North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: YouTube IP Hijacking

  • From: Jim Popovitch
  • Date: Sun Feb 24 18:03:20 2008

http://www.google.com/reader/m/view/?source=mobilepack&v=2.1.4&rlz=1H2GGLE_en&i=-3701578819353178822&c=CMOjuszq3ZEC&n=1



On 2/24/08, Max Tulyev <[email protected]> wrote:
>
> I think it was NOT a typo. This was a test, much more important test for
> this world than last american anti-satellite missile.
>
> And if they do it again with more mind, site will became down for a
> weeks at least... More of that, if big national telecom operator did it
> and have neighbors to filter them out - it can lead to global split of
> the network.
>
> Of course, it should be happened early or late with THIS design of the
> Network.
>
> Ravi Pina wrote:
> > Sounds more like a typo on a filter over at AS17557
> > than anything else.
> >
> >
> http://ca.news.yahoo.com/s/afp/080224/world/denmark_media_islam_pakistan_internet_youtube
> >
> > -r
> >
> >
> > On Sun, Feb 24, 2008 at 12:27:29PM -0800, Sargun Dhillon wrote:
> >> As you guys probably know Youtube's IP's are being hijacked. Trace:
> >> ~ $ host youtube.com
> >> youtube.com has address 208.65.153.253
> >> youtube.com has address 208.65.153.238
> >> youtube.com has address 208.65.153.251
> >> [Same /24]
> >>
> >>
> >> 701 3491 17557
> >>     64.74.137.253 (metric 1) from 66.151.144.148 (66.151.144.148)
> >>       Origin IGP, metric 100, localpref 100, valid, external
> >>       Community: 65010:300
> >>       Last update: Sun Feb 24 11:33:05 2008 [PST8PDT]
> >> 3491 17557
> >>     216.218.135.205 from 216.218.135.205 (216.218.252.164)
> >>       Origin IGP, metric 100, localpref 100, valid, external, best
> >>       Last update: Sun Feb 24 10:47:57 2008 [PST8PDT]
> >>
> >> So, it seems that youtube's ip block has been hijacked by a more
> >> specific prefix being advertised. This is a case of IP hijacking, not
> >> case of DNS poisoning, youtube engineers doing something stupid, etc.
> >> For people that don't know. The router will try to get the most specific
> >> prefix. This is by design, not by accident. This is a case of censorship
> >> on the internet. Anyways, I hope this doesn't get into a political
> >> situation, and someone stops this.
> >>
> >>  What action are you going to take? Are you going to filter
> >> announcements from AS17557, or just filter that specific announcement?
> >> Considering youtube is a fairly high-traffic website I think that other
> >> operators are just going to start filtering that AS. This is a great
> >> example of global politics getting in the way of honest corporatism.
> >> This is also an example of how vulnerable the internet is, and how lax
> >> providers are in their filtering policies. I don't know how large
> >> Pakistani Telecom is, but it I bet its not large enough that PCCW should
> >> be allowing it to advertise anything.
>
>
> --
> WBR,
> Max Tulyev (MT6561-RIPE, 2:463/[email protected])
>