#SPECTRUM INTERNET OUTAGE UPDATE#
#SPECTRUM INTERNET OUTAGE TV#

Network administrators should lean on 24/7 BGP monitoring tools. Last, but not least, network administrators should take immediate countermeasures against events like this one.

Take Proactive Countermeasures Against BGP Issues However, even that would not have stopped the hijack itself. Indeed, AS10796 was the original owner of the networks and signed most of its routes in RPKI, including 431 networks out of the 449 being hijacked.ĭropping routes found invalid via RPKI checks would have been a solution to mitigate the hijack spread. If any of them were setting up a list of networks that AS10796 was allowed to announce, that would still not have stopped the spreading of the hijack in the wild. However, simple controls are not enough for transit AS. Otherwise, AS 398994 would not have been able to hijack routes belonging to 449 Spectrum networks. We suspect that this level of control was missing at the Spectrum router. Network administrators need to set up automated controls to drop any route announcement related to networks that their customers are not allowed to announce. MANRS ( MANRS – Mutually Agreed Norms for Routing Security) provides a useful set of rules to prevent the spreading of events like this one. Apply Bulletproof Security To RoutersĪ BGP hijack may not be the case with Spectrum, but in any case, it is worth mentioning that unrecognized sources absolutely must not be able to set up a BGP session on their own and announce networks at will. !( 3.png) Lessons for Network AdministratorsĮither way, there are a few lessons network administrators can obtain from what happened. In the past, we have seen similar scenarios where this has been the case.

This could then lead to a hijacking of the routes to create an outage on purpose. Alternately, similar scenarios can happen if someone exploits a security vulnerability inside of the carrier and finds a way to open a BGP session with one of their routers. The outage might have been caused by an experiment at Spectrum.

#SPECTRUM INTERNET OUTAGE UPDATE#

This can be seen from the BGP Update activity widget provided by RIPE Stat. Only a few routes were announced via Spectrum AS itself (AS10796) and Tata communications (AS6453), one of Spectrum’s providers.Īnother oddity is that KHS was not announcing any networks before or after the hijack.

KHS announced the Spectrum networks via Spectrum AS itself (AS10796), and the Spectrum backbone (AS7843) propagated them in the wild. One of the peculiarities of this hijack is that it started in the belly of the attacked AS. !( 1.png) So… Was It Dr. BGP Hijack Or Mr. BGP Mistake? This started the outage. Routes were seen by most of the RIS peers up to 18:11 UTC, when KHS stopped announcing any routes. To better understand what happened, let’s investigate data collected by rrc10, the RIS route collector deployed by RIPE NCC (RIPE Network Coordination Centre) at the Milan Internet Exchange (MIX), in Italy. Looking at the closest RIB snapshot available, we can see that Spectrum (AS10796) was announcing 690 networks, most of which routed via its backbone (AS7843).įrom the update files provided by rrc10 collector between 16:30 and 18:30 UTC, we can further see that KHS USA (AS398994) started to originate 449 of the 690 networks previously originated by Spectrum. If the hijack was accidental, it can lead to a denial of services. If it was deliberate, at its worst, another AS could attempt to steal sensitive information. Spectrum was vague about the type of issue they were having that was causing the outage. Our investigation shows it may have involved a BGP route hijack. A BGP route hijack happens when an autonomous system (AS) claims to be the origin for a network that has been assigned to another AS. !( 2.png)Įverything was resolved at around 18:11 UTC, and services were restored to users.

#SPECTRUM INTERNET OUTAGE TV#

Users of their broadband and TV services hit social media to voice their annoyance at the disruption it was causing. September 7, 2021, 16:36 UTC: an outage hit Spectrum cable customers in the Midwest of the U.S., including Ohio, Wisconsin and Kentucky.

Spectrum internet outage