Connect with us


MIT: We’ve created AI to detect ‘serial internet address hijackers’



Widespread internet outage blamed on Verizon
A Verizon error resulted in a “cascading catastrophic failure.”

The Border Gateway Protocol (BGP), a core internet protocol, is wide open to abuse. Attackers can effectively fool other networks into misdirecting internet traffic for the attackers’ gain, be it snooping, phishing, or some other goal. 

While many hijacking events are benign and due to misconfigurations, there have been numerous cases in the past few years showing attackers are abusing BGP on a large scale. 

A BGP route hijack happens when an internet operator wrongly announces another network’s IP address blocks. In BGP route tables, ISPs are identified by an AS (Autonomous System) number.  

SEE: 10 tips for new cybersecurity pros (free PDF)    

A problem with the system is that it’s difficult to know for sure whether a BGP hijacking event is actually malicious or just an accident. Researchers have in the past identified highly suspicious events because traffic from major companies like Apple, Amazon, Microsoft, and Google was wrongly rerouted. The other sign is the location and reputation of the ISP that caused it. 

Other times, it’s more clear cut that an event is malicious, but internet infrastructure providers can still be wrongly routing traffic according to an attacker’s plan for hours before they can rectify the problem.  

The US National Institute for Standards and Technology (NIST) is working on a proposal that could thwart many BGP hijacking events. 

It involves Resource Public Key Infrastructure (RPKI) to allow cloud providers and ISPs that hold blocks of internet addresses to control which networks can announce a direct connection to their address block. 

It’s also working on BGP Validation so that routers can use RPKI information to filter out unauthorized BGP route announcements. 

Researchers at MIT are working on the detection side of the problem using a machine-learning model to “automatically identify Autonomous Systems (ASes) that exhibit characteristics similar to serial hijackers.”

The gist of the effort is to help network operators proactively respond to ISPs that have a track record for bad behavior rather than only reacting to events after they happen. As it is, network operators can only publicly call out bad behavior in network engineering mailing lists and hope other networks help correct the issue. 

“Current hijack detection systems typically rely on assumptions of prefix ownership and track origin changes in the global routing table. If an event is detected, the victim network can react and attempt to get in contact with the perpetrator or its upstream networks to solve the problem,” the MIT researchers explain in a paper ‘Profiling BGP Serial Hijackers: Capturing Persistent Misbehavior in the Global Routing Table’, which they’ll present later this month in Amsterdam. 

“However, many times this contact is not fruitful or not even possible. At that point, victims of hijacks are only left with the option of publicly disclosing the event in network operator mailing lists in the hope that peer pressure and manual interventions by other networks, such as filtering announcements or refusing to provide transit, will remediate the situation.” 

The researchers built the machine-learning detection model based on the assertion that malicious BGP behavior by an actor is sometimes consistent over time. By analyzing actions over time, the researchers aimed to create a scoring system to indicate an operator’s good or bad reputation. 

The serial BGP hijackers they focus on are the ASes that have displayed malicious activity in the global routing table for several years. 

“We take on a new perspective on illicit BGP activity: instead of looking at individual BGP hijacking events, we study the long-term prefix advertisement dynamics in the global routing table in space and time.”

Specifically, they looked at BGP announcement dynamics of serial hijacker ASes over five years in a bid to identify characteristics that separate them from well-behaved ASes.

SEE: Dear network operators, please use the existing tools to fix security

One of the serial hijackers in the study, AS197426, or BitCanal, was “effectively cut off from the global internet” last July, according to Oracle-owned Dyn. The Portuguese company was described by a security researcher as a BGP “hijack factory” because of its persistent hijacking activity over the years.   

The classifier also identified AS19529 as a hijacker network and AS134190 as a network that shows the most recent indications of potential serial hijacker behavior. 

With this knowledge, it would be possible for network operators to deploy systems to automatically discard bad BGP routing announcements rather than relying on mailing lists.  

But they also note possible problems with autonomous detection. For example, companies that provide protection against distributed denial-of-service (DDoS) attacks are what they call ‘benign serial hijackers’ because the process of scrubbing DDoS traffic involves BGP hijacking. 

Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *


This Bugatti Divo Lady Bug’s geometric paint job is truly one-of-a-kind



The Bugatti Divo is a Chiron for the racetrack, but this Lady Bug version with its diamond-shaped fading patterns is best appreciated while the car is stationary. As if the Divo is not outrageous enough, one lucky customer in America wants to push the boundaries further. And as expected, Bugatti pulled it off, although it took quite a while to iron the challenges of creating an exclusive, one-off Lady Bug paint job.

“Every Bugatti Divo is one of a kind. With the custom-made ‘Lady Bug,’ Bugatti has demonstrated the full range of its customization expertise,” said Stephan Winkelmann, President of Bugatti. The car really demonstrates what the marque is capable of in terms of creativity and craftsmanship.”

Creating Lady Bug’s geometric-dynamic algorithmic fading pattern seems easy on paper. Given the Divo’s three-dimensional sculpted body, the 2D digital patterns became distorted upon application to the car’s body, which is not good enough if you’re paying upwards of $5-million for a track-ready version of the Bugatti Chiron.

“The Lady Bug was an exceptional challenge and, at the same time, an unforgettable experience. Due to the nature of the project, where a 2D graphic was applied to a 3D sculpture, we were close to giving up,” said Jörg Grumer, Head of Color & Trim at Bugatti Design. “However, it is our profound conviction that we should never give up and that our foremost motivation should always be to make the impossible possible for the customer.”

The entire project took two years to complete as Bugatti CAD modelers simulated and created a diamond pattern design with around 1,600 individual diamonds in six-meter long transfer films. Each diamond (yes, all 1,600 of them) is checked and realigned in the body to rule out any distortions.

The designers spent countless hours rehearsing the application procedure on two test vehicles before the moment of truth.

“Every maneuver had to be exactly right in this painstaking task; therefore, we decided to do another rehearsal before the final stage of work. Because there could only be one attempt on the customer’s car, and that had to be perfect,” said Dirk Hinze, an expert in customization and surfaces at Bugatti.

The final step is applying the paint finish before painstakingly peeling away each diamond. The base color, Customer Special Red, is contrasted with graphite and clear coat to invert the pattern. According to Bugatti, it took the paintwork artist two weeks to sand, smooth, check, retouch, and re-sand every millimeter of the body surface.

The result is a one-of-a-kind Bugatti Divo Lady Bug, the only one in existence. It has a standard 8.0-liter W16 engine pumping out 1,479 horsepower. Since the Divo weighs less and has more downforce than a regular Chiron, it goes around the Nardo handling circuit a full eight seconds faster than the former.

Continue Reading


Hot Wheels Red Line Club vehicles no longer limited to members



In the year 2021, the Hot Wheels Collectors Club will expand with a digital option for memberships. With said membership, Hot Wheels will release the 2021 Red Line Club ’70 Boss 302 Mustang. This year’s Hot Wheels Red Line Club die-cast car will be the first to be offered without the membership limit, allowing “a more inclusive opportunity for fans 18+ to join the collector community and have access to the highest-quality cars.”

The Hot Wheels Red Line Club vehicles released over the past few years have become relatively sought-after and valuable – so long as they’ve been kept in good condition and are put up for auction and/or direct sale at the right time. In any case, Hot Wheels Red Line Club vehicles are some of the most extravagant collectable items released by Hot Wheels.

Hot Wheels Red Line Club vehicles released in the past were only initially made available to “a limited number of Hot Wheels Collectors members.” Now they’re expanding availability. “For the first time ever, Hot Wheels Collectors will lift its membership limit completely” for hot Wheels Red Line Club die-cast vehicles.

Of course there are still OTHER reasons why a person might want to join the Hot Wheels Collectors Club, like members-only forums, voting privileges, “exclusive content” and “excusive items.” Members also get “priority access to sales.” Take a peek at the Hot Wheels Collectors membership page to see what’s up with perks and the Red Line Club vehicle(s) coming next.

Does this lifting of restrictions on the Red Line Club car line affect you or your outlook on the vehicle line as a whole? Take a peek at the timeline below for more information on other recent Hot Wheels releases and stories from recent weeks on the state of Hot Wheels in our larger-sized world today.

Continue Reading


Lunaz adds classic Bentleys to its lineup of electrified British cars



British electric-conversion specialist Lunaz adds classic Bentleys to its lineup after dabbling with electric versions of vintage Rolls-Royces, Jaguars, and Range Rovers. Lunaz claims its 1962 Bentley S2 Continental Flying Spur is the “definitive Gran Turismo” and is the world’s first electric classic Bentley.

It starts with factory original and coach-built bodies of a Bentley Continental S1, S2, or S3 manufactured from 1955 to 1965, in a coupe and four-door Flying Spur body style. Visually, Lunaz has retained all the classic lines and creases of the original body, hammered and carved to perfection by Mulliner Park Ward. The only visual mod is the paint, custom-chosen by the buyer, of course.

Underneath that gorgeous body, though, is a different story. All the vintage bits and pieces are giving way to modern components. You won’t find a 6.2-liter V8 Bentley engine under the hood, and all the suspension and brake parts are new. Lunaz failed to discuss the powertrain specifics, but we’re assuming the Bentley will carry the same electric drivetrain as the firm’s very own electric Rolls-Royce Phantom V and Silver Cloud.

Powering the electric motors is a 120 kWh battery pack with enough energy to cover 300 miles of range. It also has modest oomph to push the Bentley from zero to 60 mph in under five seconds, not bad for an unassertive vintage British car.

Meanwhile, the interior is as British as a cup of tea. All the leather and walnut trim are there, with each piece carefully hand-restored to match the original. Lunaz also gave its classic Bentley a new retro-style infotainment screen and climate control system. Also, electric power steering is now standard.

After building its first customer car, Lunaz is now accepting orders for its limited run of electrified S1, S2, and S3 Bentley Continental variants. And as expected, the sub-$500k (£350,000) base price is sure to leave a gaping hole in your bank account. Nobody said a vintage electric Bentley would come cheap, right? Also, the build slots are ‘extremely limited,’ so better act quickly.

Lunaz Bentley Continental Gallery

Continue Reading