After Orange Disruption, Brace for More BGP Route Hijacking

All organizations that use RIPE or another regional internet registry to manage their Border Gate Protocol routing should brace themselves for a potential wave of copycat hijacking attacks, unless they have strong security controls in place.

See Also: 57 Tips to Secure Your Organization

That warning, issued by cybersecurity expert Kevin Beaumont, comes on the heels of a Wednesday attack on Spanish telecommunications giant Orange España in which about half of its customers’ internet traffic was disrupted.

Orange’s attacker appeared to have obtained and used a valid password for the telco’s administrator account with RIPE, for which two-factor authentication wasn’t enabled. Security experts report that the source of the password appears to have been information-stealing malware called Raccoon.

After gaining access to the account, the attacker used RIPE’s hosted RPKI resource certification service to broadcast a valid, cryptographically signed route origin authorization to direct traffic to an autonomous system number not controlled by Orange, resulting in the traffic never reaching its intended destination.

Early Wednesday morning, Spanish time, an X – formerly known as Twitter – user with the handle Ms_Snow_OwO – claimed credit for the attack in a post addressed to Orange:

Meow meow meow! I have fixed your RIPE admin account security. Message me to get the new credentials :^)

Shortly thereafter, Orange España told customers via Spanish-language posts to X: “We have suffered an incident that is currently affecting internet browsing for some of our customers.”

The telecommunications giant subsequently told ISMG in a statement: “The Orange account in the IP network coordination center (RIPE) has suffered an improper access that has affected the browsing of some of our customers.” The company said it had immediately responded and resolved the problem later Wednesday and that “appropriate measures have been taken to prevent such an incident from happening again.”

Cloudflare Radar reported that the disruption had affected about 50% of all Orange España traffic for three hours on Wednesday. It said the disruption had been “likely due to a newly issued RPKI ROA that does not match the routing advertisement policies of Orange Spain, causing most RPKI validating networks to not route to them.”

Border Gateway Protocol acts as a phone book for the internet by distributing routing information to all routers so they can connect users and systems with different IP addresses.

While BGP hijacking attacks can sometimes be used to intercept internet-borne data, Orange said this incident did not result in any customer data being compromised and that “only the browsing of some services has been affected.” On Wednesday, RIPE confirmed the unauthorized access to at least one of its customer’s registry accounts and said it is investigating.

“We have restored access to the legitimate account holder and are working closely with them to ensure the integrity of the account,” RIPE said. “Our information security team is continuing to investigate whether any other accounts have been affected. Account holders who might be affected will be contacted directly by us.”

RIPE recommends that all users update their passwords and enable two-step verification, which requires them to enter a six-digit security code generated by an authenticator app whenever they try to log in.

The organization said it is also investigating how to make two-step verification mandatory and plans to offer additional second-factor options for users.

Raccoon Stole Password

Cybercrime intelligence firm Hudson Rock said the attacker – Ms_Snow_OwO – posted to X an image showing how they had accessed Orange’s RIPE NCC access account, which displayed the email address associated with the telco’s RIPE account. Hudson Rock said that according to its research, a system associated with that email address suffered a Raccoon info-stealer infection last September, and information exfiltrated from the system included credentials for accessing its https://access.ripe.net account as well as 77 other corporate credentials.

Info-stealer users typically sell the stolen information via dedicated log marketplaces where buyers can browse and purchase stolen credentials. As Orange’s RIPE credential is among the information being sold in that manner, Hudson Rock said that is the likely source of the credential obtained by the attacker.

“It is also worth noting that the password that was used on Orange’s RIPE administrator account was ‘ripeadmin’ – which is ridiculously weak,” Hudson Rock said, adding that many of the corporate passwords being sold were also being reused by Orange for multiple accounts.

The weak password aside, Beaumont offered kudos to Orange, saying that after the disruption began, the telco moved quickly and transparently to address the problem.

Other organizations that use RIPE should beware of copycat attacks and make sure they’re using two-step verification, Beaumont said. “Currently, info-stealer marketplaces are selling thousands of credentials to access.ripe.net – effectively allowing you to repeat this at organizations and ISPs across Europe,” he said.