ELI5: How was Russia able to redirect all cloud traffic through their country from multiple sources like Apple, Microsoft… Etc. Wouldn’t they have to compromise all the individual systems (like apple) to do this? What are the broader implications of this?

jl91569: They used a protocol that tells routers how to get from network A to network B to tell them to go through the Russian network.

The network operators generally don’t filter this kind of request because it’s mostly used for legitimate purposes like when someone’s network crashed or is overloaded.

See [Wikipedia](https://en.wikipedia.org/wiki/Border_Gateway_Protocol) if you want to read up about how it works. [This site](http://www.enterprisenetworkingplanet.com/netsp/article.php/3615896/Networking-101-Understanding-BGP-Routing.htm) has a fairly easy to understand explanation.

Deesooy: The way your computer knows where to send your network packages is through something called a “routing table”, which is basically a mapping of networks your computer knows about, and the corresponding physical ports on your computer. On your home computer this usually has only one entry: “send all packages through my wifi card”. That will and up at your home router, which has a slightly more complicated routing table with two entries:

* send all packages addressed to the local network out through the wifi (this is how you access other computers in your house)
* send all other packages out through the internet connection to the ISP

At the ISP the package that you send to Apple, is processed by their router. That router is much larger and there might be very many of them, so their routing table is much much larger.

The ISP might have a youtube server right in their own datacenter to help speed up videos, so there is an entry in the routing table about that, but for example to reach Apple, it might send it to a different ISP, who knows yet another ISP who knows where the Apple server is located.

Because this is very complex, these tables aren’t configured manually, but they use something called the [“Border gateway Protocol”](https://en.wikipedia.org/wiki/Border_Gateway_Protocol). That basically works by Apple sending out a message to all the routers it, in turn, knows about, saying:

> Hey guys! I am Apple and please send all network packages that should go to Apple through this connection here: ::ROUTING INFORMATION::

Turns out, this message is not authenticated in any way, so anyone who is part of that network of routers can send such a message with false information.

It’s amazing how fragile some of these things are.

togetherwem0m0: El15:
The internet is a series of interconnected networks. Each network trusts all the others to behave and listens when they broadcast instructions. These instructions tell the rest of the networks the directions to get to their destinations.

So any network operator that is connected to the internet and has addresses from their regional ip address authority and has the right equipment can broadcast these instructions that all the other networks implement once heard.

The broad implications are complicated. So far as i know incidents like these have been accidents. A network engineer made a typo or equipment went shit. but there’s a good chance nation states use the method to intercept traffic and information on a selective basis.

Say you are in new Zealand and one of the powerful nation states has an interest in your signals. You have collection nodes scattered across the globe tapped into fibre at various important points but maybe not everywhere. If You are a nation state actor you may have compromised access to an is in Brazil where you issue routing instructions telling the whole internet to change the path for a group of ip addresses. Then this route is collected and fed into your sigint system.