[Infowarrior] - Hacking Team orchestrated brazen BGP hack to hijack IPs it didn’t own

[Richard Forno]

Hacking Team orchestrated brazen BGP hack to hijack IPs it didn’t own

Hijacking was initiated after Italian Police lost control of infected machines.

by Dan Goodin - Jul 12, 2015 6:53pm EDT

http://arstechnica.com/security/2015/07/hacking-team-orchestrated-brazen-bgp-hack-to-hijack-ips-it-didnt-own/

Spyware service provider Hacking Team orchestrated the hijacking of IP addresses it didn't own to help Italian police regain control over several computers that were being monitored in an investigation, e-sent among company employees showed.

Over a six day period in August 2013, Italian Web host Aruba S.p.A. fraudulently announced its ownership of 256 IP addresses into the global routing system known as border gateway protocol, the messages document. Aruba's move came under the direction of Hacking Team and the Special Operations Group of the Italian National Military Police, which was using Hacking Team's Remote Control System malware to monitor the computers of unidentified targets. The hijacking came after the IP addresses became unreachable under its rightful owner Santrex, the "bullet-proof" Web hosting provider that catered to criminals and went out of business in October 2013, according to KrebsOnSecurity.

It's not clear from the e-mails, but they appear to suggest Hacking Team and the Italian police were also relying on Santrex. The emails were included in some 400 gigabytes of proprietary data taken during last weekend's breach of Hacking Team and then made public on the Internet.

With the sudden loss of the block of IP addresses, Italy's Special Operations Group was unable to communicate with several computers that were infected with the Hacking Team malware. The e-mails show Hacking Team support workers discussing how the law enforcement agency could regain control. Eventually, Italian police worked with Aruba to get the block—which was known as 46.166.163.0/24 in Internet routing parlance—announced in the BGP system as belonging to Aruba. It's the first known case of an ISP fraudulently announcing another provider's address space, said Doug Madory, director of Internet analysis at Dyn Research, which performs research on Internet performance.

"Stupid, old, insecure core protocol"

The revelation is the latest to raise troubling questions about BGP, the core Internet routing mechanism that's almost entirely based on trust. Although the /24 block of affected addresses was small and inexplicably inactive at the time, the hijacking is already generating criticism not only of the world's continued dependence on the insecure framework, but also of the impropriety of Aruba, Hacking Team, and the Italian government for jointly making the fraud happen.

"BGP is a stupid, old, insecure core protocol of the Internet," Filippo Valsorda, an engineer on the CloudFlare Security Team, told Ars. "The affected IP class, 46.166.163.0/24, was unannounced (dead) at the time. However, the BGP trust game is delicate and critical and this reckless irresponsibility undermines the trust that the Internet survives on (and makes it sorely clear how it needs to move on from it)."

It's not the first time BGP has been abused. In late 2013, Dyn Research presented evidence showing that huge chunks of Internet traffic belonging to financial institutions, government agencies, and network service providers had repeatedly been diverted to distant and unauthorized locations, stoking suspicions the traffic may have been surreptitiously monitored or modified before ultimately reaching its intended destination. While the repeated hijackings were the most serious to come to light so far, other large swaths of Internet traffic routinely are found diverted to distant and unexplained networks, including Russia's domestic Internet traffic passing through China in 2014 and 167 important British Telecom customers' data being routed through Ukraine earlier this year.
The Hacking Team e-mails show the impunity employees felt as they worked to hijack the block of inactive IP addresses, some of which hosted virtual private servers (VPSes) used as part of a command and control system for the computers infected with the RCS malware. By having Aruba fraudulently announce the addresses, Hacking Team and its Italian customer could impersonate the Santrex hosting provider and reestablish communications with the infected machines.

"If everything was done correctly, we should get back the VPS online hoping then that the backdoor is still alive and [we] may contact the VPS," an unidentified Hacking Team support worker wrote in an August 13, 2013 e-mail, which Ars translated from Italian into English using Google Translate.

As a result, the fraudulent routing table was broadcast to networks including Italian telecommunications companies Fastweb, MC-link S.p.A, and Reteivo.it, global service provider Easynet, and Internet backbone and colocation provider Hurricane Electric, according to a blog post published Sunday by researchers from OpenDNS. From there, the bogus route was spread around the world from Australia to the Philippines, Dyn Research's Madory told Ars. Word of the hijacking first surfaced on Friday here.

As noted earlier in this post, the ease of fraudulently manipulating the BGP system has long been recognized as a key weak point in Internet security. The Hacking Team e-mails (1, 2, 3, 4, 5, 6, 7, 8, and 9) move that risk out of the theoretical and into the practical. It also underscores the need for universal norms to be observed by service providers and for enforceable penalties when they're breached.

"In general, the issue is that BGP is the underlying system for directing Internet traffic around the world and there is presently nothing to stop an entity from announcing another entity's IP address space—effectively impersonating it," Madory wrote in an e-mail. "These techniques can be used to intercept or manipulate the contents of affected Internet traffic or simply to 'blackhole' traffic."


--
It's better to burn out than fade away.