Comments on: How Pakistan knocked YouTube offline (and how to make sure it never happens again)

YouTube becoming unreachable isn't the first time that Internet addresses were hijacked. But if it spurs interest in better security, it may be the last.

[n3td3v]

Good work Cnet News

I congratulate on this article, i think it deserves to be a featured story rather than a blog entry.

There isn't enough research on stories now-a-days in the online journalist scene.

Its good to see some refreshing journalism again.

I've been reading Declan McCullagh over the years and he is without doubt one of, if not the best journalist who works with Cnet News.

When you see Declan McCullagh at the top of news articles on Cnet News, you know you're going to get a quality indepth read on whats going on.

His stories are particularly good on government issues and wiretapping.

Well done Cnet for original refreshing journalism, which lacks in the American-media scene all too often.

Usually I need to goto British news sites to get real news and real facts, but this proves me wrong that America's media outside of the NY Times can produce quality news.

[rnieves1977]

I concur

awesome read

[chash360]

Not enough....

The article is a good follow up, with excellent technical details, but....

There are issues so alarming, underlying this, and significant assumptions that are not being questioned.

I'll bet that no one in Pakistan thought this would happen, I'll bet they thought that no one outside of Pakistan would notice this at all.

There is a much easier way to cut of access, than this, the method chosen appears to be one of a very suspicous nature. A method that enables the local Pakistan NOC to find out who (in Pakistan) was connecting to YouTube, not just block it.

Your best bet for real news is still media sources outside the US, because ours is quite well owned and controlled....

[pakurilecz]

we can do without

the snarky editorial comments
"We've already seen domain name blocking in Finland and Web page blocking in the United States, both supposedly enlightened Western democracies.)"

just report the news, if I want snark I'll go to Huffington post or moveon.org

[routerguy]

script kiddies?

Um, unless a "script kiddie" is working at a NOC, with access to a router running BGP, this is just scare-mongering. This problem has been around, unchanged, for years. Route filtering (accepting only routes for which the propogating router is responsible) helps. A more responsive ISP would have negated this "attack" in minutes, not hours.

[thenet411]

And idiots!

Never underestimate the power of an idiot with a router password.

[n3td3v]

script kids can't do shit like this.

I thought the same when I read "script kiddies".

I don't think script kids can do a whole with this at the moment.

They would need to wait for the real hackers to release some kind of technique for them to use.

However, cyber terrorism is a possibility.

If a script kid gets a job at a NOC or SOC then there is real potential for damage to be caused.

Proper vetting of course is needed to stop the cyber terrorists getting jobs which work with technology and telecoms, where there is critical infrastructure at the hands of staff members.

Even human error can be a cyber terrorism, even if the error was unintentional.

It seems this was a "blue on blue" cyber attack...

Remember, your computers don't need to be connected to the internet for them to be exploited with zero-day code or a malicious user.

If a staff member can do badness by mistake or intentionally, to the end-user it doesn't matter how it happened, the result is still the same as a full scale malicious attack.

I'm sure Youtube don't care if it was a mistake, an outage is an outage and has the same affect as a malicious attack.

The hackers aren't going to go into the NOC /SOC centers, they are gonna pay the script kids to do it.

There is a pecking order that is maintained... when hackers want to target computers not connected to the internet, they will send in human resources to work at key jobs. Those human resources are the script kids, directed by the big hackers. The big hackers won't risk jail.

Remember folks, if you have computers in critical ifnrastructure buildings, they need to be patched from zero-day that appears on the security mailing lists, even if those computers will never be connected to the internet, because even with really good employee vetting and physical security checks into the building, there is always a chance the cyber terrorists will get in and get access to these not-connected-to-the-internet computers.

[M C]

I remember when CNet was sure Pharming was about to explode...

...what? You don't even know what "pharming" means?

Yeah, that's how serious that threat actually was.

And now they seem sure every script kiddie with a cable modem will find a magical way to redirect all of the Web's traffic.

How did that saying go? "Fool me once, shame on...uh, won't get fooled again"?

[declan00]

pharming

Dear "M C":

- CNET is not a monolithic entity. We employ hundreds of writers and editors, each with his or her own view. There's no party line. (A few weeks ago, my colleague Michael Kanellos and I debated capitalism here on these pages.) So because one person was excited about pharming doesn't mean much.

- It was a quote. Did you actually read the full article?

[Karl Viklund]

This might be a huge problem in the future

Very good article! Good work Cnet.

Well. This is Internet's largest weakness. And I'm sure that countries in the future, in an event of a war will try to sabotage Internet for the country it is in war with and we will end of with several different Internets that cant connect. I'm sure this will be debated heavily over the coming weeks by media and security experts and be an example that maybe it's time to try to do something about this weakness.

[jdrachmat]

Can an individual DO anything ?

The article focuses on what Internet authorities can do to prevent this serious problem occuring in the future.

My question is - can an individual do anything ? What if your ISP decides to hijack the IP address of one or other website ? Can an individual in Pakistan circumvent what Pakistan Telecom did ?

I know all hackers will now concentrate on how to replicate what Pakistan Telecom did, but I hope some IT wizard would come up with a way for individuals to fight back, and not having to rely on irresponsible businesses such as PCCW.

[declan00]

What you can do

It's an interesting question. Two things that come to mind are: you could pay attention to the certificates of sites that claim to be your bank, credit union, etc. Another is you could do a traceroute to a specific IP address if you have suspicions about it and see where it's located.

The below indicates that YouTube's 208.65.153.253 IP address is in or near San Jose, which makes sense.

eriador-cnet-cnwk:~ declan$ traceroute 208.65.153.253
traceroute to 208.65.153.253 (208.65.153.253), 64 hops max, 40 byte packets
[snip]
5 ggr6.n54ny.ip.att.net (12.122.86.101) 94.928 ms 93.830 ms 93.987 ms
6 64.212.107.97 (64.212.107.97) 93.317 ms 95.230 ms 98.577 ms
7 youtube-llc.po1.401.ar2.sjc2.gblx.net (64.212.108.162) 171.381 ms 184.317 ms 170.837 ms
8 youtube.com.hk (208.65.153.253) 170.291 ms 170.851 ms 171.321 ms

[ralfthedog]

Just a thought.

How about setting up a DNS archive? Think of an internet site that keeps a list of DNS changes. When you set them as your DNS server, you can pick a date and you will get the IP addresses for that time.

This would let you get around DNS spoofing by hackers or governments.

I am running on a negative amount of sleep, so I don't know if this is a good idea. Please comment.

[sundance_tree]

Pakistan Telco Uptstream providers partly to blame...

those telcos, like PCCW, should have only accepted customer networks announcements, unless explicitly requested, as opposed to accepting and announcing everything their customers throws at them. One hopes people have learned their lessons this time.

[dlshield]

Script Kiddies - oh you mean criminals

Why would you continue to use a less meaningful name for the criminals who cause such havoc for other people. Do you live in an ivory tower where you do not see that these criminals cause immense damage. Please quit coddling them. Call them as they are. Criminals

[ralfthedog]

You give them far too much credit.

Yes, script kiddies are criminals. They are just the bottom level skilless criminals that don't qualify as hackers.

I have a great deal of respect for a master counter fitter who can hand draw a $100 bill that will pass inspection. I have no respect for a 12 year old kid who has a color copier.

Not all criminals are created equal.

[bluenorway]

Pakistan Video Mirrors (Active YouTube URLs)

The youtube and other flv hosts' mangling of the original video to avoid copyright by "defacement" is very upsetting, but watching "What is Love" might just resolve that ;)

http://youtube.com/watch?v=5S3OA3nJRBQ
http://youtube.com/watch?v=HIHDqZLTK5Y

multiple "Danish Cartoon Parody" and "Geert" or "Forbidden Trailer" searchable.

http://thepiratebay.org/tor/4047508
http://thepiratebay.org/tor/4047509

We'll see how filterable a specific migratory stream / http url is... It takes a VERY large packet filter device to pull that scale of censorship off on multihoned isps.

Mirror FLV stream backup http://wikileaks.bluenorway.org etc

http://BlueNorway.Org
[e-mail]

;)

[tballard--2008]

And this is why...

This is why we should never, ever give up control of the internet to
the United Nations. This type of thing would become rampant.

[jwvo]

Two things worth noting

1. While PCCW is a .hk based company, their network is run entirely out of the US. I run a regional provider who uses them as well, and everyone I have ever dealt with (sales, NOC and provisioning) was in the US.

2. BGP filters are common on smaller ASN's peering sessions, but on customers who are viewed as bigger due mainly to the number of prefixes and/or company size there is an assumption of clue fullness and implicit trust as you say and thus filters are often omitted. This is true with the big American users as well. PCCW buys service from Global Crossing as an example and nobody is complaining that Global crossing didn't filter PCCW, but since PCCW transits about 15,000 routes, this would be a bit odd (15,000 routes of the total 245,000 or so that make up the internet).

[chash360]

Note the location too....

Where is PCCW's main US network operations?

Is its proximity to gov intelligence installations a coincidence?

Is not this same mechanism able to snoop upon packets, by routing through 'forged routes', without interupting service?

Why would anyone do this to block a website when all that is needed is for the Pakistan telco to remove the route, and DNS entry of YouTube from its local NOC? (this is the safe easy way.)

Do we even know for sure that the supposed material being censored was what was claimed....cartoons just don't seem to justify such a drastic action?


There is little argument that taking over hosting of those addresses was done just to cut off local access, its a strong indicator that it was done to find exactly who (IP and MAC addresses) was attempting access to YouTube at that time.

Perhaps to trace/prevent uploading of?????

This again is a very strong argument for physical addressing and routing using GPS Signals, which cannot be forged, nor duplicated. (without fake GPS Satelites anyway).

[4cls]

A good example...

Of why you should have network engineers on staff. It sounds like Google was really on the ball.

Indiviuals cannot do much to affect the inetent, but when network engineers are ordered to do stupid stuff by the goverment, what can you do. Anybody with an authorized AS number and a BGP router can affect the stablility of the Interent.

[Fred Remus]

Well - a Prophetic Blog

Looks to me like somebody just did the same to Hotmail.

[royc]

And for the weekend and Monday

I can't get to Wikipedia.

Who is upset with them?

[The_Decider]

Not likely

Hotmail has enough issues to bring it down from time to time and it commonly blocks legitimate email.

[cshenry]

Fred Remus

If you are the son of Fred and Betty Remus, nephew of Mary and Lois, cousin to Carma (writer of this message) on your father's side; please respond to this message for information regarding your father. Thank you.

[SenorFrog]

Great Article

Very educational. I'd like a follow up on exactly what Mr Karlin of Univ of NM is observing ('...the dubious claims to be the true destination for certain Internet addresses--taking place on an hourly basis') How is this being done, what are the addresses in question and why is it being done? Maybe this will clarify the 'script kiddies' comment made at the end.

[sam99999999]

Great Article!

Really well written Declan. One of the best on CNET.

I learned a lot from it and the links referenced useful sites. To echo another poster, it should be an article, not just a blog post.

[TheGreatOn]

Pakistan Telecom

Pakistan Telecom is 26% privately owned by Etisalat which also controls the company, so although you would be accurate to say it is a state-owned company I don't think it paints an accurate picture.