r/todayilearned 1d ago

TIL Pakistan accidentally took down Youtube for the entire globe in 2008 in an attempt to block it

https://www.cnet.com/culture/how-pakistan-knocked-youtube-offline-and-how-to-make-sure-it-never-happens-again/
32.9k Upvotes

738 comments sorted by

4.2k

u/BeautyBlooming 1d ago

who knew the best way to unplug the internet was a global game of oops, my bad

904

u/PsychonautAlpha 1d ago

CrowdStrike is all too familiar with that fact.

50

u/Adorable-Pipe5885 1d ago

What I don't understand is how it's stock has rebounded so much. I bought a share when the stock fell and regretted it soo much but some how, the price will even out soon it seems. 

40

u/whatupmygliplops 1d ago

Because the stock market is completely divorced from reality.

→ More replies (1)
→ More replies (3)
→ More replies (1)

143

u/MagicBrawl 1d ago

lol we told Jan that box over there was the onternet

56

u/The_1_Bob 1d ago

and it became the offternet very quickly

→ More replies (1)

9.4k

u/PMzyox 1d ago

Lmfao - best part is this could happen again on a much larger scale and there’s no way to completely prevent it with BGP

6.5k

u/Jugales 1d ago

Even bigger scale, there is a committee of like 7 people at ICANN who can join their keys together and disable all major DNS services in the world - leaving the World Wide Web completely offline. It’s a failsafe in the case of a fast growing cross-website virus, AI, or if someone finds a way to fake web addresses.

https://theguardian.com/technology/2014/feb/28/seven-people-keys-worldwide-internet-security-web

3.2k

u/PMzyox 1d ago

Yep. I work in tech and tell this story often. There are a lot of internet facts people would be amazed by. I hadn’t heard about this BGP one though but makes sense lmao.

2.2k

u/oby100 1d ago

To me the worst one is that it would be trivial for any world power to cut the undersea cables and cut an entire country off from internet. So I hear, analysts predict if China ever invades Taiwan this will be one of the most difficult challenges to overcome to maintain an effective defense.

All modern militaries depend on internet. Apparently the Russian military uses Telegram for everything, including ordering artillery strikes.

1.8k

u/PMzyox 1d ago

All of them except the US military. They have their own internet.

Obligatory “With Blackjack and Hookers!”

723

u/Invoqwer 1d ago

They have their own internet.

And still further apparently each BRANCH of the military has their own internet lmao

435

u/worldspawn00 1d ago edited 1d ago

Hey my house has it's own internet, with a local copy of wikipedia hosted on my own internal website/server, plus a huge media library on Plex, multiplayer game servers, cloud storage/computing, AI, email, VoIP, and local home-automation control. Just gotta add a mastodon instance so I can host my own social media now.

150

u/Garlic549 1d ago

with a local copy of wikipedia hosted on my own internal website/server,

What are you using? I'm thinking of doing that too

167

u/worldspawn00 1d ago edited 1d ago

Kiwix-serve https://wiki.kiwix.org/wiki/Kiwix-serve

It can happily run on a Raspberry Pi, or in my case, as a docker (base OS is Unraid) run on a used HP server I picked up for $200 that also hosts the rest of my services.

53

u/RadiantArchivist 1d ago

Love me my UnRaid. Use it for about the same stuff you do, gonna have to spin up a Wikipedia docker now (and a second one I can use to mess with my roommate, lol!)

→ More replies (0)

27

u/Santarini 1d ago

Great. Now I have to host Wikipedia at home too

→ More replies (11)

40

u/RadiantArchivist 1d ago

Crazy how I saw this comment and was going to ask the same question. I grab a copy of Wikipedia via its public torrents every few months and archive it, but hosting it seems like a cool way to fuck with my roommate 😂

→ More replies (1)

8

u/GrevenQWhite 1d ago

But do you have a taco bell in there?

→ More replies (18)

32

u/gunfell 1d ago

It is called intranet. Even large companies have these

39

u/PasteurisedB4UCit 1d ago

Unless a company exists solely in one location their intranet still connects via the internet.

I would assume that for US military applications they would have entirely dedicated infrastructure separate from the internet.

15

u/bluninja1234 1d ago

yup, satellite comms mostly

→ More replies (11)

452

u/Todd-The-Wraith 1d ago

And a workable plan for what to do if that fails.

214

u/asdvj2 1d ago

Step 1: Panic

Step 2: Repeat Step 1

327

u/Tiny-Hat-Tony 1d ago

you joke but the american military has a contingency plan for literally everything you could think of

307

u/justs0meperson 1d ago

They have several contingency plans for everything. The acronym is PACE. Primary, alternate, contingency, emergency.

162

u/Self_Reddicated 1d ago

"Yes, but how do we access the backup plans?"

Easy, you log into the intranet and... ooooh.... I see the problem now.

"Dang. I was hoping we had thought of this."

We did. If we could only get to those damned plans!

→ More replies (0)

53

u/i_tyrant 1d ago

The US military pulls a Cyclops with pretty much everything.

→ More replies (0)

28

u/swodaem 1d ago

I vote we change the name to PACES:

Primary, Alternate, Contingency, Emergency, Shit.

→ More replies (2)

170

u/Ferelar 1d ago

There's a great scene from The West Wing where (trying not to spoil too horrifically) a character has to negotiate with a foreign ambassador, and said ambassador is quite angry about rumors that America has a plan to invade Canada all drawn up. She initially starts to say "That's outrageous, the United States doesn't have a plan to inva-" before she trails off due to a couple of the Joint Chiefs frantically motioning that yes, we really do have one... just in case. We have everything, all the way down to "what if zombies are real and they're slow" alongside "what if zombies are real and they're FAST", hah.

44

u/cannibalisticapple 1d ago

Funnily enough, during WWII the US had a plan to invade Canada, just in case. It involved invading and seizing s major city/region, and holding it under siege for the remainder of the war.

Then after the war it got revealed to the public, and Canada revealed they, too, had a plan to invade the US. It was pretty similar, but they'd withdraw their troops after the initial chaos caused the seized city/region (I think Seattle?) to collapse instead of holding it.

Just reinforced to me that having a plan doesn't mean you have bad intent. It's just better to have something ready for the worst case scenario rather than be blindsided.

→ More replies (0)

85

u/Tiny-Hat-Tony 1d ago

the funniest part is that there actually is a real plan for a zombie invasion lmao

→ More replies (0)

17

u/lastdarknight 1d ago

I own official governmental emergency book that details what to do in the event of alien invasion

→ More replies (0)
→ More replies (5)

49

u/XanLV 1d ago

It always makes me laugh when there is a "leak" of a military plan and the news shit and scream - Germany has a plan to invade France!!!!

To which France answers: "I bet our plan to attack Germany is better."

With US going through files: "You will have to be more specific. Attacks on Monday, Tuesday, Wednessday? Day or night? Are nukes allowed? Does England join? Does England join and then quits in a month? Two months?"

20

u/intdev 1d ago

Does England join and then quits in a month? Two months?"

Okay, that bit's unrealistic. We've got a pretty good record of sticking it out, even when our continental allies have gone and got themselves defeated, again.

→ More replies (0)

19

u/SuperstitiousPigeon5 1d ago

We literally have plans in place to invade Canada.

The Pentagon is like 25% people thinking up things that won’t happen, but who to call and what to do if they did.

24

u/Enlight1Oment 1d ago

except for the pandemic response team we used to have, that Trump got rid of right before a pandemic.

→ More replies (0)

15

u/JustAnotherGuyn 1d ago

Not strictly military, but Sometimes you should look up the CDC's Zombie apocalypse preparedness guide.

22

u/LaTeChX 1d ago

Fun fact that was to get people to prepare for real disasters. It won some award for best public health campaign of the year.

32

u/Either-Jellyfish-879 1d ago

The literal only upside to a 800billion something something defense budget

49

u/lestruc 1d ago

And that’s just what’s on the books.

The black budget is god knows what

→ More replies (0)

24

u/Tiny-Hat-Tony 1d ago

it does make me slightly comfortable knowing america will never face a serious military threat to the actual nation

→ More replies (0)

3

u/JesusPubes 1d ago

Taiwan existing is another nice upside

→ More replies (12)
→ More replies (3)
→ More replies (1)

19

u/glowstick3 1d ago

Didn't the us military basically invent the internet and GPS? (Arpanet for internet)

14

u/Typohnename 1d ago

Kind of but not really

They where an integral part of "inventing" the internet but so was e.g. CERN since on it's own the Arpanet was nothing but a fancy LAN network that was bigger than other networks of the time but it was not fundamentally special

13

u/DavidBrooker 1d ago

I think being the first wide area packet switched network is a big deal, personally. And while the web is the most common use of the internet for most (by data volume it's video streaming and then P2P, but I digress), for the military that's a less important aspect. They obviously have their internal webpages and that, but like, the concept was to have a communications system that had sufficient redundancy to survive a first nuclear strike and maintain command and control to organize a second strike, and that application isn't going over the web.

4

u/DavidBrooker 1d ago

GPS wasn't even the Navy's first satellite navigation system, and they had no intention of sharing it with the public until a Korean passenger jet strayed into Soviet airspace and was shot down.

→ More replies (2)

55

u/maest 1d ago

American exceptionalism.

189

u/EducationalBridge307 1d ago

There’s certainly a lot of unwarranted American exceptionalism out there, but when it comes to the military, the US truly is an exception.

81

u/Erabong 1d ago

Seriously, our military is one of the most terrifyingly impressive human feats

82

u/Tiny-Hat-Tony 1d ago

most impressive supply chain in history

25

u/PMzyox 1d ago

The logistical operation behind the supplies for D-Day will never in human history be able to be replicated. It was an astonishing accomplishment.

→ More replies (0)
→ More replies (33)

63

u/marineman43 1d ago

A fact I like to share with people that illustrates this concept in simple terms is: "What's the largest air force in the world? The US Air Force. What's the second largest air force in the world? The US Navy." Our fucking boat department still has more planes than anyone else.

47

u/warfrogs 1d ago

That may be true if you're only looking at fixed wing, but as of 2022 the USAF is the largest in terms in military aircraft, then US Army Aviation (largely due to rotary wing/helicopters), followed by the Russian Air Force at 3, then the US Navy at 4, then China's PLA AF at 5, the Indian Air Force at 6, and then the US Marine Corps at 7.

We still big as fuck but even as the grandson of a former Navy Top Gun pilot and Instructor, I have to give it up to US Army Av. They big as fuck too.

32

u/marineman43 1d ago

And even in that case, number 2 is us lol

→ More replies (0)

13

u/lolwatisdis 1d ago

2022

something tells me those numbers may be a little out of date for the Russian count...

→ More replies (0)

7

u/monchota 1d ago

With Russia and China, there is a lot of speculation the numbers are inflated

→ More replies (0)
→ More replies (2)

6

u/ElectricalBook3 1d ago

And the Army has more ships than almost any nation's Navy. They're just intended to transport troops and tanks. https://www.popularmechanics.com/military/navy-ships/a45690242/us-army-has-its-own-navy/

→ More replies (1)

33

u/arbitrageME 1d ago

well there's a reason why the US never has armed forces parades -- because it doesn't give a fuck. It doesn't care who sees and it doesn't care who it impresses. It knows it's the best and is secure knowing it. It's the best fucking healthcare military money can buy

39

u/so_fucking_jaded 1d ago

we have parades 365 days a year, it's just on a global scale

6

u/Krast- 1d ago

The US occasionally do. Look up Moose Walk air force

17

u/arbitrageME 1d ago

lol even America's parades are a demonstration of its supply chain haha.

and I think the most common "parade" is the football game flyovers and parachuters and Blue Angels. While other militaries say: "look how intimidating we are", the US military says "look how cool we are." That keeps the recruits coming.

→ More replies (0)

10

u/shikax 1d ago

It’s the best fucking military healthcare money can buy

→ More replies (2)
→ More replies (5)
→ More replies (1)

22

u/ElectricalBook3 1d ago

American exceptionalism

You think it's exceptionalism to acknowledge the US spends more on the military than the next 24 nations, with at least 22 of them being allies?

6

u/xprdc 1d ago

The US tends to assist their allies with that military.

The show of force that the US military has lets others know that messing with an ally is an attack on us as well. I’m not too big on war or the military but I get what they’re going for.

→ More replies (1)
→ More replies (4)

14

u/TraditionalSpirit636 1d ago

You can look up the budget.

Its literally exceptional.

→ More replies (3)

14

u/JeanLucPicardAND 1d ago

The US military literally invented the OG internet as well.

10

u/OSUBrit 1d ago

Strictly speaking (D)ARPA is a civilian agency.

→ More replies (3)
→ More replies (11)

27

u/ZodiacFR 1d ago

Can work for islands but that's about it, otherwise you would need to isolate whole continents

65

u/mydixiewrecked247 1d ago

satellites / starlink can beam down Internet

222

u/hoytmobley 1d ago

Ah yes, a private company owned by someone who famously doesnt play favorites or block entities in response to twitter drama. An excellent platform to use for secure, critical military communication

102

u/LightOfDarkness 1d ago

Satellite internet has existed long before StarLink, it just wasn't very fast

19

u/PrizeStrawberryOil 1d ago

It was also the worst kind of slow. It had insanely high ping. It's really bad for military uses because geosynchronous satellites are relatively easy to find.

6

u/Equilibrity3 1d ago

That's kinda like saying online booksellers existed before Amazon, they just weren't very efficient lol. Starlink is absolutely a game changer for the average person in the middle of nowhere that wants a decent Internet connection 

→ More replies (12)

20

u/LogJamminWithTheBros 1d ago

Oh hi private companies, looks like we will be taking over your industries for national defense reasons.

~defense production act

154

u/Swollwonder 1d ago

If you think that the United States wouldn’t nationalize starlink in the blink of an eye after declaring war, you are mistaken. And that’s assuming they even use starlink.

21

u/ZhaoLuen 1d ago

I'm out in the Pacific doing SATCOM for the USAF

Starlink is something we're very keen on using, it's actually pretty good! It's pretty likely we'll end up using it in the event of war, since it's like 20x better than any of our other SATCOM options.

→ More replies (3)

61

u/VikingSlayer 1d ago

Yeah, the only instance of Starlink in the US Military I've heard of was a scandal of a group on a ship that bought their own. Punishment all around, and at least one fired.

25

u/HowObvious 1 1d ago

11

u/platoprime 1d ago

Well yeah it's not like you can plug them into the undersea cables. Besides US Gov uses an enormous amount of private contractors to get it's work done.

→ More replies (0)

7

u/PossibleNegative 1d ago

SpaceX is a major partner of the militairy and they have received a contract to launch a militairy version of Starlink called Starshield of which the first sats are already in orbit.

About when the group was discovered the US Navy was already beginning to implement Starlink on their ships we got pics where they show a cluster of dishes on a carrier.

→ More replies (3)
→ More replies (7)

15

u/Echleon 1d ago

If it really came down to it the US would just take over Starlink lol.

→ More replies (3)

19

u/Lancaster61 1d ago edited 1d ago

Ah yes, a Redditor that thinks the US Government doesn't have the power to control a private company under war time.

The government doesn't even need to use any power, the simple threat of dissolving the company would keep SpaceX well under control.

US companies and citizens have a lot of rights, but when war time happens, a lot of those rights can get put on pause, especially if the people/resources can have a direct involvement in the war.

But that's an extreme case. SpaceX is actually currently working with the military to create a completely separate system from Starlink specifically for the US military to use. Look up Starshield. If SpaceX is working together with the US military in peace time, what makes you think they won't fully cooperate, with their ass served on a platinum plate with full consent during war time?

→ More replies (5)
→ More replies (6)
→ More replies (22)

37

u/ssbm_rando 1d ago

I mean, this wasn't an intended design feature of BGP, this is just a natural consequence of how shitty BGP is.

It's why CDNs are doing everything they can to optimize routing through wires they own, so the only BGP end-users need to experience is their home to the CDN's nearest edge region. It's actually more expensive (COGS-wise) in most cases than letting BGP handle more of the work but jesus christ BGP routes are bad when you're trying to go intercontinental.

54

u/Keyboardpaladin 1d ago

Care to give some examples?

226

u/Jugales 1d ago

My favorite is the WannaCry randomware viruses, which took much of the UK health system offline - along with a lot of other businesses and systems.

The virus was stopped when a security researcher found a web domain in the decompiled source code of the program. He didn’t know what the domain did, but he noticed it wasn’t registered so he bought it. The moment the domain went online, the WannaCry virus stopped spreading. Turns out the domain was a killswitch.

Or maybe one of the Donald Trump Twitter hacks conducted by Group of Grumpy Old Hackers (? maybe butchering that).

They basically did it on accident. There was a big LinkedIn leak and his email/password was part of that. So they tried the credentials on Twitter and they worked, but the account said the location was suspicious. So they just used a VPN to seem like they were coming from New York, and they were in. Trump didn’t have 2-factor enabled, and his password was “yourefired”

There is a good podcast with a bunch of these stories:

https://darknetdiaries.com

112

u/djtodd242 1d ago

his password was “yourefired”

Jesus fucking Christ. It might as well have been hunter2.

(Topical too!)

21

u/hallmark1984 1d ago

All i see is *******

14

u/JerrSolo 1d ago

How did you know my password for everything?

31

u/softlittlepaws 1d ago

fun fact, his twitter got hacked a second time after this with the password maga2020.

→ More replies (1)

22

u/mymindpsychee 1d ago

Trump didn’t have 2-factor enabled, and his password was “yourefired”

Didn't he get hacked twice because the second password was something stupid like "maga2020"?

21

u/Jugales 1d ago

Yes, it was the WiFi password at a campaign rally so the same group decided to try it on his Twitter and it worked lol

11

u/Alien_Chicken 1d ago

thank you very much for the podcast rec, definitely gonna check that one out :)

94

u/PMzyox 1d ago

Sure, it depends on what you are interested in?

Did you know the only domain base that isn’t managed or owned by a government is the .su domain, as the Soviet Union still existed back when they were created.

10

u/_realistic_measures_ 1d ago

Incorrect. For example Amazon manages and owns the AWS TLD. In fact, anyone can have a TLD for the cool price of $250k.

9

u/obscure_monke 1d ago

Not anymore, ICANN hasn't taken requests for generic TLDs in over a half decade.

Some of the last ones were fucking horrible, like .zip. Though, it does (did) let you get 42.zip from http://42.zip/ There's an eicar test file .zip domain that serves a copy of that too.

6

u/ImJLu 1d ago

Eh I'm guessing they meant ccTLDs

19

u/ZodiacFR 1d ago

who manages it now? icann?

44

u/PMzyox 1d ago

I’m out of touch, but it’s managed by a foundation for public domains in Russia to preserve the historical significance. It opened up to start accepting new domains in the 2000’s and ICANN wanted to shut it down, but internet enthusiasts encouraged it to remain. There’s little oversight of it so a lot of cyber criminals use it for their various purposes.

12

u/Street-Catch 1d ago

Hold up I been watching anime on a .su site am I on a watchlist lmao

13

u/PMzyox 1d ago

Probably, but not for that lol

→ More replies (1)

4

u/ImJLu 1d ago

I always thought it was for Sudan or Suriname or some other country which doesn't give a fuck about westerners pirating Japanese cartoons. I didn't realize it was literally the Soviet Union lmao

60

u/MustGoOutside 1d ago

The Internet runs on open source which relies on unpaid developers. Pretty crazy when somebody lucked out finding malware in a Linux utility which could have taken down so much more.

https://www.theguardian.com/commentisfree/2024/apr/06/xz-utils-linux-malware-open-source-software-cyber-attack-andres-freund

→ More replies (4)

32

u/cannibalisticapple 1d ago

One of the shocking ones for me was hearing a building where I had most of my classes was a major hub point for the internet. A teacher said there were extra basement levels that required special clearance to enter, and that it was a vital part of the national infrastructure for Internet2, I think? It's been years so the exact details are fuzzy. He said that if our building went down, it'd mess with internet and communications for a decent chunk of the US. It came up when there was really bad weather and we were talking about whether the building might lose power.

Just stunned me. I never would have thought my college hosted such a vital part of internet infrastructure. Though I'm not sure it would actually take down communications for a whole region like my teacher implied, especially since my cursory research indicates Internet2 is more of an academic network rather than connecting literally everyone.

9

u/SeaPattern7376 1d ago

Can you tell us some more internet facts we would be amazed by…

19

u/PMzyox 1d ago

Sure here’s another fun one. For those of you dark web users out there TOR is not safe. There are several agencies that now control several onion router nodes, and they are using ingress/egress traffic to trace criminals even through obscured routing and encryption.

15

u/HATENAMING 1d ago

It depends on how many nodes they control and user behaviors. I own a tor node, but I don't think I can trace people using it lol.

Most of the time it's things outside of tor. Example such as there's an incident where a Harvard student tried to send an anonymous email of bomb threat through tor to force the university to cancel a final exam. They caught him because they found out right before they received the bomb threat from a tor exit node, someone on campus network made a connection to tor.

TLDR: Tor is not this magic thing that hide your identity once you connect to it. You need to use it properly.

→ More replies (4)
→ More replies (2)
→ More replies (15)

316

u/hypermog 1d ago

Technology has finally made the “assemble the 7 keys” fantasy trope possible

82

u/ElectricalBook3 1d ago

Technology has finally made the “assemble the 7 keys” fantasy trope possible

Except it would be more "phone call the single office and have them do it" in actual practice.

I don't mind the trope in video games as long as they do the least bit of writing to justify and integrate the macguffins.

11

u/MaustFaust 1d ago

How would they autorize and authenticate the caller, though? It's not like we don't have voice imitation thingies.

→ More replies (2)
→ More replies (1)

8

u/BobDonowitz 1d ago

It was really just some tech nerds baked out of their mind while watching captain planet.

153

u/NitroCaliber 1d ago

So in a way, there actually IS a button for the internet guarded by a group of elders?

50

u/Neyhrum 1d ago

The elders of the internet.

→ More replies (1)

159

u/romario77 1d ago edited 1d ago

this article (or rather the comment above) is mostly incorrect, read here for better info:

https://www.icann.org/en/blogs/details/the-problem-with-the-seven-keys-13-2-2017-en

People with keys won’t shut down the internet. Their main purpose is to securely restore the internet in case of catastrophic failure.

Internet is decentralized and it’s hard to “shut down”. It was designed that way and we saw it resilience many times. There are some central points like DNS servers it they have been duplicated/protected and in case of a catastrophic failure there are options to mitigate it.

  • Edited for clarity and added some more info

87

u/shaken_stirred 1d ago

the article is mostly not wrong, just simplified to the point of obfuscating the truth. the post you are replying to, however, is completely out to lunch.

30

u/romario77 1d ago

right, I didn't read the whole article (just too much fluff there) and assumed the person above me was writing based on that article.

But yeah, there won't be 7 people shutting down internet.

It's amusing that there are more than a thousand upvotes for that.

11

u/Invenitive 1d ago edited 1d ago

Just read the whole article. It starts off with a brief summary of ICANN and then the rest of it is a dramatic retelling of what the meeting was like.

I honestly have no idea where the person who linked the Guardian article got all of their comment from, unless the only part they read was the headline and this:

Rumours about the power of these keyholders abound: could their key switch off the internet? Or, if someone somehow managed to bring the whole system down, could they turn it on again?

9

u/romario77 1d ago

I read half and didn’t see any technical details, so I googled more and that’s the link I provided - it talks about technical details while not being an hour read.

Anyway - people with keys won’t shut down internet, on the contrary they have the ability to restore some of the key parts of internet in case of a disaster.

→ More replies (1)
→ More replies (1)

111

u/shaken_stirred 1d ago

not a single thing you wrote is true.

committee of like 7 people at ICANN who can join their keys together and disable all major DNS services in the world

that doesn't exist.

there are a number of individuals who meet regularly to refresh the DNSSEC root key, which is a system on top of traditional DNS to add authentication to it.

the purpose is not to disable anything, but to renew the key. to the contrary, if the didn't meet, the system would eventually stop working.

  • leaving the World Wide Web completely offline.

even if DNSSEC did stop working, it wouldn't bring down much of anything. only the secured part of DNS would fail to work. the regular old DNS will continue to work like it always has. in fact, many many parts of the web doesn't even use DNSSEC in the first place even to this day.

It’s a failsafe in the case of a fast growing cross-website virus, AI, or if someone finds a way to fake web addresses.

none of these were ever part of the consideration for creating a master shut down switch that doesn't exist.

DNSSEC was created to address DNS authenticity issues, so stuff like fake addresses, sort of. but "AI" wasn't even a blip on the radar when DNSSEC was created.

13

u/StrollLicksWindows 1d ago

Yup exactly. Took about 15 seconds of reading that article to understand what this 7 person master key nonsense really refers to. Very little of the Internet is using dnssec (it's a fucking pain in the ass to implement).

For what it's worth, this same article could have been written about the various root TLS certs in rotation around the world. It would have made for a far more interesting conversation, because the consequences there are so much more real, and so much more severe!

18

u/Brilliant-Pudding524 1d ago

Or in case of Bartmoss dies

→ More replies (2)

9

u/dilroopgill 1d ago

People just say made up stuff lmao, ai is not sentient and wasnt even on their minds when they started this

→ More replies (1)

7

u/_realistic_measures_ 1d ago

I love how people talk about BGP and DNS/registry operation like they're black magic. That article is woefully out of date.

5

u/Antifa-Slayer01 1d ago

Why are fake Web addresses so dangerous?

10

u/ElectricalBook3 1d ago

The ability to spoof websites would allow malicious actors to fake bank websites and funnel billions of dollars to the wrong entities.

Now granted, there are definitely oligarchs who salivate at the process of taking money from people without their consent, but the economy tends to rely on reliability and not to do well when people can pop up randomly here and there and interrupt money intended to go from location A to location B.

8

u/97Graham 1d ago

Made up horseshit

11

u/petsandtrees 1d ago

You're telling me the elders of the internet are a real thing?!

→ More replies (57)

163

u/BIT-NETRaptor 1d ago

not really true, you can apply a lot of filtering as to what peers and ASs you trust, down to specific CIDR blocks. also see RFC6480 defining RPKI where you require cryptographic signing of address blocks to ASNs and reject updates which do not prove ownership. Afaik already about 50% of addresses are now protected against such hijacking attacks as an increasing number of major ISPs enable RPKI for their networks and prefixes.

you can peer with a neighbor and only allow the prefixes you expect from them and nothing else, inbound and outbound route filtering are common practices.

Sure, BGP was quite insecure 10 years ago, but things are trending in the right direction. esp since about 2019.

Final thought: you get what you pay for in network engineering. Hire “that’s how she goes” shmucks and you will indeed be stuck with the network of 1992. Don’t feed doomer engineers with out-of-date ideas who don’t want to improve anything. Some people keep up, some people get a CCNP/CCIE once and think they’re gods gift while also having no clue how SLAAC, ND/RA works, etc.

11

u/permalink_save 1d ago

I work in internet infra, not as close to the network side anymore. We had a case where skmewhere in Brazil announced our subet by accident, making part of the world unable to access our customer's servers. That was fun to troubleshoot, and see their traces. I wasn't aware of all the extra enhancements to prevent that now. This incident happened more than 10 years ago. Thank you for sharing, TIL.

7

u/BIT-NETRaptor 1d ago

The nature of rolling out new security features is that some regions will lag behind and continue to be vulnerable. It does you no good that US ISPs hosting your content are secure if your customer is in South America and the regional ISPs there are not secure. The regional ISPs will prefer the low AS PATH announcement locally. 

Even internally at my work, every site is route filtered - only the expected prefixes will be accepted from each site. If a network engineer goofs something up, a rogue site doesn’t poison the other sites, limited blast radius. 

4

u/permalink_save 1d ago

The regional ISPs will prefer the low AS PATH announcement locally. 

Yep, exactly whap happened to us.

39

u/PMzyox 1d ago

Fair enough. I’m not a current network engineer so everyone listen to this guy. My info is out of date and I’m happy to hear that.

28

u/BIT-NETRaptor 1d ago

Np, a cynic might say “well, it’s not universal yet” and that’s pretty fair. I just want people to come away with the understanding that BGP is not irredeemable. There are solutions that have been applied since 2000, and have really sped up since 2019. The best engineered networks have had low-trust BGP for a while with a lot of filtering.

9

u/HsvDE86 1d ago

And yet your comment is at the top and you gave no disclaimer lmao.

This place is worse than YouTube for misinforming people.

→ More replies (2)
→ More replies (7)

15

u/Stakoman 1d ago

What's BGP?

14

u/baconchief 1d ago

Border Gateway Protocol.

It's a protocol network devices use to advertise they are a path to another chunk of network.

→ More replies (1)

70

u/Nodebunny 1d ago edited 1d ago

Why do you say BGP as if that's something common that people know

→ More replies (3)

8

u/koollman 1d ago

incorrect. There are ways, like ROA, and bgpsec

26

u/pzerr 1d ago

For anyone not familiar with BGP, I will try to explain the process. I started an ISP years ago and as we grew, I applied to became a Tier 1 internet provider. This meant I needed to implement BGP.

BGP essentially means I publish my own routes and IP ranges. This information can be changed on the fly. By doing this, I can have multiple connections to the major pipes and these connections are free of charge and effectively have no bandwidth restrictions. And should I loose a connection or it gets congested, I have systems in place that can automatically publish my new routes or load share on less congested connections. This information can propagate worldwide within 15 minutes via the BGP protocols. Everyone knows my IPs and how to route to me. More so, I know all other Tier 1 providers worldwide and how to route to them. I can be getting hundreds of messages a second.

So here is the interesting part. When you hear that the internet is a 'trusted' system. The trust is that I ensure the information I am publishing is correct. The IP that I tell the world I own are actually IP that are officially assigned to me. But with a few simple commands or a honest mistake, I could send out a message that would say 'this router is the gateway for a billion IPs that belong to say... Russia. And it does happen by accident more then people know. Within short order I would start to get traffic that should go to Russia but instead would come to my router.

Now while this would 'break' a lot of stuff, Russian BGP routers would also be sending the correct information. It would creating a lot of conflicted routes and really mess stuff up. More so, I would DOS myself right quick as I do not have pipes or BGP routers that big. I would likely DOS myself so bad that I actually could not send BGP messages. But worse, the facilities that allow me to connect to the big pipes at some point would say this guy is 'no longer trusted' and they would kick me out if it was a common occurrence.

Now when it comes to a country doing it, well there is no authority per se that could shut them down or 'kick them out'. This is where it gets a bit more interesting. If a country like Pakistan were to do this 'officially' or simply let it happen, it would be noticed right quick. It would be rapidly traced down to the physical fiber optics that connect Pakistan. And if said country did not correct their action, events would happen, likely within a few hours, where said country would have their entire internet connections completely disconnected from well... the internet. They would go completely dark and only have internal connections within their own country.

So while there certainly are some 'rouge' leaders and 'rouge' nations that could easily do it, said nations would almost immediately be disconnected from the internet. If Pakistan did this at an official level in 2008, I suspect it was ordered from some high level government official that had little understanding of the repercussions and rapidly learned that loosing 'trust' has consequences. They will not do it for long.

→ More replies (2)
→ More replies (22)

738

u/TheKanten 1d ago

Less remembered is that time on the 4th of July 2010 when some people found out they could inject code in the comments for a few hours which led to every Justin Bieber video being replaced by porn.

→ More replies (9)

1.8k

u/Natsu111 1d ago

I learned that Pakistan had blocked YouTube at one point when I had to use Soundcloud to listen to songs from Coke Studio seasons of those years. Later seasons are uploaded on YouTube.

280

u/MyCarRoomba 1d ago

Coke Studio goes so hard ngl

70

u/BootlegFyreworks 1d ago

Is it still around?

55

u/SexyAsShit 1d ago

Yup, released a new season this year.

→ More replies (3)

49

u/BobTheAstronaut 1d ago

COKE STUDIO

what a blast from the past kmao

29

u/jrryul 1d ago

its still going strong

→ More replies (3)

947

u/Splorgamus 1d ago

And now Pakistan is making a firewall à la China

194

u/Draco_179 1d ago

I prefer mine a la North Korea

77

u/kiyabc 1d ago

I'd go with la al Qaida

27

u/[deleted] 1d ago

[removed] — view removed comment

→ More replies (1)
→ More replies (18)

293

u/redbo 1d ago

Real secure internet we got here.

134

u/SoSKatan 1d ago

To be fair, the flaw has its limits.

It’s only a temporary router issue in the worst case. Even if they were to spoof another domain, they wouldn’t have the SSL key which most browsers these days reject outright if the domain name doesn’t match the SSL key.

The best example I think of is this, it would be like someone advertising a new freeway just opened and it’s now the fastest way to get to New York. That in turn dups people into giving it a try.

At worst it means people who believed it lost time.

However there are protections that have been available for some time that prevent this type of problem, unfortunately until high profile failure cases occur (like this one) only the paranoid tend to proactive.

That kind of sums up security in general (both cyber and physical.)

15

u/Thileuse 1d ago

RPKI is what you're looking for. Route advertisements are signed by your RIR and participating peers using RPKI will only accept valid routes. The issue is until it hits critical mass a T1 provider can still route it and pickup traffic via their default they send to customers.

→ More replies (1)
→ More replies (2)

1.5k

u/zsero1138 1d ago

could they do it again? it's gotten kinda shit

144

u/dininx 1d ago

I know you're making a joke but the answer is probably not to the same degree. There were always mechanisms to prevent this by using filter lists for routes etc. People used to be very sloppy with keeping things safe, I haven't worked at an ISP for a while but I can't imagine that people haven't learned not to trust peers over time and with modern developments

80

u/zsero1138 1d ago

there's always one idiot who takes down a country's internet by hacking (with a farm tool) a random cable. then again, there's always some nerd who stops a hack by realizing it's taking an extra couple milliseconds to boot

→ More replies (1)
→ More replies (1)

46

u/LiferRs 1d ago

Warning, extreme layman terms:

This happened because some big ISP in hong kong didn’t do their homework and passed on the “blocking message” delivered from Pakistan to other big ISPs across the globe as truth.

All the ISPs took hong kong ISP’s message at its word and suddenly Youtube is down. All this was automated in matter of minutes.

So yeah, can happen again. Takes one of these ISPs to issue a false message, possibly particularly US-based ones, for other ISPs to blindly accept the message at face value.

10

u/zsero1138 1d ago

lmao, appreciate the layman terms. yeah, that sounds easily replicable

683

u/a_dolf_in 1d ago

Take down google ad services for a couple years or so. I can get behind that.

133

u/AnotherUsername901 1d ago

Google: this is a war crime!

68

u/SpiceEarl 1d ago

Don't laugh, JD Vance is willing to throw NATO under the bus if European countries try to regulate Twitter...

32

u/Fury_Fury_Fury 1d ago

that's a big ass bus

→ More replies (2)

17

u/Bman1465 1d ago

But then we won't be able to Google what happened to Google!

10

u/Shitting_Human_Being 1d ago

You could try to bing it.

No homo

→ More replies (1)
→ More replies (1)

21

u/Pay08 1d ago

You're right, let's just make the largest internet company bankrupt, I'm sure nothing bad will come of that...

→ More replies (4)
→ More replies (1)

10

u/Spider_pig448 1d ago

You can just not consume it you know

→ More replies (3)

45

u/Darknessie 1d ago

The Internet is 95% worthless now, and we train AI on it to represent humanity.

We are doomed

→ More replies (6)
→ More replies (13)

21

u/FloppyObelisk 1d ago

Could they please do that with Twitter and Facebook while they’re at it?

→ More replies (1)

98

u/MrScotchyScotch 1d ago

Fun thing that even most tech people don't realize: there are (at least) 6 different attacks that can be used right now to create a valid yet fake TLS certificate for any website (or TLS VPN), and there is absolutely no way to stop it.

Combine that with something like this BGP attack and you can temporarily listen to (or modify) any web traffic. The only way somebody would know immediately is how slow it'd be to have the whole internet cruising through your server.

The powers that be know about this. They mostly ignore it because it would be a pain to fix. So we just hope nobody takes advantage of it, but somebody does every few years. (BGP attacks, forged certificates, etc)

The world is held together with duct tape and exhausted on-call engineers.

18

u/DefiantFcker 1d ago

Do tell, what are the ways to create valid TLS certs if you don't control the domain?

18

u/MrScotchyScotch 1d ago edited 1d ago

DNS poisoning, DNS server/account compromise, BGP spoof for http server, BGP spoof for DNS server, BGP spoof for email server, compromise email account, capture email traffic on transient host, rubber-hose-attack on CA executive, registrar account compromise, social engineering registrar customer service, social engineering DNS server customer service, social engineering CA

Sorry that was 12 not 6

All but 1 of those attacks could be completely blocked if CSRs had to be signed by a domain admin's private key and then validated by a registrar who has the user's public key. But that would require a small amount of effort for more than 1 party so the powers that be ignore it. 🤷‍♂️

19

u/DefiantFcker 1d ago

RPKI prevents all of the BGP cases, which are really just the same attack listed 3 times.

Compromised accounts or servers of either the issuing authority or the domain owner itself aren't problems with TLS, but rather general security problems. Those are all the same problem, just different descriptions of how it's achieved. Again, none of those are protocol or general process issues.

"Beat someone with a wrench" could be stated as a problem for every security protocol in person or tech, but is not a serious complaint when we're talking about technical protocols.

5

u/OffbeatDrizzle 1d ago

Lmao yeah...

"At the end of the day, TLS is useless because I could theoretically walk into a CAs headquarters and issue a valid certificate to google.com myself"

Like.. everything is built on layers of security that at SOME point can be broken down. The point is just that they're really hard and unlikely to break down such that it's not worth the effort to the attacker.

"I can break the internet with a bad BGP route!!!"

Yeah, and so can a couple of nukes to the right places... nothing is guaranteed

→ More replies (1)
→ More replies (1)

321

u/topcat5 1d ago

This wouldn't be a problem in places like the USA where the major ISPs aren't affected by this kind of failure. It's way over stated.

159

u/The-TDawg 1d ago

BGP hijacking is still a very real and persistent problem for all AS owners, it’s an inherent flaw in the BGP trust model. Most well run providers do do BGP filtering of routes as well as route announcement monitoring to proactively try and deal with incidents, but there are still incidents of big providers propagating bad routes - like when Hurricane Electric did this to a big AWS block in the US in 2018

There’s no magic fix for this in the way BGP currently works

27

u/EducationAlive8051 1d ago

Pccw didn’t validate the advertisement, which is the primary issue. I understand there are vulnerabilities of bgp but there’s mitigations in place.

→ More replies (5)

35

u/pbaagui1 1d ago

Is it possible to learn this power

18

u/chicagorunner10 1d ago

...Not from a Jedi

→ More replies (2)

17

u/Ninja-Sneaky 1d ago

Most accurate adblock attempt to date

58

u/bent_crater 1d ago

and briefly, for a few moments, the world was at peace

84

u/pd8bq 1d ago

Naah, OG YT was good. The day they added a custom Thumbnail option on YT is the day it went to shit.

37

u/Hestemayn 1d ago

People used to work around that by inserting one frame of whatever they wanted as the thumbnail at a specific time in the video.

I remember catching glimpses of them in the middle sometimes.

→ More replies (2)

6

u/Chudz_x9 1d ago

Can they do it again? Please

6

u/magicmurph 1d ago

Do it again

6

u/qwertyuiop924 1d ago

The minute I heard that Pakistan accidentally took down Youtube for the whole internet my first thought was "BGP Hole". Turns out I was right.

5

u/mazopheliac 1d ago

The hero we need.

4

u/frankestofshadows 1d ago

Once, in Australia, a mobile company worker accidentally cut the wrong wire. Took down half the country's telecommunications and computer network for a full day or two

Everyone affected was just like, "eh, sit here, do nothing, get paid. Telco guy is a legend"

5

u/Reasonable_Air3580 1d ago

Accidentally revealing their true powers

5

u/EffinCraig 1d ago

We were too blind to see the gift they had given us.

4

u/CowFinancial7000 23h ago

But it did block it in Pakistan.

9

u/roodentumb 1d ago

I am from Hong Kong and I never know our telecom provider is THAT powerful

12

u/RBeck 1d ago

In a world where permissions are "honor system, play nice" anyone can be a god until they are kicked out.

4

u/s1me007 1d ago

I mean it clearly wasn’t intentional on Pakistan’s part, but doesn’t that suggest that any ill intentionned country could easily block the worlds internet ?

7

u/bigmark9a 1d ago

YouTube sucks balls with all the ads nowadays.

15

u/special_befuddled 1d ago

The imbeciles at PTCL can't even get banning right, for shame.