A president was deposed, and with that, a conspiracy theory arose, only for Cloudflare to propose a logical explanation.

Such was the story this week following the aftermath of Venezuelan leader Nicolás Maduro’s capture and arrest by U.S. authorities. That international incident saw some cybersecurity scrutiny, with Low Orbit Security analysing whether reported internet outages in the country were associated with the military operation. This is a possible scenario considering certain remarks made by the U.S. president and one of his generals in the aftermath of the operation, while examples like Russia and Ukraine have shown cyberwarfare is as prevalent as physical battle during war.

The analyst looked at Border Gateway Protocol (BGP) anomalies using Cloudflare Radar's route leak data for AS8048, an Autonomous System (AS) number for Venezuela's primary internet service provider, CANTV Servicios.

On January 2nd, one day prior to the Maduro operation, it was noted that “eight prefixes (blocks of IP addresses) were being routed through CANTV, with Sparkle (an Italian transit provider) and GlobeNet (a Colombian carrier) in the AS path [which is] essentially the list of networks traffic passes through to reach its destination. CANTV was in a path it is not typically a part of.”

“There was also a noticeable spike in BGP announcements in the days leading up to the events and a drastic dip in the 'Announced IP Address Space' according to the same Cloudflare Radar data, although it's unclear what this indicates,” added Graham Helton, founder of Low Orbit Security.

Helton also noted Sparkle is considered an ‘unsafe’ transit provider in the AS path, and Cloudflare didn’t show the actual network prefixes of the leak. He added the AS path showed 8048 repeated 10 times, which is unusual, as this would make the route less viable an option, considering BGP prefers shorter paths. The 8 prefixes being routed suggested domain ranges belonging to critical infrastructure firms upon reverse lookup.

“When BGP traffic is being sent from point A to point B, it can be rerouted through a point C. If you control point C, even for a few hours, you can theoretically collect vast amounts of intelligence that would be very useful for government entities. The CANTV AS8048 being prepended to the AS path 10 times means there the traffic would not prioritize this route through AS8048, perhaps that was the goal? … There were undoubtedly some BGP shenanigans happening during this time frame,” claimed Helton.

Bryton Herdes, principal network engineer for Cloudflare, suggested instead a need to curb one’s enthusiasm, noting a more “mundane” cause behind the event.

Looking at the prefixes which were originated from AS21980, Venezuela’s Dayco Telecom, Herdes noted the intriguing AS8048 is actually a provider of Dayco's AS path.

“Many of the leaked routes were also heavily prepended with AS8048, meaning it would have been potentially less attractive for routing when received by other networks,” he added. “If AS8048 was intentionally trying to become a man-in-the-middle (MITM) for traffic, why would they make the BGP advertisement less attractive instead of more attractive? Also, why leak prefixes to try and MITM traffic when you’re already a provider for the downstream AS anyway? That wouldn’t make much sense.”

Cloudflare also reported network disruptions that appeared to stem from a routing policy error or a convergence-related issue. But the real smoking gun is that such leaks are common in South American networks, with AS8048 a regular offender.

“AS8048 may have configured too loose of export policies facing at least one of their providers, AS52320. And because of that, redistributed routes belong to their customer even when the direct customer BGP routes were missing,” wrote Herdes.

The engineer also exonerated Italy's Sparkle, noting that while it does not fully implement RPKI Route Origin Validation (ROV), this wouldn’t have prevented the recent BGP anomaly seen in Venezuela, as the incident involved a valid origin AS but an abnormal path, which ROV cannot address. Instead, he noted, such path-based issues could be mitigated through Autonomous System Provider Authorization (ASPA), an upcoming IETF standard that builds on RPKI to define authorized upstream providers and block route leaks.

“While route leaks could be done with malicious intent, the data suggests this event may have been an accident caused by a lack of routing export and import policies that would prevent it. This is why to have a safer BGP and Internet, we need to work together and drive adoption of RPKI-based ASPA,” Herdes concluded.