News for hackers. Stuff that matters.

A comment on Hijack of Amazon’s domain service used to reroute web traffic for two hours. Parent comment

Re:Hijack of Amazon’s domain service used to reroute web tra... by buzer on Tuesday April 24, 2018 @05:34PM (#16916831)
It looks like Amazon announces /23s, but there were announcements for the more specific /24s today, starting from around 11:05:42 UTC, the routes were withdrawn at 12:55:35 (to be more specific, that's when RIPEs probe saw the changes).

https://stat.ripe.net/205.251.192.0%2F24#tabId=routing

As far as I know, most of ASNs only filter routes coming from their direct customers (if even that and even in that case they are likely to accept those prefixes from their own peers), so once route gets into the tier 1 ISPs routing tables, it's going to be propagated pretty much everywhere.

[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by notyourday on Wednesday April 25, 2018 @10:08AM (#16921611)
Well, in that case Amazon needs to hire better backbone engineers. For anycast they should always be announcing both covering routes and de-aggregated routes.

They should also be constantly monitoring views of AWS network from other BGP speaking networks, allowing them to immediately detect such poisoning. If other important BGP speaking network does not want to provide them the view, they can go to a single-homed with BGP customer of such network and buy the view.

[ Parent | on HN ]