Hacker News Reader

Comment by aroch | Hacker News Reader

OMZ Global (AS34329) is an industrial process company (eg steel, manufacturing, ship building, etc). I'm going to assume someone who shouldn't have had access to BGP is trying to use it to block GoogleDNS or similar inside the corporation.

That or some pretty hilariously heavy-handed state-sponsored hijacking.

View on HN

IIRC the only commonly access service hosted in that IP block is their DNS servers. There are easier ways to hijack DNS traffic than trying to hijack the entire prefix via BGP.

A casual browse through the other entries seems to suggest that people mess up BGP announcements all the time. My favourite one below involves the AS belonging to S & S Discount Market Pvt Ltd.

https://bgpstream.com/event/18050

Edit: It has happened previously

http://www.bgpmon.net/googles-services-redirected-to-romania...

> A casual browse through the other entries seems to suggest that people mess up BGP announcements all the time.

While true, incorrect bgp announcements happen all the time, I think this is one of the cases that Hanlon's Razor probably does not apply: most of the time they are not a result of people messing up - rather the bad announcements come from spammers/malware spreaders needing new IP space because their current (likely hijacked) IP space has gotten blacklisted and is no longer effective.

OMZ is also Russian, so state-sponsored isn't out of the running.

How is OMZ being Russian relevant to it possibly being state-sponsored?

Also, it's really not a major challenge to take over someone elses equipment to do this.

Oh come on, there's absolutely no reason for Russia to use a large Russian industrial company to perform BGP hijacking.

Nobody would be bringing up state sponsored attacks if it was a random US manufacturing company doing this.

It is Russian, and it delivers reactor containments and other heavy machinery for nuclear industry and military.

>and military

Do they still? Couldn't find anything post-1940s supporting that.

I'd be willing to bet this is the case; this only covers 8.8.8.0 to 8.8.8.255 so not 8.8.4.4 so it wouldn't be that effective at blocking Google DNS; only 1 IP would be blocked.

Some people don't use both.

Why would they be blocking it? Google promotes 8.8.8.8 as the primary dns server, and, as far as I know, as long as it keeps answering, clients won't fall back to the secondary 8.8.4.4.

Reply on news.ycombinator.com