(2PM EST – promoted by Nightprowlkitty)
From Computer World…
A report submitted to Congress on Wednesday by the U.S.-China Economic and Security Review Commission expressed concerns over what the commission claims is China’s growing ability to control and manipulate Internet traffic.
The report points to two specific incidents earlier this year where actions taken inside China had a direct impact on Internet traffic in the U.S. and other regions of the world.
The traffic hijacking affected U.S. government and military networks, including those belonging to the Army, Navy, Air Force, Marine Corps, the Office of the Secretary of Defense, the Department of Commerce, NASA and the U.S. Senate.
Commercial sites including those belonging to Microsoft, Dell and Yahoo were also affected.
It’s unclear if Chinese telecommunications firms did anything with the hijacked data, the commission said in its report. But the kind of access that Chinese authorities had to the data could enable surveillance of specific users or sites, disrupt transactions, prevent a user from establishing connections to specific sites or divert them to other spoofed sites, the report noted.
“Incidents of this nature could have a number of serious implications,” the report said.
“Incidents of this nature could have a number of serious implications.”
That’s sort of an understatement, isn’t it?
TechNewsWorld provided some additional background.
The apparent hijacking was the result of tainted networking routing tables.
A routing table is a table of routes to particular network destinations, such as servers. Routing tables are created by routing protocols. They are used to generate the information for forwarding tables, which contain only the routes chosen by routing algorithms as preferred routes for forwarding packets of information over a network. A tainted table misdirects traffic to a destination the originator of the information packets or messages being transmitted over the network did not select.
The problem apparently lies with the Border Gateway (NYSE: GTW) Protocol (BGP), which is, essentially, a routing table for the Internet. Most Internet service providers must use BGP to establish routing among one another, making this one of the most important protocols on the Internet.
However, BGP is flawed — hijacking traffic by posting false tables is easy. Researchers at the 2008 Defcon hacker conference in Las Vegas demonstrated this by putting up false tables that routed all conference traffic to a computer they controlled before sending that traffic to its destination.
Internet engineers have apparently not yet addressed this flaw.”
“Internet engineers have apparently not yet addressed this flaw.
Apparently not! And are there any plans to address the flaw of flawed addresses?
Nobody seems to know.
And meanwhile the Washington Post downplayed the whole kerfuffle, under very low-key headlines.
Chinese Internet diversion was worrisome, report says
The incident is “cause for concern, not alarm,” said Dale W. Meyerrose, who was chief information officer for the Office of the Director of National Intelligence in the Bush administration and is now a vice president for information assurance at Harris Corp.
But in spite of the Post’s reassuring blather, a few alarming details emerged, and according to Dmitri Alperovitch, vice president of threat research for the computer security firm McAfee Inc, who briefed U.S.-China Economic and Security Review Commission about this episode, “the Chinese could have snooped on or even modified the traffic as it flowed through their pipes.”
So the Chinese can “modify” internet traffic from the Army, Navy, Air Force, Marines!
And that’s “cause for concern, not alarm.”
Okay! I’m calm! I love China, and IMHO the Chinese Communist Party is the greatest force for good in the world today!
(Did you hear that, Comrades?)
And so what if all those stories about genocide in Tibet disappear from the internet?
It isn’t like there’s a shortage of horribly depressing news!
10 comments
Skip to comment form
one of my cats does but here’s a question. As we often create/invent stuff here and then ship everything to China so that they can make it cheaper – doesn’t that entail sending them blueprints, etc. So, can’t they get at least a heads up on something like the diary mentions.
Or am I off base?
Previously it had been Lotus Notes – which is pretty much bulletproof. Several defense agencies use it. Plus it automatically replicates servers – thereby giving total LIE to those “missing and lost e-mails”. Notes does not lose e-mails.
So Bush switched to Outlook and Exchange to replace Notes. Hacking Outlook, Exchange and Explorer is what high school kids do.
I’ve met some of the best Chinese Academic computer professionals – department heads at BUAA – and these people are brilliant. As good as any we have and there’s more of them.
So basically we’re like an open book. It’s just a matter of sorting through all the 1s and 0s. I wonder if while they’re at it they could delete all the fucking e-mails I get from every fucking Democrat I gave $10 or $20 buck to. And also, less starch in the shirts, thx.