{"id":112725,"date":"2024-01-06T15:10:27","date_gmt":"2024-01-06T13:10:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/komprometacziya-uchyotnoj-zapisi-privela-k-sboyu-bgp-marshrutizaczii-orange-espagne"},"modified":"2024-01-06T15:10:27","modified_gmt":"2024-01-06T13:10:28","slug":"komprometacziya-uchyotnoj-zapisi-privela-k-sboyu-bgp-marshrutizaczii-orange-espagne","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/komprometacziya-uchyotnoj-zapisi-privela-k-sboyu-bgp-marshrutizaczii-orange-espagne","title":{"rendered":"Kompromitacja konta doprowadzi\u0142a do awarii routingu BGP Orange Espagne","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompletne przej\u0119cie konta administratora doprowadzi\u0142o do prawie czterogodzinnej przerwy w dzia\u0142aniu drugiego co do wielko\u015bci hiszpa\u0144skiego operatora telekomunikacyjnego Orange Espagne, kt\u00f3ry obs\u0142uguje 11 milion\u00f3w abonent\u00f3w. Do uzyskania dost\u0119pu do interfejsu rejestratora RIPE NCC w Orange Espagne u\u017cyto przewidywalnego has\u0142a \u201eripeadmin\u201d i nie w\u0142\u0105czono uwierzytelniania dwusk\u0142adnikowego. <\/p>\n

Has\u0142o do RIPE zosta\u0142o przechwycone w wyniku ataku z\u0142o\u015bliwego oprogramowania na system jednego z pracownik\u00f3w i od wrze\u015bnia znajdowa\u0142o si\u0119 w sprzeda\u017cy w bazach z has\u0142ami dost\u0119pnymi na czarnym rynku. Co ciekawe, opr\u00f3cz konta Orange Espagne w wymienionych bazach znajduj\u0105 si\u0119 r\u00f3wnie\u017c tysi\u0105ce innych kont do \u0142\u0105czenia si\u0119 z access.ripe.net, kt\u00f3re potencjalnie mog\u0105 by\u0107 wykorzystane do przeprowadzania podobnych atak\u00f3w. <\/p>\n

Incydent pozosta\u0142 niezauwa\u017cony do 2 stycznia, gdy jaki\u015b wandal wszed\u0142 do interfejsu webowego RIPE NCC i wprowadzi\u0142 zmiany w ustawieniach BGP i RPKI (Resource Public Key Infrastructure), co doprowadzi\u0142o do prawie czterogodzinnego zak\u0142\u00f3cenia routingu oko\u0142o po\u0142owy ruchu operatora telekomunikacyjnego. Dzia\u0142ania atakuj\u0105cych spowodowa\u0142y, \u017ce technologia RPKI, maj\u0105ca na celu ochron\u0119 og\u0142osze\u0144 BGP przed fa\u0142szerstwem, zosta\u0142a wykorzystana do blokowania legalnych og\u0142osze\u0144. <\/p>\n

Sprawca utworzy\u0142 kilka nowych wpis\u00f3w RPKI ROA (Route Origin Authorization), w\u015br\u00f3d kt\u00f3rych znalaz\u0142y si\u0119 wpisy wi\u0105\u017c\u0105ce du\u017ce bloki adres\u00f3w Orange Espagne z obcym systemem autonomicznym, co spowodowa\u0142o, \u017ce poprawne og\u0142oszenia BGP z tego operatora zacz\u0119\u0142y by\u0107 blokowane na routerach wielu operator\u00f3w szkieletowych. W rezultacie liczba og\u0142osze\u0144 BGP przypisanych do Orange Espagne spad\u0142a z 9200 do 7400, a ruch zmniejszy\u0142 si\u0119 prawie dwukrotnie.

\"Kompromitacja<\/center> <\/p>\n

RPKI (Resource Public Key Infrastructure) stosuje si\u0119 do autoryzacji og\u0142osze\u0144 BGP i pozwala ustali\u0107, czy og\u0142oszenie BGP pochodzi od w\u0142a\u015bciciela sieci, czy nie. Przy u\u017cyciu RPKI dla system\u00f3w autonomicznych adres\u00f3w IP<\/a> buduje si\u0119 \u0142a\u0144cuch zaufania od IANA do regionalnych rejestrator\u00f3w (RIR), a nast\u0119pnie do dostawc\u00f3w (LIR) i ko\u0144cowych u\u017cytkownik\u00f3w, co pozwala osobom trzecim upewni\u0107 si\u0119, \u017ce operacja z zasobem zosta\u0142a przeprowadzona przez jego w\u0142a\u015bciciela. Bez zastosowania autoryzacji ka\u017cdy operator mo\u017ce og\u0142asza\u0107 podsie\u0107 z fa\u0142szywymi informacjami o d\u0142ugo\u015bci trasy i inicjowa\u0107 tranzyt cz\u0119\u015bci ruchu od innych system\u00f3w, kt\u00f3re nie stosuj\u0105 filtracji og\u0142osze\u0144.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u043f\u043e\u0447\u0442\u0438 \u0447\u0435\u0442\u044b\u0440\u0451\u0445\u0447\u0430\u0441\u043e\u0432\u043e\u043c\u0443 \u0441\u0431\u043e\u044e \u0432 \u0440\u0430\u0431\u043e\u0442\u0435 \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u043f\u043e \u0432\u0435\u043b\u0438\u0447\u0438\u043d\u0435 \u0438\u0441\u043f\u0430\u043d\u0441\u043a\u043e\u0433\u043e \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430 \u0441\u0432\u044f\u0437\u0438 Orange Espagne, \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e 11 \u043c\u043b\u043d \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432. \u0414\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 RIPE NCC \u0432 Orange Espagne \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u043f\u0440\u0435\u0434\u0441\u043a\u0430\u0437\u0443\u0435\u043c\u044b\u0439 \u043f\u0430\u0440\u043e\u043b\u044c «ripeadmin» \u0438 \u043d\u0435 \u0431\u044b\u043b\u0430 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f. \u041f\u0430\u0440\u043e\u043b\u044c \u043a RIPE \u0431\u044b\u043b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0447\u0435\u043d \u0432 \u0445\u043e\u0434\u0435 \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":112726,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112725","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Kompromitacja konta spowodowa\u0142a awari\u0119 routingu BGP w Orange Espagne | ProHoster","description":"Kompromitacja konta administratora spowodowa\u0142a prawie cztero godzinn\u0105 awari\u0119 u drugiego co do wielko\u015bci hiszpa\u0144skiego operatora telekomunikacyjnego Orange Espagne, kt\u00f3ry obs\u0142uguje 11 mln abonent\u00f3w.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/komprometacziya-uchyotnoj-zapisi-privela-k-sboyu-bgp-marshrutizaczii-orange-espagne","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u0441\u0431\u043e\u044e BGP-\u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 Orange Espagne | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u043f\u043e\u0447\u0442\u0438 \u0447\u0435\u0442\u044b\u0440\u0451\u0445\u0447\u0430\u0441\u043e\u0432\u043e\u043c\u0443 \u0441\u0431\u043e\u044e \u0432 \u0440\u0430\u0431\u043e\u0442\u0435 \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u043f\u043e \u0432\u0435\u043b\u0438\u0447\u0438\u043d\u0435 \u0438\u0441\u043f\u0430\u043d\u0441\u043a\u043e\u0433\u043e \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430 \u0441\u0432\u044f\u0437\u0438 Orange Espagne, \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e 11 \u043c\u043b\u043d \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/komprometacziya-uchyotnoj-zapisi-privela-k-sboyu-bgp-marshrutizaczii-orange-espagne","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-06T13:10:28+00:00","article:modified_time":"2024-01-06T13:10:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"112725","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 20:40:12","updated":"2026-02-08 20:40:12","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/112725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=112725"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/112725\/revisions"}],"predecessor-version":[{"id":158009,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/112725\/revisions\/158009"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media\/112726"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=112725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=112725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=112725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}