{"id":112727,"date":"2024-01-06T21:10:22","date_gmt":"2024-01-06T19:10:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/orange-espana-vzlomali-iz-za-togo-chto-parol-u-polzovatelya-admin-uchetnoj-zapisi-ripe-ncc-byl-ripeadmin"},"modified":"2024-01-06T21:10:22","modified_gmt":"2024-01-06T19:10:22","slug":"orange-espana-vzlomali-iz-za-togo-chto-parol-u-polzovatelya-admin-uchetnoj-zapisi-ripe-ncc-byl-ripeadmin","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/orange-espana-vzlomali-iz-za-togo-chto-parol-u-polzovatelya-admin-uchetnoj-zapisi-ripe-ncc-byl-ripeadmin","title":{"rendered":"Orange Espa\u00f1a was hacked because the password for the admin account of RIPE NCC was ripeadmin.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Orange Espa\u00f1a, the second largest mobile operator in Spain, faced a major outage on Wednesday after an unknown party gained access to the account managing the global routing table using a \"ridiculously weak\" password. Starting at 9:28 UTC, an entity using the nickname Snow logged into the Orange account at RIPE NCC with the password ripeadmin. RIPE NCC is responsible for managing and distributing IP addresses and serves 75 countries across Europe, the Middle East, and Central Asia.<\/p>\n
Snow initially added new ROAs (Route Origin Authorizations) to the global routing table, which did not cause any outages at first. However, later Snow added ROAs with \"fake sources,\" leading to a significant reduction in valid Orange routes, which in turn caused a service outage. The problem was exacerbated by the use of the RPKI (Resource Public Key Infrastructure) system, designed to prevent unauthorized route hijacking, which effectively rendered the Orange network nonfunctional.<\/p>\n
The company Hudson Rock discovered credentials for sale in online marketplaces, obtained through malware installed on Orange's computers since September. Researchers also noted thousands of other credentials securing RIPE accounts available in such marketplaces.<\/p>\n
This incident highlights the fragility of the BGP system and reveals serious security issues within Orange. The use of a weak password and the absence of multi-factor authentication, combined with malware installed on an employee\u2019s computer that went unnoticed for four months, are serious oversights that should never have occurred in an organization of Orange\u2019s size. Researchers hope that this incident serves as a wake-up call for other service providers and prompts them to strengthen their security measures.<\/p>\n