<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7652.24">
<TITLE>Re: YouTube IP Hijacking</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2><Jake Blues mode><BR>
<BR>
I hate Cyber Jihads!<BR>
<BR>
</Jake Blues mode><BR>
<BR>
----- Original Message -----<BR>
From: owner-nanog@merit.edu <owner-nanog@merit.edu><BR>
To: Neil Fenemor <neil.fenemor@fx.net.nz><BR>
Cc: Will Hargrave <will@harg.net>; nanog@merit.edu <nanog@merit.edu><BR>
Sent: Sun Feb 24 16:06:50 2008<BR>
Subject: RE: YouTube IP Hijacking<BR>
<BR>
<BR>
Clearly, they are incensed by youtube content, so what makes anyone<BR>
think that they would not be trying to engage in a case of Cyber-Jihad?<BR>
<BR>
I hosted the site that was rated #1 on Google for the Jyllands Posten<BR>
(di2.nu) cartoons when it was a current issue, and I STILL get lots of<BR>
script kiddie DOS from the Islamic world.<BR>
<BR>
I generally don't assume malice when mere incompetence will suffice, but<BR>
in the case of the Islamic world, they've proved themselves malicious<BR>
towards the non-Islamic world often, and violently, enough, that I don't<BR>
believe they deserve that presumption of innocence any more.<BR>
<BR>
In either case, the correct COA is to filter all advertisements with AS<BR>
17557 in the path, until they fix the routes they are advertising, and<BR>
let us know how they plan on making sure this doesn't happen again.<BR>
<BR>
<BR>
> -----Original Message-----<BR>
> From: Neil Fenemor [<A HREF="mailto:neil.fenemor@fx.net.nz">mailto:neil.fenemor@fx.net.nz</A>]<BR>
> Sent: Sunday, February 24, 2008 1:01 PM<BR>
> To: Tomas L. Byrnes<BR>
> Cc: Will Hargrave; nanog@merit.edu<BR>
> Subject: Re: YouTube IP Hijacking<BR>
><BR>
> While they are deliberately blocking Youtube nationally, I<BR>
> suspect the wider issue has no malice, and is a case of<BR>
> poorly constructed/ implemented outbound policies on their<BR>
> part, and poorly constructed/ implemented inbound polices on<BR>
> their upstreams part.<BR>
><BR>
> On 25/02/2008, at 9:49 AM, Tomas L. Byrnes wrote:<BR>
><BR>
> ><BR>
> > Pakistan is deliberately blocking Youtube.<BR>
> ><BR>
> > <A HREF="http://politics.slashdot.org/article.pl?sid=08/02/24/1628213">http://politics.slashdot.org/article.pl?sid=08/02/24/1628213</A><BR>
> ><BR>
> > Maybe we should all block Pakistan.<BR>
> ><BR>
> ><BR>
> ><BR>
> >> -----Original Message-----<BR>
> >> From: owner-nanog@merit.edu [<A HREF="mailto:owner-nanog@merit.edu">mailto:owner-nanog@merit.edu</A>]<BR>
> On Behalf<BR>
> >> Of Will Hargrave<BR>
> >> Sent: Sunday, February 24, 2008 12:39 PM<BR>
> >> To: nanog@nanog.org<BR>
> >> Subject: Re: YouTube IP Hijacking<BR>
> >><BR>
> >><BR>
> >> Sargun Dhillon wrote:<BR>
> >><BR>
> >>> So, it seems that youtube's ip block has been hijacked by a more<BR>
> >>> specific prefix being advertised. This is a case of IP<BR>
> >> hijacking, not<BR>
> >>> case of DNS poisoning, youtube engineers doing something<BR>
> >> stupid, etc.<BR>
> >>> For people that don't know. The router will try to get the most<BR>
> >>> specific prefix. This is by design, not by accident.<BR>
> >><BR>
> >> You are making the assumption of malice when the more<BR>
> likely cause is<BR>
> >> one of accident on the part of probably stressed NOC staff<BR>
> at 17557.<BR>
> >><BR>
> >> They probably have that /24 going to a gateway walled garden box<BR>
> >> which replies with a site saying 'we have banned this',<BR>
> and that /24<BR>
> >> route is leaking outside of their AS via PCCW due to dodgy<BR>
> >> filters/communities.<BR>
> >><BR>
> >> Will<BR>
> >><BR>
><BR>
> Neil Fenemor<BR>
> FX Networks<BR>
><BR>
><BR>
><BR>
</FONT>
</P>
</BODY>
</HTML>