|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: Yahoo outage summary
On Sun, 8 Jul 2007 19:51:04 -0400 (EDT) Sean Donelan <[email protected]> wrote: > On Sun, 8 Jul 2007, Steven M. Bellovin wrote: > >> I put up a diary at the Storm Center > >> (http://isc.sans.org/diary.html?storyid=3112) that summarizes what > >> we know about the Yahoo outage on Friday. If anybody has any > >> additional info they want to share or comments about the write-up > >> please let me know. > >> > > In other words, it was yet another BGP screw-up that secured routing > > could have prevented. > > Or using route registeries and filters, or any of the other dozen > ideas suggested over the last decade. > > > Any clue about the root cause, i.e., malice or accident? > > Does it matter? You are screwed either way. > It tells us what we need to do to prevent such things from happening in the future. For example, most misconfigurations could be blocked if all routers matched prefixes against originating ASNs, and it doesn't matter much if the assertion is digitally signed or not -- all that matters is that the check is done against some authoritative database run, say, by the RIRs. (No, that's not quite the right solution, but it serves to illustrate my point.) That's completely inadequate against an attacker. --Steve Bellovin, http://www.cs.columbia.edu/~smb
|