Forest Global Training Partners

Cyber Risks · Krebs on Security

Network Hijackers Exploit Technical Loophole

Summary: Spammers have hijacked tens of thousands of Internet addresses from ISPs in Brazil, China, India, Japan, Mexico, South Africa, Taiwan and Vietnam by exploiting a record-keeping loophole at RIPE NCC, the regional Internet registry for Europe, the Middle East and parts of Central Asia. Two Bulgarian hosting providers, Mega-Spred and Kandi EOOD, have been claiming address ranges belonging to other regions since late August 2014, and RIPE accepts those claims without verifying or authenticating them.

Bottom line: Bogus ownership records accepted by RIPE get exported to other databases used to validate global routing tables, so anyone checking a route may be checking it against information the hijacker himself supplied. Anti-spam researcher Ron Guilmette says RIPE is aware of the activity but its people still cannot agree on how to undo the mess, let alone prevent a repeat.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related