dirottamento di percorso) del traffico di rete partito dal Texas verso l'Inghilterra ed era stato instradato verso i sistemi di comunicazione russi ed ukraini.
Il fatto di per sè potrebbe essere irrilevante in quanto il traffico di rete transita per la via meno congestionata del momento.
In questo caso però dai Trace Routing si rileva che questo traffico ha coinvolto
, poi se sia stata una esercitazione, una dimostrazione di forza oppure un qualche errore, è un altra storia.
Comunque Putin era scomparso per 10 giorni in concomitanza di questo fatto.
March 13, 2015
Comments (30) Views: 7513
Security Doug MadoryUK traffic diverted through Ukraine




On the heels of the BGP leak yesterday that briefly
impaired Google services around the world, comes another routing incident that impacted some other important Internet services.
Beginning on Saturday, Ukrainian telecom provider,
Vega, began announcing 14
British Telecom (BT) routes, resulting in the redirection of Internet traffic through Ukraine for a handful of British Telecom customers. Early yesterday morning, Vega announced another 167 BT prefixes for 1.5 hours resulting in the rerouting of additional traffic destined for some of BT’s customers, including the UK’s
Atomic Weapons Establishment, the “
organization responsible for the design, manufacture and support of warheads for the United Kingdom’s nuclear deterrent.”
BackgroundIn early 2013, Ukrainian provider Vega (AS12883)
became a reseller of BT services, but prior to Saturday had never announced any BT routes. Then, in the middle of a weekend night in Europe (02:37 UTC on Saturday, March 7
th), Vega began announcing 14 prefixes typically announced by AS2856 of BT. These prefixes are listed below.
109.234.168.0/21 Thales Transport and Security Ltd (Barnet, GB)
109.234.169.0/24 Thales Transport and Security Ltd (Ealing, GB)
144.87.142.0/24 Royal Mail Group Limited (Sheffield, GB)
144.87.143.0/24 Royal Mail Group Limited (Chesterfield, GB)
147.182.214.0/24 Black & Veatch (Manchester, GB)
193.113.245.0/24 BT - 21CN (GB)
193.221.55.0/24 Svenska Cellulosa Aktiebolaget SCA (GB)
193.32.23.0/24 Tilbury Container Services Ltd (Tilbury, GB)
193.36.243.0/24 Allen and Overy LLP Tower (Hamlets, GB)
193.39.16.0/21 The Guinness Partnership (Oldham, GB)
194.34.64.0/24 AstraZeneca PLC (GB)
195.171.26.0/24 The Carphone Warehouse Limited (Westminster, GB)
195.211.94.0/24 AEA Technology Plc (Islington, GB)
203.215.136.0/24 Servcorp SmartOffice (Tower Hamlets, GB)

The
Royal Mail group is the
postal service company of the UK. While the Royal Mail’s website offers a handy “Redirect your mail” link, it was their electronic mail that was being redirected over the past week, because one of the impacted networks contains the IP addresses of their email servers, which are shown next.
$ dig +short royalmail.com MX
10 cscmaanot02.royalmail.com.
10 cscmaanot01.royalmail.com.
$ dig +short cscmaanot02.royalmail.com. A
144.87.143.99
$ dig +short cscmaanot01.royalmail.com. A
144.87.143.97
The following graphics display the percentage of our peers over time that saw either BT (AS2856) or Vega (AS12883) announce routes for the Royal Mail service. Both of these routes are covered by
144.87.128.0/17, which is announced by British Telecom (AS2856). So for about five days, a significant portion of the Internet was sending traffic destined for these routes to Vega in the Ukraine. Our traceroutes show that traffic continued on to British Telecom after passing through Kiev.
Hijacked Nuke Networks
Then at 03:03 UTC yesterday morning, Vega (AS12883) began announcing 167 additional BT prefixes, including the following prefixes of the UK’s
Atomic Weapons Establishment. After routing all of these prefixes for 90+ minutes, Vega stopped announcing any BT prefixes at 04:36 UTC.
132.153.244.0/24 Atomic Weapons Establishment GB
132.153.245.0/24 Atomic Weapons Establishment GB
132.153.246.0/24 Atomic Weapons Establishment GB
132.153.247.0/24 Atomic Weapons Establishment GB
132.153.248.0/24 Atomic Weapons Establishment GB
132.153.249.0/24 Atomic Weapons Establishment GB
132.153.250.0/24 Atomic Weapons Establishment GB
132.153.251.0/24 Atomic Weapons Establishment GB
132.153.252.0/24 Atomic Weapons Establishment GB
132.153.253.0/24 Atomic Weapons Establishment GB
132.153.254.0/24 Atomic Weapons Establishment GB
132.153.3.0/24 Atomic Weapons Establishment GB
Next, we illustrate the route propagation profiles for two of the aforementioned AWE prefixes. Since these routes were already globally distributed by BT, only a small portion of the Internet believed that Vega was a better alternative. (Another noteworthy network impacted at the same time was that of defense contractor
Lockheed Martin, apparently hosting an external VPN service at evpnuk1a.external.lmco.com, which resolves to 192.28.124.20.)

The above Atomic Weapons Establishment address space contains the IP addresses of their email servers, namely:
132.153.244.3 awe.co.uk mta1.awe.co.uk
132.153.244.4 awe.co.uk mta2.awe.co.uk
To illustrate this traffic redirection, we will consider the normal and altered traceroute paths from one location in the US to AWE. On the day prior, the traceroute shown below goes from Houston via Softlayer to the Telehouse facility in New York City, and then onto BT and AWE.
trace from Houston, TX to Atomic Weapons Establishment at 12:40 Mar 11, 2015
1 *
2 173.193.118.140 ae12.dar02.sr02.hou02.networklayer.com 0.28
3 50.97.18.242 ae9.bbr01.sr02.hou02.networklayer.com 0.28
4 173.192.18.218 ae3.bbr01.eq01.dal03.networklayer.com 6.13
5 173.192.18.137 ae0.bbr01.eq01.chi01.networklayer.com 26.17
6 173.192.18.133 ae0.bbr02.tl01.nyc01.networklayer.com 48.188
7 173.192.18.176 ae7.bbr01.tl01.nyc01.networklayer.com 51.295
8 198.32.160.80 (TELEHOUSE, New York) 46.511
9 166.49.208.40 t2c3-xe-11-3-1-0.uk-lon1.eu.bt.net 114.113
10 166.49.211.243 166-49-211-243.eu.bt.net 114.354
11 213.121.193.151 host213-121-193-151.ukcore.bt.net 114.142
12 62.172.103.85 core2-pos1-0.birmingham.ukcore.bt.net 239.692
13 62.6.196.74 vhsaccess1-pos8-0.birmingham.fixed.bt.net 121.198
14 132.153.3.254 Atomic Weapons Establishment 134.476
During the hijack on the next day, a traceroute from the same location gets diverted to Vega’s interface at
DECIX in Frankfurt, Germany (Ucomline is Vega’s international brand). From there, it was passed to Vega’s interface with its Russian transit provider,
RETN, before traveling back to the
London Internet Exchange and finally to its intended destination at AWE via BT.
trace from Houston, TX to Atomic Weapons Establishment at 03:22 Mar 12, 2015
1 *
2 173.193.118.140 ae12.dar02.sr02.hou02.networklayer.com 2.948
3 50.97.18.246 ae9.bbr02.sr02.hou02.networklayer.com 0.3
4 173.192.18.220 ae3.bbr02.eq01.dal03.networklayer.com 8.133
5 173.192.18.135 ae1.bbr01.tl01.atl01.networklayer.com 28.524
6 173.192.18.152 ae0.bbr01.eq01.wdc02.networklayer.com 42.033
7 173.192.18.195 ae7.bbr02.eq01.wdc02.networklayer.com 40.167
8 50.97.18.215 ae0.bbr01.eq01.ams02.networklayer.com 118.838
9 50.97.18.217 ae0.bbr02.xn01.fra01.networklayer.com 124.983
10 50.97.18.218 ae7.bbr01.xn01.fra01.networklayer.com 124.133
11 80.81.194.177 edge-3-2-5-231.kiev.ucomline.net 154.988
12 87.245.247.157 ae2-241.RT.NTL.KIV.UA.retn.net 155.174
13 87.245.233.238 ae2-10.RT.TC2.LON.UK.retn.net 158.221
14 195.66.224.10 linx1.ukcore.bt.net 161.442
15 194.72.31.130 (BTnet inter-pop routes, GB) 166.986
16 62.172.103.89 core1-pos1-1.birmingham.ukcore.bt.net 163.205
17 62.6.196.70 vhsaccess1-pos7-0.birmingham.fixed.bt.net 164.139
18 132.153.3.254 (Atomic Weapons Establishment, GB) 177.4
The 167 hijacked prefixes (listed below) also included more innocuous networks like those of Pepsi Cola (
165.197.56.0/22) and Wal-Mart UK (
161.163.166.0/24 and
161.163.177.0/24). However, these networks do host domains with “VPN” and “mail” in their names, implying they provide important services for these companies. Does this list represent some curious mistake or something more? Either way, it redirected a portion of Internet traffic bound for networks, at a minimum resulting in poor performance for some customers.
161.163.166.101 csukvpn01.wal-mart.com
161.163.166.101 uksslvpngw.wal-mart.com
161.163.166.102 csukvpn02.wal-mart.com
165.197.57.5 emea.webmail.intl.pepsico.com
165.197.57.6 emea.webmail.intl.pepsico.com
ConclusionUnlike yesterday’s
Google routing leak that was remediated after only 20 minutes, Vega’s errant announcement of BT’s networks went on for five days. As we’ve chronicled in the blog in past, route hijacking has become
a growing and ever-present concern. As a result, enterprises must monitor their routes to ensure uninterrupted Internet connectivity for their customers — no one else is going to do it for them. Whether for security or performance, tools like
Dyn Internet Intelligence were built to address this need.
Below is a complete listing of the 167 leaked prefixes from yesterday:212.162.232.0/24 Cofunds Ltd (GB)
148.253.220.0/23 Department for Environment, Food and Rural Affairs (DEFRA) (GB)
61.28.211.0/24 Servcorp (GB)
86.128.0.0/11 BT Infrastructure Layer (GB)
86.128.0.0/12 BT Infrastructure Layer (GB)
193.32.254.0/24 Marks and Spencer PLC (GB)
194.70.94.0/24 Dabs Direct PLC (GB)
148.252.5.0/24 Department for Environment, Food and Rural Affairs (DEFRA) (GB)
37.235.123.0/24 Submission Technology Ltd (GB)
194.169.34.0/24 AgustaWestland Ltd (GB)
81.128.0.0/12 BT Infrastructure Layer (GB)
143.159.0.0/16 INFONET Services Corporation (GB)
147.148.0.0/14 Various Registries (Maintained by ARIN) (GB)
193.46.221.0/24 Continental DataGraphics Ltd (GB)
132.153.3.0/24 Atomic Weapons Establishment (GB)
194.169.69.0/24 BUILDING DESIGN PARTNERSHIP LIMITED (GB)
91.230.16.0/24 Dairy Crest Ltd (GB)
193.32.48.0/24 Virgin Money plc (GB)
193.36.240.0/24 Allen and Overy LLP (GB)
192.19.187.0/24 Avago Technologies U.S. Inc. (GB)
31.48.0.0/13 BT Public Internet Service (GB)
195.171.0.0/16 BT Public Internet Service (GB)
132.153.254.0/24 Atomic Weapons Establishment (GB)
213.120.0.0/14 BT Public Internet Service (GB)
91.223.126.0/24 Evolving Systems Limited (GB)
116.66.140.0/22 Cognizant Technology Solution India Pvt Ltd, India (GB)
81.128.0.0/11 BT Public Internet Service (GB)
195.182.62.0/24 The Football Association Ltd (GB)
185.30.8.0/22 Satellite Applications Catapult Limited (GB)
86.128.0.0/10 BT Public Internet Service (GB)
147.152.0.0/16 British Telecommunications PLC (GB)
162.62.136.0/22 Adaptec, Inc. (GB)
193.28.232.0/24 TEVA UK HOLDINGS LIMITED (GB)
193.238.232.0/24 Pinewood Technologies Plc (GB)
194.36.55.0/24 Hogg Robinson PLC (GB)
196.4.50.0/24 Uniserv Group (GB)
194.33.160.0/24 Office of Communications (GB)
161.163.177.0/24 Wal-Mart Stores, Inc. (GB)
194.130.197.0/24 MAID PLC (GB)
192.65.44.0/24 Tektronix, Inc. (GB)
192.189.160.0/24 Lafarge Tarmac Holdings Limited (GB)
132.153.252.0/24 Atomic Weapons Establishment (GB)
193.195.138.0/24 Telme Online Limited (GB)
193.33.244.0/24 AAH Pharmaceuticals Ltd (GB)
132.153.251.0/24 Atomic Weapons Establishment (GB)
198.200.211.0/24 Curtis Instruments, Inc. (GB)
193.46.76.0/24 Shire Pharmaceuticals Limited (GB)
144.98.0.0/16 RWE NPower (GB)
84.23.0.0/19 Biznet IIS Ltd. (GB)
158.234.0.0/16 CGI IT UK Ltd. (GB)
193.35.197.0/24 British Telecommunications PLC (GB)
194.60.136.0/24 Cornwall Council (GB)
146.174.170.0/23 Quantum Corporation (GB)
167.26.157.0/24 CIBC World Markets (GB)
109.205.158.0/24 BONTBLOCK (GB)
5.81.0.0/16 BT Infrastructure Layer (GB)
162.10.0.0/19 Doculynx Inc. (GB)
158.155.253.0/24 Computer Generation (GB)
165.197.56.0/22 Pepsi-Cola International (GB)
193.37.142.0/24 CSC IT Ltd (GB)
148.252.3.0/24 Department for Environment, Food and Rural Affairs (DEFRA) (GB)
193.113.0.0/16 British Telecommunications PLC (GB)
194.36.248.0/24 WWRD United Kingdom Ltd (GB)
193.37.160.0/24 BT Public Internet Service (GB)
91.198.255.0/24 Sandwell Metropolitan Borough Council (GB)
192.65.227.0/24 British Telecommunications PLC (GB)
5.53.64.0/19 SAS Global Communications Ltd. (GB)
132.153.244.0/24 Atomic Weapons Establishment (GB)
170.136.115.0/24 Viad Corp (GB)
194.59.188.0/24 WCMC 2000 (GB)
194.132.25.0/24 WSP Europe (GB)
195.99.0.0/16 BT Public Internet Service (GB)
192.152.14.0/24 Aircraft Research Association Limited (GB)
159.10.208.0/22 CNA Insurance (GB)
199.181.156.0/24 ARC - Chicago (GB)
132.153.246.0/24 Atomic Weapons Establishment (GB)
192.65.224.0/24 British Telecommunications PLC (GB)
94.72.248.0/21 KCOM BT sub-allocation (GB)
193.238.233.0/24 Pinewood Technologies Plc (GB)
193.219.122.0/24 Significant (UK) Ltd (GB)
80.247.56.0/23 PGDS UK ONE - BT Internet - PG1 DC (GB)
192.65.228.0/24 British Telecommunications PLC (GB)
192.65.226.0/24 British Telecommunications PLC (GB)
194.169.32.0/24 AgustaWestland Ltd (GB)
204.124.211.0/24 Fruit of the Loom, Inc. (GB)
194.169.32.0/20 AgustaWestland Ltd (GB)
148.253.4.0/22 Department for Environment, Food and Rural Affairs (DEFRA) (GB)
194.132.24.0/24 WSP Europe (GB)
194.169.22.0/24 Isoft Health Ltd (GB)
132.153.247.0/24 Atomic Weapons Establishment (GB)
194.34.174.0/24 Allianz Insurance plc (GB)
161.163.166.0/24 Wal-Mart Stores, Inc. (GB)
195.8.202.0/23 Significant (UK) Ltd (GB)
192.31.31.0/24 British Telecommunications PLC (GB)
192.28.124.0/24 Lockheed Martin Corporation (GB)
212.140.0.0/16 BT Public Internet Service (GB)
193.195.7.0/24 Thus PLC t/a Demon Internet (GB)
192.19.199.0/24 Avago Technologies U.S. Inc. (GB)
91.233.33.0/24 Metropolitan Networks UK Ltd (GB)
192.65.222.0/24 British Telecommunications PLC (GB)
159.180.96.0/19 BT-CENTRAL-PLUS (GB)
165.120.0.0/16 BT Public Internet Service (GB)
155.202.124.0/22 SANTANDER UK PLC (GB)
150.147.68.0/24 Data Research Associates, Inc. (GB)
132.146.0.0/16 British Telecommunications PLC (GB)
109.144.0.0/12 BT Public Internet Service (GB)
159.253.66.0/23 KCOM Group Public Limited Company (GB)
142.205.161.0/24 Toronto Dominion Bank (GB)
62.7.0.0/16 BT Public Internet Service (GB)
62.239.0.0/16 British Telecommunications PLC (GB)
194.36.128.0/24 Hitachi Europe Ltd (GB)
194.32.3.0/24 Northern Ireland Civil Service (GB)
170.136.116.0/24 Viad Corp (GB)
217.32.0.0/12 BT Public Internet Service (GB)
192.65.219.0/24 British Telecommunications PLC (GB)
194.169.33.0/24 AgustaWestland Ltd (GB)
213.1.0.0/16 BT Public Internet Service (GB)
62.6.0.0/16 BT Public Internet Service (GB)
5.80.0.0/15 BT Public Internet Service (GB)
195.244.16.0/24 Websense SC Operations Limited (GB)
91.227.78.0/24 Ashridge (Bonar Law Memorial) Trust (GB)
194.169.36.0/24 AgustaWestland Ltd (GB)
193.131.115.0/24 Eurodollar (UK) Limited (GB)
192.65.223.0/24 British Telecommunications PLC (GB)
212.70.68.0/23 Intuitiv Ltd. (GB)
194.169.79.0/24 BUILDING DESIGN PARTNERSHIP LIMITED (GB)
132.153.250.0/24 Atomic Weapons Establishment (GB)
80.247.0.0/20 Net Energy Internet Ltd. (GB)
195.35.123.0/24 Toshiba Information Systems (UK) Ltd (GB)
194.130.196.0/24 MAID PLC (GB)
194.34.211.0/24 The Statistics Board (GB)
85.235.107.0/24 DMZ at Bacton. (GB)
146.198.0.0/16 INFONET Services Corporation (GB)
82.132.188.0/22 O2 Reference (UK) (GB)
194.72.0.0/14 BT Public Internet Service (GB)
213.249.188.0/22 KCOM Group Public Limited Company (GB)
194.34.210.0/24 The Statistics Board (GB)
194.34.205.0/24 The Statistics Board (GB)
192.65.225.0/24 British Telecommunications PLC (GB)
132.153.245.0/24 Atomic Weapons Establishment (GB)
132.153.253.0/24 Atomic Weapons Establishment (GB)
132.153.249.0/24 Atomic Weapons Establishment (GB)
162.116.126.0/24 Allergan, Inc. (GB)
91.247.73.0/24 Unipath Limited (GB)
145.229.0.0/16 Northern Ireland Civil Service (GB)
192.65.221.0/24 British Telecommunications PLC (GB)
149.223.0.0/16 TRW Automotive (GB)
194.169.35.0/24 AgustaWestland Ltd (GB)
167.26.158.0/24 CIBC World Markets (GB)
159.197.13.0/24 NATS (GB)
62.172.0.0/16 BT Public Internet Service (GB)
212.162.230.0/24 Royal Bank of Scotland plc (GB)
216.222.222.0/24 Smith and Nephew - Endoscopy (GB)
193.102.37.0/24 Softlab GmbH, Muenchen (GB)
194.102.0.0/19 British Telecommunications PLC (GB)
193.32.39.0/24 Sir Robert McAlpine Ltd (GB)
192.156.169.0/24 Syntellect Inc. (GB)
171.30.128.0/17 Global Crossing VHSDR service (GB)
132.153.248.0/24 Atomic Weapons Establishment (GB)
194.34.209.0/24 The Statistics Board (GB)
193.36.253.0/24 Allen and Overy LLP (GB)
195.95.131.0/24 NCC Services Ltd (GB)
152.134.0.0/16 SIX CONTINENTS LIMITED (GB)
61.28.219.0/24 Servcorp (GB)
194.34.223.0/24 Allianz Insurance plc (GB)
167.26.159.0/24 CIBC World Markets (GB)
193.39.141.0/24 AWE PLC (GB)
Source:
UK traffic diverted through Uk...arch | The New Home Of Renesys