[AusNOG] FYI : Attackers are accessing routers running on the border gateway protocol (BGP) and injecting additional hops

[Daniel Hood]

Whats the easiest way one could monitor their netblocks to make sure there
is no funny business going on in their paths?



On Sun, Nov 24, 2013 at 6:10 PM, Joshua D'Alton <joshua at railgun.com.au>wrote:

> I'd be interested if you knew how Level3 particularly protect their
> netblocks, especially the precious 4/8, I've heard its the veritable fort
> knox of netblocks, but...
>
>
> On Sun, Nov 24, 2013 at 8:03 PM, Dobbins, Roland <rdobbins at arbor.net>wrote:
>
>>
>> On Nov 24, 2013, at 3:47 PM, Joshua D'Alton <joshua at railgun.com.au>
>> wrote:
>>
>> > Roland, I'd be interested to know if Arbor has seen 'DDoS' via BGP
>> 'hacks' like this, certainly it is quite easy to divert hundreds of Gbit of
>> traffic, perhaps... :)
>>
>> Yes, we've seen deliberate hijacking for DDoS, as well as spammers
>> hijacking netblocks for brief periods of time to send spam bursts sourced
>> from the netblocks in question.  Doing so for DDoS purposes is quite
>> infrequent, but doing so for spamming purposes is fairly routine, and in
>> many cases goes unnoticed (until the netblocks in question are blacklisted
>> by the various anti-spam organizations, heh).
>>
>> -----------------------------------------------------------------------
>> Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>
>>
>>           Luck is the residue of opportunity and design.
>>
>>                        -- John Milton
>>
>> _______________________________________________
>> AusNOG mailing list
>> AusNOG at lists.ausnog.net
>> http://lists.ausnog.net/mailman/listinfo/ausnog
>>
>
>
> _______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20131124/89538740/attachment.html>