Internet experts say huge chunks of sensitive web traffic have been routinely hijacked by hackers and diverted to foreign computers, compromising the data of victims in at least 150 cities worldwide.
Researchers at New Hampshire-based global internet intelligence company Renesys say that they’ve witnessed a complex type of Man-in-the-Middle attack occur on computer networks no fewer than 60 days this year already, the likes of which they say should never have happened.
In incidents described in a report released by Renesys last month, the firm claims that web data from major financial institutions, government agencies and Internet Service Providers (ISPs) alike were all compromised when unidentified hackers exposed a rarely-discussed vulnerability in order to almost silently divert that information away from its intended destinations, and instead route it abroad to be collected, read and then re-sent to the rightful recipient.
The method of attack exploits a vulnerability in the Border Gateway Protocol, or BGP, and takes advantage of the fact that much of the information routed through the global system of networks considered to be the backbone of the internet is exchanged based off of little more than trust among administrators.
BGP is "essentially the glue that holds the disparate parts of the Internet together," Jennifer Rexford, a computer science professor at Princeton University, told the Washington Post’s Andrea Peterson last month.
"By default your neighbor just believes you, and doesn't have a really reliable way to tell if you are actually telling the truth," Rexford added. Unfortunately for many, though, hackers are alleged to have taken advantage of this vulnerability and in turn exploited the trusting relationship between neighboring domains.
Decades later, the internet has emerged to become a beast that even the developers of the protocols it relies on wouldn’t have expected. Renesys says hackers took advantage of this, and were able to therefore hijack web data without relying on the sophisticated means conjured up by officials at, say, the National Security Agency.
While classified documents released this year suggest that the NSA has physically tapped into fiber optic cables carrying internet data and even developed methods of attack to compromise the most complex of encryption algorithms, the method identified by Renesys is a whole different sort of sneaky. What these hackers have been doing, the company claims, involves hijacking the route web traffic is intended to travel and diverting it elsewhere for analysis before sending it back on its right path.
“Why settle for simple denial of service, when you can instead steal a victim’s traffic, take a few milliseconds to inspect or modify it and then pass it along to the intended recipient?” Renesys co-founder Jim Cowie wrote last month. “This year, that potential has become reality.”
According to Cowie and company, hackers have been using their skills to take web data meant for certain servers and send it all the way to Belarus in one example, and Ireland in another. The victims, the company claims, were computer users in the United States, South Korea, Germany, the Czech Republic, Lithuania, Libya and Iran, who likely never knew that their internet transmissions were secretly diverted to unintended recipients during the normal transfer of bits and bytes.
In one example cited by Cowie, a computer that connects to the internet in Mexico willingly transmits data to Washington, DC that is carried over BPG by the networking firm PCCW.
Instead, he continued, PCCW gives that data to another fiber cable owner, Level3, and that’s when hackers have their way with the information.
“Level3 . . . is advertising a false Belarus route, having heard it from Russia’s TransTelecom, who heard it from their customer, Belarus Telecom,” he says. “Level3 carries the traffic to London, where it delivers it to Transtelecom, who takes it to Moscow and on to Belarus. Beltelecom has a chance to examine the traffic, and then sends it back out on the ‘clean path’ through Russian provider ReTN. ReTN delivers it to Frankfurt and hands it to NTT, who takes it to New York. Finally, NTT hands it off to Qwest/Centurylink in Washington DC, and the traffic is delivered.”
“The recipient, perhaps sitting at home in a pleasant Virginia suburb drinking his morning coffee, has no idea that someone in Minsk has the ability to watch him surf the web,” Cowie said.
Renesys believes around 1,500 individual IP blocks from 150 cities around the world — including Chicago, Denver, Montreal and New York — were compromised in what the firm claims was not an accident, but indeed an attack.
“This kind of attack should not happen,” he added. “You cannot carry out this kind of hijacking without leaving permanent, visible footprints in global routing that point right back to the point of interception. We believe that people are still attempting this because they believe (correctly, in most cases) that nobody is looking.”