Filtering is easy if your just doing it for downstream customers.
But how do Tier 1's filter from each other? Once you go up the tree a few times it gets really hard to build any sort of valid filter list of what you should be getting from provider X or provider Y.
BGPSEC and RPKI are unfortunately not really workable yet, in terms of full-path validation. And obviously the source data to do it is a long way off.
The way your post read it sounded like you had to create a filter for all routes in the world but I assume that's not the case in the practical sense.
It's just tedious to do this, and a lot of providers, especially smaller ones don't bother with it.
no I do not believe this to be difficult and anyone configuring BGP should have some awareness of most of its tools.
you can live your whole life without having to use a fire extinguisher or understanding the differences between a,b,c,d etc types but if you are a fire (man/woman) I expect you to understand which is used in what circumstance. if you do not you have the chance to spread a fire and make it worse then prevent it the same with someone who calls themself a network engineer.
[0] https://supportforums.cisco.com/legacyfs/online/legacy/0/5/4...
It could be, the key missing piece of information is the physical location of the actual router that is the ultimate source of this. It is only known by their peers or upstream and is not easily traceable (in the US it's usually under NDA and you'd need court order to find out "officially"). Some network admin somewhere probably knows. May be he/she reads HN. The second question is whether that device is hacked and is doing it unbeknown to its admin.
But without this information, the fact that this is an AS registered with a bogus .ru domain doesn't mean anything, this could be coming from Liechtenstein or Bolivia.
Sure there are. But compare this to an organization getting owned because they didn't patch a known vulnerability. We generally focus on the company that was breached because the power to stop such a breach was in their hands. The same can be said in this situation. ISPs are not proactively taking known measures to minimize the impact of a BGP hijack.
Malicious actors will be malicious...it's what they do. If it's not Russia, it'll be someone else.
The particular networks announced, and particularly the fact that more specific routes were announced, suggests this is some nefarious incident. Not just an accident that someone announced routes they shouldn't have.
I understand that less network savvy readers think this story is about Russia, but it really is about ISP's and the old issue of lazy network admins who do not filter routes and what happens. You can replace "Russia" with "Canada" and it wouldn't change the meaning. The country attribution is based on the AS (Autonomous System) registration. If these were really the malicious state actors, they'd probably use an AS registered in another country to cover their tracks. This is either an honest mistake or possibly a "let's see what would happen" prank.