Pakistan Telecom Hijacks YouTube Worldwide via a More-Specific BGP Announcement (AS17557)
On 24 February 2008, while implementing a domestic block on YouTube ordered by Pakistani authorities, Pakistan Telecom (AS17557) announced 208.65.153.0/24; upstream PCCW Global (AS3491) propagated it and most of the internet sent YouTube traffic to Pakistan for roughly two hours.
02Deep-Dive Technical Analysis
YouTube (AS36561) originated 208.65.152.0/22. At 18:47 UTC AS17557 announced the more-specific /24 covering YouTube's web servers; because routers prefer the longest matching prefix, it won globally once AS3491 passed it on without filtering. YouTube re-announced the /24 at 20:07 and then two /25s at 20:18 to out-specific the hijack; AS3491 withdrew AS17557's routes at 21:01 UTC. RIPE NCC observed the whole event from ~300 RIS vantage points.
03Vulnerability & Exploit Flow
Origination of a more-specific /24 for another network's address space, propagated by an upstream that did not filter customer announcements.
04Recommended Defense & Mitigation Protocol
Strict upstream prefix filtering of customer routes, IRR/RPKI origin validation (RFC 6811), and announcing defensive more-specifics during an incident.
05Security Impact & Geopolitical Consequence
The most cited example of how a local censorship action leaks into a global outage under BGP's trust model, accelerating work on prefix filtering, IRR-based customer filters and, later, RPKI route origin validation.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.