Shutting Down the BGP Hijack Factory

Re:Shutting Down the BGP Hijack Factory by lossolo on Tuesday July 10, 2018 @04:04PM (#17501590)

We have RIPE and other IANA organizations that have routing objects in their databases with information about through which ASN certain classes are announced, there are also LOAs. GTT and Cogent are huge Tier-1 providers, why they do not check which classes their clients are announcing? Am I missing something here?

[ Parent | on HN ]

Re:Shutting Down the BGP Hijack Factory by msumpter on Tuesday July 10, 2018 @04:12PM (#17501660)

According to a post by Job on nanog they have been known to submitted false or fabricated IRR information to RADB and RIPE: http://seclists.org/nanog/2018/Jun/379

At the end of the day, BGP is a very trusting protocol and it requires keeping the neighborhood clean and clear. IMO providers should be filtering prefixes their clients shouldn't be announcing (al la BCP38) but keeping up on the various IP blocks being shifted around is a paperwork nightmare I'm sure.

[ Parent | on HN ]

Re:Shutting Down the BGP Hijack Factory by walrus01 on Tuesday July 10, 2018 @04:20PM (#17501746)

BGP is still very much built on trust and reputation... At a local ix level if you were to show up at an ix like the ams-ix and regularly announce prefixes you have no right to, your company name and AS# would quickly develop the reputation of a rancid turd.

[ Parent | on HN ]

Re:Shutting Down the BGP Hijack Factory by im3w1l on Wednesday July 11, 2018 @02:18AM (#17504814)

The BGP authentication method doesn't seem very secure, so how do you know who you are trusting?

[ Parent | on HN ]

Re:Shutting Down the BGP Hijack Factory by walrus01 on Wednesday July 11, 2018 @02:48AM (#17504935)

a properly implemented IX has MAC address filtering on ports. This can of course be spoofed. But there is also a level of security at OSI layer 1 for the physical fiber cross connect from an ISP's panel to the IX's panel.

For instance: If the IX is located on the 15th floor of the building. An ISP might be colocated on the 12th floor. Fiber XC from 12.501.P4.D4 (12th floor, row 5, rack 01, fiber patch panel 4, SC duplex port D4) to 15.201.P1.D4, then a fiber cable from D4 to an SFP+ port on the IX's switch. Unless somebody physically hijacks your fiber crossconnect and moves it (which would be noticed as hard down immediately) it's pretty hard to pretend to be another ISP, from the perspective of the switch fabric operator of the IX.

[ Parent | on HN ]

Re:Shutting Down the BGP Hijack Factory by lormayna on Wednesday July 11, 2018 @03:42AM (#17505119)

There is no real need for BGP authentication: if you want to create a peer relathionship, it need to be configured on both routers, then there is a native trust relationship.

[ Parent | on HN ]

Re:Shutting Down the BGP Hijack Factory by walrus01 on Tuesday July 10, 2018 @04:07PM (#17501615)

Many big ISPs are quite diligent about what blocks their downstream customers announce. If you're an NTT ip transit customer every new block you announce to them is vetted. They have a high degree of automation with IRR integration but also humans in the loop.

Any asshole can theoretically make a fraudulent LOA, but by producing one to an upstream a hijack factory opens itself up to criminal charges of fraud and forgery.

[ Parent | on HN ]

Re:Shutting Down the BGP Hijack Factory by madsushi on Thursday July 12, 2018 @03:20AM (#17512805)

One note: not all IP addresses are handled by RIPE/ARIN/etc. There are legacy allocations which are not subject to any agreements and are the property of the owners.

[ Parent | on HN ]