Shutting Down the BGP Hijack Factory

Re:Shutting Down the BGP Hijack Factory by lormayna on Tuesday July 10, 2018 @04:46PM (#17502000)

I have worked for a medium size ISP for many years (3 upstream Tier-1 provider, presence on 2 IXP) and we sometimes suffer from BGP hijaking. We had developed a software that every hour checks the BGP prefix assigned to every peer and update the BGP filter automatically. It takes some time to engineering it and develop but after then, it works like a charm.

[ Parent | on HN ]

Re:Shutting Down the BGP Hijack Factory by eecc on Tuesday July 10, 2018 @05:15PM (#17502246)

That’s a 1-hour attack window though. It should be event driven, something where peers can securely signal changes as they happen

[ Parent | on HN ]

Re:Shutting Down the BGP Hijack Factory by lormayna on Wednesday July 11, 2018 @03:40AM (#17505115)

You can run every 15 minutes if you want.

It's a shame that the ISP is bankrupted, it could be a very nice product also to sell. I was in charge of this software, I can reproduce it easily (unfortunately I don't get the source code) and put online then everyone can use and improve.

[ Parent | on HN ]

Re:Shutting Down the BGP Hijack Factory by inetknght on Tuesday July 10, 2018 @09:32PM (#17503747)

Write a protocol for it then and demonstrate its use

[ Parent | on HN ]

Re:Shutting Down the BGP Hijack Factory by j16sdiz on Tuesday July 10, 2018 @10:46PM (#17504088)

Those are very expensive. According to apnic[1], there are 15,000 update / day in 2016. For small size ISP, the number is much lower and may be managible. But event driven can't be a general solution for larger isp.

[1] https://blog.apnic.net/2017/01/27/bgp-in-2016/

[ Parent | on HN ]

Re:Shutting Down the BGP Hijack Factory by gcb0 on Wednesday July 11, 2018 @01:04AM (#17504569)

15k updates a day? how big is the payload? ...sounds negligible to someone ignorant in BGP finer details.

[ Parent | on HN ]