As we know Google DNS server ( in 14th and 15th March was hijacked in Sao Paulo. And subsequent to this event, BGPmon.org announced an alert.

BGPmon alert

Now, In a course assignment, we are asked to find AS number of the attacker. I for this question have downloaded related dump files from routeviews.org and found this related messages:

TIME: 03/15/14 17:23:56
FROM: AS28571
TO: AS6447
ASPATH: 28571 1251 20080 7908 

TIME: 03/15/14 17:23:56
FROM: AS52888
TO: AS6447
ASPATH: 52888 1251 20080 7908

Our TA would say the attacker's AS was 7908 (BT LATAM Venezuela, S.A). But in my opinion it wasn't, because in my view there is no advantages to be exploited by the attacker if he does redirect traffics to his own AS. Despite of this, I couldn't find any update messages originated by this AS in dump files. In other hand, in the picture above, time of attack has been announced 17:23 and from this time onwards, I couldn't find any interesting messages in dump files.

My question is, can anyone please tell me what's the real AS number of attacker?

Thanks in advance

  • 3
    Why are there no advantages to redirecting to their own AS? Isn't that the whole point? To redirect traffic to a resource controlled by the attacker?
    – schroeder
    Jan 4, 2015 at 7:26
  • 1
    @schroeder Because an attacker would not want to leave any traces of himself. "...a resource controlled by the attacker..." No, all traffics redirected to "BT LATAM Venezuela" and so far no malicious site has been detected. so we cannot say that the intention of attacker was redirecting people to a malicious website (phishing)
    – frogatto
    Jan 4, 2015 at 7:36
  • 1
    If an attacker with BGP access mount an attack on internet infrastructure, it is very unlikely they just want to phish a few sites. But by any definition, they're the attacker of the routing system regardless of their ultimate goals.
    – billc.cn
    Jan 4, 2015 at 11:54
  • 4
    I think our point is that the phrase "the attacker's AS" is inaccurate. The attacker could be anywhere. You could be in Guam and redirect people to Russia. But the goal of the attacker is to route traffic to a specific destination. That destination is what your TA is terming, "the attacker's AS".
    – schroeder
    Jan 4, 2015 at 19:59
  • 3
    For anyone who comes looking at unanswered questions, an examination of the issue (and conclusion that it was probably someone tinkering, because 7908 had other leaks earlier in the day / also for China, because it's using those blocks internally): arstechnica.com/information-technology/2014/03/… Apr 1, 2015 at 20:28

1 Answer 1


The real AS to feed a false route is any AS along the AS path:

7908 --> 20080 --> 1251 --> |28571|
                            |52888| --> 6447

you see in the 2 wrong announces of route to:

Hence all traffic toward shoud be routed since this attack through ASes:

|52888| --> 1251 --> 20080 --> 7908

If the target of this attack is to redirect all the flow toward Google to a booby trapped web server mimicking perfectly Google, then this booby trapped server must be inside of the under control AS which is at the end of this faked route. It is:


which belongs to:

BT LATAM Venezuela, S.A.

And clearly the university of Oregon doesn't have to route its Google traffic through a cache located in Venezuela.

This isn't sufficient to diagnose this is a real attack or rather a human error (leak of an internal route on the allowed ones to broadcast to BGP neighbours). If this is an human error then the origin is most probably within:

AS 7908

But if this is an attack, then this is most probably conducted remotely and you can't locate its first hop of access without the connections logs on BGP router inside AS 7908.

  • This seems more sensible. In case of a remote attack, the connection logs are necessary - one question is; how to legally get access of these logs? Aug 29, 2015 at 5:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .