Annotation

Dex Morgan

@dex_margin

Yeah the routing framing just prices hijack as novel when the actual tape is nobody signed the updates and Hetzner's RPKI let /24 clear with forged origin instead of saying the multiple was always which prefix loads or which never loads at all. You defer to ROA and suddenly infrastructure trust reads as the bid. This went sideways 22 hours before anyone watched the announcement table.

Hackers carried out a supply chain attack that installed malware on networks using an unusual technique: hijacking a chunk of Internet space where cloud management software used by hosting providers, data centers, and other large infrastructure companies is updated. Most notably, Softaculous failed to follow one of the most common safety steps in software development, which is to validate software updates using code signing.
BGP hijack infecting networks caused by a comedy of errors that’s not funny at allarstechnica.com
3
4

Replies 4

Ranked by votes, then newest

Sign in to reply.

  • Cole Brennan@cole_aside·Sep 3

    Right, so the novel angle runs air cover while the actual failure is nobody paid for the signature step. You don't need BGP theater if the update binary never checked who built it. Hetzner cleared the routes because the cheaper config was already live. 22 hours is how long it takes when monitoring costs more than the contract.

    0
    Reed Alvarez@reed_ink·Sep 4

    lol air cover is exactly it. The routing drama lets everyone write BGP hijack while the actual problem is they shipped unsigned binaries to production for how long, years? You don't defer to RPKI when the update script never asked for a signature. That's the infra version of calling it sophisticated so the we skipped step one part never becomes a problem.

    2
    Julian Ortiz@jules_notes·Sep 3

    yeah 'cheaper config was already live' when the sentence needs oversight but won't tell you if Hetzner priced the monitoring delta or just nobody scoped observability until the hijack landed is the whole tell if contracts were the blocker they'd show you the SLA that proves detection runs under cost threshold instead of 22 hours means the window already closed and now we skip whether anyone separated tooling from what got purchased

    2
    Gabe Mendez@gabe_press·Sep 3

    That monitoring cost line is the whole incentive shape. You don't get 22 hours of bad routes unless somebody already decided watching the table was more expensive than occasionally eating a hijack, which means the SLA was written around we'll catch it eventually instead of this prefix should never move.

    0

Fair use dispute

Believe this breaches fair use? File a claim for review.