Dyn Research

"Out of the box these home routers all come with the same subnet" - if the customer has any way to change the router LAN subnet, this does not matter. Someone will put it to 10.x.x.x. My cable modem came from ISP with a default login from the LAN side which allows me to change pretty much anything I wish - if in BT setup they do not allow login, then that argument of mine would not make sense.

"NAT that" - sure, if you say so. Unless someone years ago already made that choice for you and you already have that management network.

"yet to come across any 30/8" - http://blog.erratasec.com/2013/12/dod-address-space-its-not-conspiracy.html - read the blogpost and comments.

Or http://networksavant.blogspot.fr/2013/05/70008.html

Or http://xerocrypt.wordpress.com/2013/12/07/the-adversaries-conspiracy-fail/

http://www.ispreview.co.uk/index.php/2013/12/confusion-alleged-gchq-nsa-backdoor-bt-fttc-modems.html

Of course you also can use looking glasses (http://lg.he.net/, http://www.cogentco.com/en/network/looking-glass in case anyone to check me) to verify that 30/8 is not in the BGP tables, thus is not routed.

And even if it starts getting routed, e.g. someone makes a hijack, the space surely does not have to be 30/8 to be hijacked, as evidenced by e.g. http://research.dyn.com/2013/11/mitm-internet-hijacking/

And let me put a tinfoil hat on and ask: if I were to spy on the home routers and wanted to keep the whole affair in secret, would not assignment of less "hot" chunk of…

> launch attacks on critical infrastructure from outside the country

First, "outside the the country" is a nebulous thing. For example, I suspect that a NSA and/or GCHQ trick is to simply route traffic[1] so it flows over an international fiber so it becomes "foreign" in origin. The bad BGP routes that redirected traffic through

More importantly, the executive order does not reference "critical infrastructure" (itself a vary vague term that includes "safety" and "security" (unqualified)). Instead, it references[2] "critical infrastructure sector".

(A) harming, or otherwise significantly compromising
the provision of services by, a computer or network
of computers that support one or more entities in a
critical infrastructure sector;

Which it defines as:

(d) the term "critical infrastructure sector" means any
of the designated critical infrastructure sectors
identified in Presidential Policy Directive 21

PPD-21's list[3] of the "Designated Critical Infrastructure Sectors" includes:

Commercial Facilities
Communications
Financial Services
Government Facilities
Information Technology

It would not take much imagination at all to construe various petty offenses, legitimate (but disliked) use cases, and simple accidents as "attacks" or "disruption" of some insignificant government service. Is screen scraping a business's website too fast count as "harming" a "commercial facility" that should allow accounts to be frozen…

Now that the actual source (Dyn) put up their work:

> Who caused this, and how? A long pattern of up-and-down connectivity, followed by a total outage, seems consistent with a fragile network under external attack. But it’s also consistent with more common causes, such as power problems. Point causes such as breaks in fiberoptic cables, or deliberate upstream provider disconnections, seem less likely because they don’t generate prolonged instability before a total failure. We can only guess. The data themselves don’t speak to motivations, or distinguish human factors from physical infrastructure problems. [1]

...it turns out that the DDOS part was indeed pure conjecture and over-hyped BS. Thanks, NY times.

Also, they changed the title of the article, if not more. Classy.

[1] http://research.dyn.com/2014/12/who-disconnected-north-korea/

Dyn Research (née Renesys) was quoted in the article, and typically posts in-depth articles when this type of thing happens. [1]

Based on the quote[2], I interpret the failure as someone attacking the routers themselves, overwhelming their control planes to the point where they can't sustain BGP sessions reliably.

[1] No post from them yet, would expect it to be at http://research.dyn.com/2014/12/ if/when they do the full write-up.

[2] "Their networks are under duress,” Mr. Madory said. “This is consistent with a DDoS attack on their routers,” he said, referring to a distributed denial of service attack, in which attackers flood a network with traffic until it collapses under the load."

Senior network/routing/noc staff at the top 5-10 backbones mostly. They move most/all bits at some points. For 2014 that was Level 3, Telia Sonera, Cogent, GTT, Tata, Verizon, Sprint and a few others.

Source: http://research.dyn.com/2015/02/bakers-dozen-2014-edition/

One or more of these networks likely provides transit to the errand AS or the errand AS' upstream and they can lean on them pretty hard. Doing so will be in full compliance to whatever transit agreement exists between them as well. No need to be big brother about it, it's plain self-interest. They have SLAs to meet.

There's some notes about how Whatsapp achieved that here [1], they attribute their capacity in part to Erlang's concurrency and in part to cloud hosting with SoftLayer. Amazon is the origin of SoftLayer's cloud services and single biggest reason one engineer can manage arbitrary numbers of servers/users:

The popularization of the term can be traced to 2006 when
Amazon.com introduced its Elastic Compute Cloud. [2]

[1] http://research.dyn.com/2014/03/global-consumerwhatsapp/

[2] https://en.wikipedia.org/wiki/Cloud_computing#History_of_cloud_computing