AS4788 Telecom Malaysia major route leak?

Fri Jun 12 11:24:44 UTC 2015

> These aren't just leaks - they're more specifics of what's normally 
> advertised, but keeping the proper origin. Hard to see how that could be 
> accidental...

Having looked further - the examples of these I was looking at
(advertisements from AS34556 & AS17709) were being advertised before the
leak, but only with limited visibility. The leak caused them to be
(intermittently) globally visible.

Tin foil hat off - can all just be accidental.

Chris

> On Fri, 12 Jun 2015, Stephane Bortzmeyer wrote:
>
>> On Fri, Jun 12, 2015 at 11:09:34AM +0200,
>> Tore Anderson <tore at fud.no> wrote
>> a message of 10 lines which said:
>> 
>>> I see tons of bogus routes show up with AS4788 in the path, and at
>>> least AS3549 is acceping them.
>>> 
>>> E.g. for the RIPE NCC (193.0.0.0/21):
>>>
>>>                     [BGP/170] 00:20:29, MED 1000, localpref 150
>>>                       AS path: 3549 4788 12859 3333 I, validation-state: 
>>> valid
>> 
>> Unlike most BGP leaks, they kept the proper origin, so validation by ROA 
>> was
>> useless :-(
>> 
>