Apple have prevailed in a dispute with Russian telco Rostelecom after the latter issued erroneous route announcements to divert traffic intended for the servers of the American corporation to the latter’s network.
Aftab Siddiqui, a network engineer working on the Mutually Agreed Norms for Routing Security (MANRS) project, reported that on July 26–27, Rostelecom began advertising routes over the border gateway protocol (BGP) for a little over 12 hours for a portion of Apple’s network.
Internet customers who were trying to connect to Apple’s services in some areas of the Internet may have been routed via the Rostelecom network as a result, Siddiqui wrote.
Apple does not use Route Origin Authorisation (ROA), which relies on cryptographically signed items from the resource public key infrastructure (RPKI) to confirm that an origin AS is authorised to broadcast network prefixes.
By ensuring ROA is valid, networks can avoid making erroneous BGP route announcements and diverting traffic to the incorrect location.
Siddiqui claimed that without ROA, the only choice available during a route hijack is to broadcast more precise routes.
According to Siddiqui, “Apple Engineering did exactly this today; as soon as it became aware of the hijack, it started announcing 17.70.96.0/21 to route traffic toward AS714.”
Accidental misconfigurations have caused some of the instances, such as the one in 2004 when Turkish provider TTNet pretended to represent the entire Internet, preventing millions of customers from accessing reliable websites for hours at a time.
Others, such as the 2018 Iranian Telecommunications Telegram prefix takeover, raise the possibility of nation-state participation.
As happened in February of this year when the South Korean cryptocurrency site KlaySwap was attacked and over US$2 million in cash were seized, criminals have been known to utilise BGP hijacking to steal traffic.
According to Siddiqui, it is the duty of network operators to guarantee an internationally reliable and secure routing infrastructure, which involves establishing legitimate ROAs for all of their resources.
“A routing architecture that stops is essential for the security of your network.”