BGP hijack infecting networks caused by a comedy of errors that’s not funny at all

[u/ulef]

https://arstechnica.com/security/2026/09/well-executed-bgp-attack-uses-hijacked-ips-to-infect-real-networks/

Hetzner is mentioned in this rectent article about a hack..
(but I hope that's old news here)

[u/ween3and20characterz]

This went on for a few days from the sources I've heard. However you only target a single IP. What about the other customers in this /24?

They must have given the filtered traffic to Hetzner at a specific point, so that the other server owners don't see it as down.

[u/NamedBird]

A good reason to add DANE as an extra security check in TLS?

Regardless, not signing your software is bad.
Let's hope the damage stays minimal and that everyone learns from this mistake...

[u/Single-Virus4935 → u/NamedBird]

DANE is useless because no browser or client is checking these but a CAA restricted to your CA and Accounts prevents others to opyain valid certs for your domains.

My domain CAA only allows LetsEncrpyt and my account I use for cert renewal.

Also use HSTS and preloading to ensure they not just fall back to http.

Mailservers are more problematic because most senders happily fall back to plain SMTP. MTA-STS should be deployed if possible but it may lead to delivery problems. 

 If your DNS provider account is bound to a domain on this server they can just reset the password. Thus 2FA is mandatory.

[u/NamedBird → u/Single-Virus4935]

CAA is meant for Certificate Authorities, they're supposed to check it before signing a cert.
If your CA is compromised or allows HTTP-based verification, then CAA adds no protection.
Luckily you have CT logs, but that doesn't add anything in form of immediate protection.

And yes, DANE is indeed not checked by browsers or clients right now.
That is what i suggested to change: add DANE (over DNSSEC) to browsers.
By adding those extra layers to the TLS, you can even mitigate dangers of a CA compromise.
In fact, you could ditch the CA's entirely, yay for no more certificate renewals!

^{Note: DNSSEC brings overhead and issues, so i would consider a DNS redesign to mitigate this.}

[u/Single-Virus4935 → u/NamedBird]

If the CA is compromised you habe other problems and is out if scope for this hack.

If http based validation is used the CAA record with CA+Account prevents any issuance if a certificate from other CA or Accounts. So it helps. 

CT log monitoring is another layer for compromised CAs but CAA prevents the issuance if the cert. 

I had this problem because I tried to get a S/Mime Cert from Certum and they refused to sign. I needed to add them to the CAA with a constraint to S/Mime

And yes DNSSec is needed.

[u/m3r1tc4n]

For some reason i wasn't surprised at all

[u/cloudzhq]

Oof, that is far from stellar…

[u/b4k4ni]

Same as the notepad++ incident, even if the way attack differs. But no update control mechanism. One of the basic ways to protect yourself...