Doug Madory, the director of Internet analysis at network analytics company Kentik, said that what little information is known about Monday's BGP event suggests that the event was the result of the Russian government attempting to block people inside the country from accessing Twitter. Likely by accident, one ISP made those changes apply to the Internet as a whole.
"There are multiple ways to block traffic to Twitter," Madory explained in an email. "Russian telecoms are on their own to implement the government-directed blocks, and some elect to use BGP to drop traffic to certain IP ranges. Any network that accepted the hijacked route would send their traffic to this range of Twitter IP space into Russia—where it likely was just dropped. It is also possible that they could do a man-in-the-middle and let the traffic continue on to its proper destination, but I don't think that is what happened in this case."
The prevalence of BGP leaking and hijacking and the man-in-the-middle attacks they make possible underscores the crucial role HTTPS and other forms of encrypted connections play in securing the Internet. The protection assures that even if a malicious party takes control of IP addresses belonging to Google, for example, the party won't be able to create a fake Google page that doesn't get flagged for having a valid HTTPS certificate
Madory said that protections known as
Resource Public Key Infrastructure and
Route Origin Authorizations—both of which are designed to protect the integrity of BGP routing tables—prevented most ISPs from following the path advertised by RTCOMM. Instead, the measures asserted that AS13414—the autonomous system belonging to Twitter—was the rightful origin.
That doesn’t mean all ASes ignored the announcement.