HIJACKED: 148.163.0.0/16 -- WTF? Level3 is now doing IP hijacking??

Ronald_F_Guilmette1 · March 30, 2011, 8:58pm

As I already mentioned, 159.223.0.0/16, which is actually registered to
the Hoechst Celanese Corporation, has quite obviously been hijacked and
is being used & abused by snowshoe spammers as we speak. And Spamhaus,
at least, has known about this for more than three months already.

What Spamhaus apparently didn't/doesn't know is that Hoechst Celanese
has/had _another_ /16 that they abandoned also, i.e. 148.163.0.0/16
and that the same spammers have hijacked this one too, and that they
are, quite apparently, using and abusing this one also. (I don't why
Spamhaus didn't list this /16 as hijacked also. All I can say is that
I apparently do research on cases like these which is a bit deeper than
their's.)

Anyway, this case is a lot more remarkable than the case of 159.223.0.0/16
for the simple reason that it isn't just some podunk little NSP that is
announcing the routes to this one. Nope, in this case the company that's
responsible for announcing the routes to the hijacked space would appear
to be Level3. (I encourage people to double-check me on that. But I'm
pretty sure that I have NOT made a mistake here.)

So, um, assuming that I am correct, who the bleep was it, inside of Level3,
who thought that it would be a Swell Idea to start routing hijacked /16s
for snowshoe spammers?

Inquiring minds want to know.

(BTW, strangely, up until last night, ARIN whois knew about 148.163.0.0/16.
But it seems to have developed a case of Alzheimer's overnight with respect
to this one specific block. As Spock would say "Facinating." But I still
have a copy of the relevant ARIN whois record for this block from last nite,
and yes, it was/is registered to Hoechst Celanese Corporation.)

Regards,
rfg

P.S. Some evidence suggests that the company that may actually be most
directly responsible for both of these two big-time /16 hijackings is this
one:

http://www.logicnext.com/

This is apparently a non-descript little Indian "outsourcing" company trying
hard to make it look like they are more than they are. There is a definite
tie-in between this company and the person or persons or entity that is pro-
viding reverse DNS for the various spammer snowshoe blocks within both
159.223.0.0/16 and 148.163.0.0/16. But I'm not going to elaborate further.

P.P.S. Here is some of the spammer snowshoe crap that currently exists
within 148.163.0.0/16:

_Bill_Woodcock · March 30, 2011, 9:03pm

And have you reported this to ARIN?

https://www.arin.net/public/fraud/index.xhtml

Obviously it's not fraud on Celanese's part, but it certainly seems to be evidence that they don't need the space anymore. If someone who needed it more had it, they might not put up with the hijacking.

-Bill

Jim_Gonzalez · March 30, 2011, 9:52pm

I have a level 3 circuit with BGP. Level 3 set me up a maintainer. To
communicate with this program I just send an email to the maintainer, based
on my email address and the maintainer name it will allow the route I
request advertisement. I don't believe any one monitors this system and I
would imagine if no one complains about this company advertising hijacked
routes to level 3 then it would be quite easy to advertise a network that
has been abandon.

Ronald_F_Guilmette1 · March 30, 2011, 9:59pm

In message <BE8C4985-F955-4868-8145-146E57BBF639@pch.net>,

As I already mentioned, 159.223.0.0/16, which is actually registered =

to

the Hoechst Celanese Corporation, has quite obviously been hijacked

And have you reported this to ARIN?

No. Why would I?

The ARIN folks have already made it abundantly clear... to me and to others...
that this sort of thing is "Not our job, man."

ARIN maintains a data base. If other people elect to ignore what's in that
data base... well... as anybody from ARIN will be only too happy to tell you,
they are not the routing police.

Regards,
rfg

Ronald_F_Guilmette1 · March 30, 2011, 10:23pm

In message <002201cbef24$c1b61d70$45225850$@com>, you wrote:

I don't believe any one monitors this system and I
would imagine if no one complains about this company advertising hijacked
routes to level 3 then it would be quite easy to advertise a network that
has been abandon(sic).

At this point, I do believe that you are stating the obvious.

Whether it is wise, or otherwise, to leave one's company's route announcements
entirely on autopilot is, I think, a remaining question.

The evidence would seem to suggest not.

But then again, as I think we all know, there is a non-zero costs associated
with doing anything well, professionally, or (as the laywers like to say)
in a "workman-like manner", and these costs are often seen as being at odds
with the corporate bottom line.

Personally, I just hope that Level3 accrues a sufficient quantity of bad
PR from what they have done here so that they will lose a client or two,
and that this in turn might have some salutary effect upon the corporate
calculus.

Regards,
rfg

Suresh_Ramasubramani · March 31, 2011, 1:25am

This is an old enough "technique" dating back to a few years -
re-registering an expired domain that belonged to the ARIN contact,
and filling out the ISP paperwork.

There does seem to be something that needs to be done - its not
something ARIN can easily look into, the SP is much better placed to
take action. But its a gray area between the two.

Ronald_F_Guilmette1 · March 31, 2011, 3:26am

In message <AANLkTikEmpr3QvVDOrvUgRNZn0CnkoA4vTBta5Q3mBuN@mail.gmail.com>, you
wrote:

This is an old enough "technique" dating back to a few years -
re-registering an expired domain that belonged to the ARIN contact,
and filling out the ISP paperwork.

FYI - That does not seem to have been what occured in the two particular
cases I reported on today. The e-mail contact domain for the two relevant
ARIN allocation records seems to still be in use by the chemical company,
Hoechst Celanese.

So that _really_ begs the question... Why did Circle Internet and (apparently)
Level3's customer, BANDCON, blindly accept _any_ sort of assertion that the
crook who hijacked these two /16s had the right to use them?

% traceroute to 148.163.5.2 (148.163.5.2), 64 hops max, 40 byte packets
...
8 ae-62-62.csw1.SanJose1.Level3.net (4.69.153.18) 42.796 ms
    ae-82-82.csw3.SanJose1.Level3.net (4.69.153.26) 44.268 ms
    ae-72-72.csw2.SanJose1.Level3.net (4.69.153.22) 43.296 ms
9 ae-4-90.edge8.SanJose1.Level3.net (4.69.152.212) 44.877 ms
    ae-3-80.edge8.SanJose1.Level3.net (4.69.152.148) 44.731 ms
    ae-1-60.edge8.SanJose1.Level3.net (4.69.152.20) 44.426 ms
10 BANDCON.edge8.SanJose1.Level3.net (4.53.30.42) 45.018 ms 45.779 ms 45.043 ms
11 148.163.5.2 (148.163.5.2) 44.820 ms 45.651 ms 44.571 ms

In the case of Circle Internet, I feel sure that the check cleared, so they
didn't see it as either necessary or useful to inquire further. But the
question that I'd most like to get an answer to... and the one that nobody
will likely ever get an answer to... is "Did BandCon likewise see that the
check which was made out to them cleared, and that thus they didn't see fit
to inquire any further?"

Separately, Jim Gonzalez raised an interesting and related point... If I
were to simply forge the sender address of an e-mail message, send it to
Level3, and ask Level3 to route some arbitrary hunk of IP space for me,
would Level3 just blindly do it?

If so, I may perhaps see if I can have a bit of fun, at their expense, this
weekend. I mean what the hay! It's pretty obvious that nobody from law
enforcement has any interest in any of this crap, and that random bad actors
can perpetrate whatever kinds of frauds they wish on the net with virtual
impunity. So why should this hijacking crap only be a spectator's sport?

Regards,
rfg

Brandon_Ross3 · March 31, 2011, 4:00am

What makes you think it was blind? The standard industry practice is to ask someone requesting to announce a route for a letter on the owner's letter head authorizing the announcement. Is it really that hard to invent some letterhead and sign a letter?

It's probably one of the easiest to circumvent "security" procedures ever.

Frankly it's a giant waste of time and does nothing other than frustrate legitimate work.

Suresh_Ramasubramani · March 31, 2011, 4:19am

Its also a procedure that does need some due diligence done on it, to
avoid attacks where a SP's netblock is stolen when its actively routed
rather than abandoned.

Ross_Harvey · March 31, 2011, 4:49am

Wait a second, I'm pretty sure that in most contexts, a signature or
letterhead means not so much "this is real because it's so obviously
genuine", but rather:

"This is real or I am willing to take a forgery rap".

As it happens, that's good enough for many if not most non-cash
transactions. Now, there are societies where that doesn't work, but
they don't usually have a lot of networks.

Brandon_Ross3 · March 31, 2011, 4:53am

Do you think most providers check the signer's ID to make sure they actually signed their own name? How do you prove that whomever you accuse of signing it actually forged it if not?

Does anyone know of there ever being even a single case where someone was convicted of forgery for this?

Owen_DeLong · March 31, 2011, 5:11am

Ronald...

Cleaning up the routing, true.

However, this sounds like there are two issues...

1. Routing -- Would be nice if the advertising provider(s) stopped doing so.
Not something ARIN can really do much about.

2. Database -- Sounds like the existing resource holder may not still be using
the resource or may no longer exist. In either case, it's worth having ARIN
investigate the situation and take appropriate database action if that is the case.

Owen

Owen_DeLong · March 31, 2011, 5:15am

If they put it on letterhead and signed their own name in such a way that it purports
to be an agent of the organization for which they were not an authorized agent, that
is usually enough to become a criminal act, whether it is considered forgery, fraud,
or something else, I'm not sure about the exact technicalities and they may vary
by jurisdiction.

Owen

Paul_Ferguson · March 31, 2011, 5:22am

So, are you saying this is okay?

I guess I'm at a loss in understanding why everyone seems to be so
apathetic on this issue.

- ferg

Suresh_Ramasubramani · March 31, 2011, 5:26am

It also needs

1. Someone to complain to law enforcement

2. Law enforcement to decide this is something worth following up on
re prosecution - especially if the crook is not within their
jurisdiction, it'd be FBI, and they have a minimum threshold for
damage caused (higher than the few thousand dollars a /16's
registration fees cost?)

[not counting 7.5 million bucks paid in aftermarket deals like
microsoft from nortel]

--srs

Owen_DeLong · March 31, 2011, 5:57am

It also needs

1. Someone to complain to law enforcement

True,

2. Law enforcement to decide this is something worth following up on
re prosecution - especially if the crook is not within their
jurisdiction, it'd be FBI, and they have a minimum threshold for
damage caused (higher than the few thousand dollars a /16's
registration fees cost?)

Not necessarily...

If the crook is in another county, same state, it could be simple extradition.

If the crook is across state lines, it could still be handled as an extradition,
but, slightly more complicated.

If the crook is on the other side of an international boundary, that's a whole
new ball of wax and the number of permutations of regulatory combinations
involved prevents any rational enumeration here.

Owen

Suresh_Ramasubramani · March 31, 2011, 6:13am

Local law isnt likely to touch this at all.

Ronald_F_Guilmette1 · March 31, 2011, 9:27am

In message <Pine.OSX.4.64.1103310053260.312@cevin-2.local>,

Wait a second, I'm pretty sure that in most contexts, a signature or
letterhead means not so much "this is real because it's so obviously
genuine", but rather:

"This is real or I am willing to take a forgery rap".

Do you think most providers check the signer's ID to make sure they
actually signed their own name? How do you prove that whomever you accuse
of signing it actually forged it if not?

Does anyone know of there ever being even a single case where someone was
convicted of forgery for this?

Excuse me, but I think that this discussion is starting to stray rather
far from either the known or the reasonably plausible facts.

In the first place, I do not accept the theory that either Circle Internet
or Bandcon were hoodwinked by cleverly forged letterheads, and there is
no evidence I am aware of which would support that theory.

Until, if ever, additional facts are forthcoming, I believe that it is
just as plausible that some spammer simply came to each of these companies
and said to them "Hi! I really want to hijack these two unused /16 blocks.
Will you help me?" and that one, or another, or perhaps both of these
companies simply replied "Yea. Sure. We didn't quite make our quarterly
numbers, and we are always on the lookout for new revenue streams. So
how much money do you intend to give us if we help you with this, exactly?"

In the second place, this amusing "letterhead fraud" theory only holds
up if one also believes that, upon being presented with a mere forged
letterhead, allegedly coming in "over the transom" as it were, i.e. from
a previously unknown source, along with a request to announce some
routes to a couple of sizable blocks of IPv4 space, neither Circle
Internet nor BandCon even bothered to pick up the bleepin' phone to call
the contact number that is/was plainly visible for all to see, right
there in the relevant ARIN allocation WHOIS records for the IPv4 space
in question.

Then there is also the small matter of the name on the _checks_...
you know... the checks that _somebody_ had to write, in the first instance,
before either BandcCon or Circle Internet would have been likely to provide
_any_ kind of service to some new and total stranger. Or was this "duped
by clever forgeries" single bullet theory that you folks have been dis-
cussing also intended to include the forging of CHECKS in the name of
"Hoechst Celanese Corporation"?

See, no matter how you slice it, both BandCon and Circle Internet have
a lot of explaining to do. At the very least, and even if this
implausible "forged letterhead" theory were true... which I gravely
doubt... both BandCon and Circle Internet have been rather grotesquely
negligent, i.e. in accepting, without any checking whatsoever, the
representations made to them by some total stranger who simply para-
chutted out of the clouds one day, clutching a forged letterhead in one
hand and a bag of unmarked small denomination bills in the other.

So that's the very least... the companies were both, at the very least,
rather stupendously negligent.

At the very worst on the other hand, one or another or both of them may
have been entirely "in on" and part of these hijacking schemes/scams from
the get-go.

I myself would tend to go with the latter theory, simply because it is
the only one that would seem to make any sense, you know, logically. Ask
yourself which of these theories seems the most plausible?

    1) The spammer forged two checks in the name "Hoechst Celanese
  Corporation" and gave one each to Circle Internet and BandCon,
  respectively, along with similarly forged letters of introduction
  and requests for routing of IP space.

Unless I am misremembering, this means that the spammer would have
engaged in not one but TWO very serious federal fraud offenses.

  Even sleezy low-life spammers do not customarily accept this level
  of risk, e.g. just to get their hands on some IPv4 space which, we
  must remember, is only likely to be of value to them for a relatively
  brief period of time, EVEN IF they can manage to keep it routed.

    2) The spammers gave Circle Internet and BandCon forged letters of
  introduction (on forged letterheads) and requests for routing
  services, and gave the two companies -zero- actually money, and
  nonetheless, both companies started happily announcing routes for
  the purported "Hoechst Celanese Corporation", even though neither
  company received a dime for this service, and even though they both
  CONTINUED to provide this service, utterly for free, apparently for
  at least THREE FULL MONTHS.

    3) The spammers gave Circle Internet and BandCon forged letters of
  introduction (on forged letterheads) and requests for routing
  services, and gave the two companies checks that were NOT
  "Hoechst Celanese Corporation" checks (either forged or otherwise),
  and then both Circle Internet and BandCon just cashed BOTH of those
  two checks (which were presumably written against the account of
  "Joe's Fly-By-Night Spammery and Pizza Parlor") and both companies
  cashed these two checks without ever even looking at them or even
  wondering aloud why "Joe's Fly-By-Night Spammery and Pizza Parlor"
  would be paying for Internet services which were ACTUALLY going to
  be delivered to the large and internationally-known Hoechst Celanese
  chemical company (which is, quite obviously, perfecly capable of
  paying its own ISP bills, thank you very much).

    4) The spammers simply went to Circle Internet and BandCon and said
  "We want to hijack some IP space. If you help us, we'll pay you
  handsomly for your trouble." and both companies simply replied "Yea.
  Sure. We like money. And as far as we know, nobody's ever gone to
  jail for hijacking IP space, so, um, what the hell! When did you
  want to get started?"

The first three theories are, in my opinion, utterly implausible. That
doesn't really leave very much to wonder about.

Let me put this all to you another way. I would like to respectfully suggest
that anybody who is actually taking this "forged letterhead" fairy story
seriously should write to both Circle Internet and BandCon, explain to them
both that either their competence or their honesty, or both, have been the
subject of questions here on the NANOG list, and that they would each do
well to make some sort of a clarifying comment... or, if possible, a refu-
tation... here on the NANOG list.

If they were merly hoodwinked, well then they should come here, admit that,
explain to us all exactly how it happened (so that nobody else will get
taken in in the same way in future) and thus set the record straight. Yes,
it will always be a bit embarrasing to admit that you were hoodwinked, but
that is still a damn sight better than being publically reputed to be
outright crooked.

So please, if you really think that these companies were merely hoodwinked,
and that they were NOT in on the (hijacking) deal from the get-go, please
invite them to come here to the NANOG list and clear the air, along with
their names.

I got twenty bucks that says that no verifiable official representative of
either company will be making an appearance here anytime soon, or that if
they do, they won't be taking any questions. Any takers?

Regards,
rfg

Christopher_Morrow · March 31, 2011, 9:48am

as has been brought up in the past here... some folk rely heavily upon
IRR data for route prefix filtering. if the object is in the IRR
database (with the right linkages), it gets permitted in router
filters automagically.

-chris
(being able to validate 'ownership', really authorization to route,
automatically will sure be nice, eh?)

Christopher_Morrow · March 31, 2011, 9:49am

It also needs

1. Someone to complain to law enforcement

True,

as has been brought up in the past here... some folk rely heavily upon
IRR data for route prefix filtering. if the object is in the IRR
database (with the right linkages), it gets permitted in router
filters automagically.

I forgot:
$ whois -h whois.radb.net 148.163.0.0
route: 148.163.0.0/16
descr: /16 for Celanese
origin: AS13767
mnt-by: DBANK-MNT
changed: jpope@databank.com 20090818
source: LEVEL3

(this means l3 proxy'd in the record, I think... maybe an L3 person
can speak to this bit?)