Routing error momentarily sends AT&T Facebook data via China

During a small period on Tuesday, internet data between AT&T broadband customers and Facebook was directed via Chinese ISP China Telecom, routed by hardware inside the country before reaching its destination, The Register has confirmed.

The brief routing error was highlighted by security researcher Barrett Lyon, who identified that AT&T customers, when requesting data from Facebook, were first sending their requests via China, then Korea, before completing the request on Facebook’s servers.

Despite a momentary routing error, there was no evidence to suggest any sensitive information was compromised, but Lyon did highlight that Chinese authorities were likely to be monitoring unencrypted traffic being passed via servers on China Telecom networks, which are owned by the Chinese government.

Routing looked only to be affecting requests from AT&T users, with Lyon discovering the error by accessing AT&T’s IP Services Route Monitor. Using Telnet, he was able to perform a series of commands to identify how traffic was being routed from the provider.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!

Facebook issued a statement to The Register, confirming a single carrier was suffering from routing problems:

We are investigating a situation today that resulted in a small amount of a single carrier’s traffic to Facebook being misdirected. We are working with the carrier to determine the cause of this error.

Our initial checks of the latency of the requests indicate that no traffic passed through China.

If you are on AT&T and are worried about how you Facebook data is handled, Facebook has recently introduced a HTTPS-only option on it website which will ensure all Facebook data is securely encrypted, making sure third-parties aren’t easily able to monitor sensitive internet traffic.

To enable the option, log into Facebook and select Account Settings -> Account Security and then check the box that says “Browse Facebook on a secure connection (https) whenever possible.”