nanog mailing list archives

Re: The story about MyEtherWallet.com hijack or how to become a millionare in 2 hours.


From: Job Snijders <job () ntt net>
Date: Tue, 24 Apr 2018 20:35:38 +0000

On Tue, Apr 24, 2018 at 10:22:19PM +0200, Fredrik Korsbäck wrote:
Id take it that 15169 accepted the prefix for some reason over a
bilateral peering-sesssion (to the best of my knowledge the equinix
routeservers does indeed do filter, but please correct me on this one)
with 10297 and hence poisoned the 8.8.8.8 resolver for some time with
the wrong ip-addr.

I have no reason to believe the Equinix route servers propagated or
contributed to this hijack, I checked with them. It is a good thing
their route server has filters, otherwise the damage could've been even
worse!

Kind regards,

Job


Current thread: