Simply Security - News, Views, and Opinions from Trend Micro

Libya goes dark

Posted on March 7th, 2011 in CounterMeasures, Cybercrime by CounterMeasures | Be the first to comment | Tags: cybercrime, Malware

After a week of flaky Internet connectivity, traffic to and from Libya has come to a halt. The country is effectively offline; as is shown very clearly by this Google Transparency report.

Image courtesy of Google

Details of how this shutdown was achieved are few right now. It seems that routes to the country are still being advertised, but there is simply no response from any destination inside the country, the traffic is almost certainly being “blackholed“. This will also mean that Internet users inside Libya are disconnected from the outside world as they will not receive any response to their Internet requests.

Every Libyan website (by this I mean sites hosted in Libya, www.bit.ly for example is still live) that I tested was unreachable, with traffic simply failing to get a response after the last hop on the Internet backbone outside the Libyan address space. By blackholing traffic rather than using the blunt instrument of BGP as Egypt did, it is still possible to selectively allow individual computers or networks to access the internet.

Traceroute to LTT Libya web site

The best analogy I can think of is that, although the figurative canal system is still in place to get traffic to the right destination, Libya simply pulled the plug and drained the water.

Share|

« Trojanized Apps Root Android Devices

Three Bulletins, Four Vulnerabilities for March »