| Chinese probe blames gambling site redirects on U.S.-registered routing number An investigation report carried by state broadcaster CCTV blames gambling site redirects hitting users in several Chinese provinces on AS 402425, a routing number registered by U.S. company QOREXA LABS. The report asks internet registries to revoke the number and network operators to filter routes carrying it. The attackers registered false address prefixes in internet routing registries, then announced short paths from the network they controlled, pulling part of China's domestic traffic through it. Routers accept such announcements largely on trust and prefer the shortest path, so a false short path wins until operators filter it out. They then rewrote DNS answers in the hijacked traffic, the lookups that turn a website name into a numeric address, pointing them at gambling sites or at malicious DNS servers that returned those addresses. QOREXA LABS, whose website shows a bitcoin-related business, registered the number with ARIN, North America's internet number registry, on April 9. |