Wouldn't they want to hijack more specifics to spam? I doubt much of that space is going to correctly route for spamming purposes. On 11/9/06, Hank Nussbacher <hank@efes.iucc.ac.il> wrote:

On Thu, 9 Nov 2006, Josh Karlin wrote:

...

Here is one that is somewhat the opposite, the AS announced a significant portion of IANA allocated space. Note, they are large blocks and as such probably did not cause much damage because most networks announce more specifics. My question to the community is, what kind of misconfiguration could cause this set of prefixes to be announced? I asked the AS responsible, but have not had a response.

Misconfiguration? :-) That's a nice word for spammer. See Joe's PPT at: http://www.uoregon.edu/~joe/maawg8/maawg8.ppt

AS29449 is not the problem. It is the upstreams of AS5602 (KPNQwest Italia) and AS286 (KPN) that let this crap leak.

-Hank Nussbacher http://www.interall.co.il

the preso link is below, you didnt read it yet.. :) you can hijack any address space providing your route is preferred either because it is more specific, less specific, shorter as-path.. Steve On Thu, Nov 09, 2006 at 10:59:20PM -0700, Josh Karlin wrote:

Wouldn't they want to hijack more specifics to spam? I doubt much of that space is going to correctly route for spamming purposes.

On 11/9/06, Hank Nussbacher <hank@efes.iucc.ac.il> wrote:

...

On Thu, 9 Nov 2006, Josh Karlin wrote:

...

Here is one that is somewhat the opposite, the AS announced a significant portion of IANA allocated space. Note, they are large blocks and as such probably did not cause much damage because most networks announce more specifics. My question to the community is, what kind of misconfiguration could cause this set of prefixes to be announced? I asked the AS responsible, but have not had a response.

Misconfiguration? :-) That's a nice word for spammer. See Joe's PPT at: http://www.uoregon.edu/~joe/maawg8/maawg8.ppt

AS29449 is not the problem. It is the upstreams of AS5602 (KPNQwest Italia) and AS286 (KPN) that let this crap leak.

-Hank Nussbacher http://www.interall.co.il

-- Stephen J. Wilcox BSc (Hons). CCIE #10730 Technical Director, Telecomplete http://www.telecomplete.co.uk/

Wouldn't they want to hijack more specifics to spam?

no. see nick feamster's work, and the lightning talk i proxied for him in dallas. randy

I'm just somewhat surprised that they would announce /3's, /6's, and /7's and be so incredibly obvious about it

if it was incredibly obvious, why did it take us so long to see it? and no, please let's not all have a "i saw it first" contest. randy

On Fri, Nov 10, 2006 at 07:20:10AM +0200, Hank Nussbacher wrote:

AS29449 is not the problem. It is the upstreams of AS5602 (KPNQwest Italia) and AS286 (KPN) that let this crap leak.

In fact, it may not even be the immediate upstreams. In our paper, we describe specific examples where it's very hard to track exactly who's at fault, because so much of the AS path appears to be forged. See finding #5 in the excerpt below. I include the most germane excerpt from the paper below, for people's convenience. btw, Randy Bush helped us understand this technique a bit better and coined the phrase spectrum agility. "... We have called this technique ``spectrum agility'' because it allows a spammer the flexibility to use a wide variety of IP addresses within a very large block from which to send spam. The large IP address block allows the mail relays to ``hop'' between a large number of IP addresses, thereby evading IP-based filtering techniques like DNSBLs. Judging from Figure~\ref{fig:dnsbls} and our analysis in Section~\ref{sec:dnsbls}, the technique seems to be rather effective. As an added benefit, route announcements for shorter IP prefixes (\ie, larger blocks of IP addresses) are less likely to be blocked by ISPs' route filters than route announcements or hijacks for longer prefixes. Upon further inspection, we also discovered the following interesting features: (1)~the IP addresses of the mail relays sending this spam are widely distributed across the IP address space; (2)~the IP addresses from which we see spam in this address space typically appear only once; (3)~on February 6, 2006, attempts to contact the mail relays that we observed using this technique revealed that that roughly 60-80\% of these hosts were not reachable by {\tt traceroute}; (4)~many of the IP addresses of these mail relays were located in allocated, albeit unannounced and unused IP address space; and (5)~many of the AS paths for these announcements contained reserved (\ie, to-date unallocated AS numbers), suggesting a possible attempt to further hamper traceability by forging elements of the AS path. ... " -Nick