> You can potentially BGP hijack a domain (via DNS) and e-mail (via SMTP) as a private individual so easily.

No you can't.

Well various attacks exist against ip routing, dns, email forging etc,in practice they are really hard to pull off as an individual who isn't in a privileged network position (with possible exception of email forging. That one is a bit easier depending on stuff)

> You can potentially BGP hijack a domain (via DNS)

I think you might be confusing stuff here. Unless you bgp hijack the nameserver, but if you have that ability, why not go after the site directly?

If you've worked in the industry, you know you can get a BGP uplink these days with bare minimum IRR source validation with only a signature on a contract (not even payment is required to turn up generally).

Using this, you can advertise any IP prefix you want. Since a lot of providers advertise /23+ as well, if you hijack the /24, you will always be the BGP best path and will be able to accomplish a full internet-wide hijack.

Of course, the task requires a few weeks of planning and execution, but that doesn't stop it from being possible.

If you are a nation-state, you already have all of the above, and nobody to hold you accountable for using it.

> Of course, the task requires a few weeks of planning and execution, but that doesn't stop it from being possible.

Few weeks? With most providers you can get this done within 24h from the initial email to sales@

Getting the colocation, hardware, BGP uplink, and the creativity involved in not using your identity at all & minimizing (or eliminating) expenses. Possible, but it'll take a few weeks.

You don’t need any of those things, you can just rent a dedicated server (perhaps even a VPS) and send over a LoA and have the host route the IPs to your box.

I’ve never had to deal with colo or think about hardware to have my IPs announce.

Generally the reason an attacker would do those things is because their hijacks will last much longer due to lack of an abuse department and victims having to contact upstreams.

Shorter ASPath, planning which Tier 1/2 is the best to hijack from, and lack of LOA requirement or RPKI.

If an attacker wants to do this - they don't want to "just" cause damage. This is a limited opportunity. They want to do it right, and that takes planning.

I do agree that your idea is possible, but I don't think it captures the full severity of the issue.

> No you can't.

Yes you can

> they are really hard to pull off as an individual who isn't in a privileged network position

“privileged network position”, as in someone with a couple of thousand dollars to spend.

Where i live you can use an email as a proof of anything at court

so can a fax, but bureaucratic shortsightedness is not a good proof of anything.

> These protocols only have bandaids like DNSSEC and RPKI stopping you from doing it

The lion share of mailers don't check even them.

> You can potentially BGP hijack a domain (via DNS)

domains and BGP don't really interact, can you explain what you mean?

I imagine what they're getting at is, you do a BGP hijack so that you get all the DNS queries about domain.example. So when a resolver asks about something.domain.example it gets told to ask servers authoritative for domain.example and it is given the IP addresses for some of those servers, but a BGP hijack could (if successful) allow you to answer for those IP addresses instead.

At this point you can give any answers you like for such queries.

If the domain has DNSSEC, you either have to choose answers you've seen that may be misleading (e.g. old but still not expired answers) or some resolvers might notice your answers are bogus.

Many domains today don't have DNSSEC, so, you could give any answer and it will be indistinguishable from an answer by the legitimate authoritative DNS servers. Nobody would know any different.

Now that you can cause traffic to go wherever you want, you can easily satisfy most of the Ten Blessed Methods and get yourself certificates in the Web PKI ("SSL Certificates") or whatever else you needed to achieve.

In the distant future sometimes it may be possible that a recursive is able to assure itself that the answer is genuine via DPRIVE [DNS over HTTPS, or TLS, or QUIC or whatever else is invented] instead but in practice most of the routes by which we could get genuine answers ultimately rely on DNSSEC (DPRIVE is still doing something useful for you - privacy benefits, particularly oblivious transfer could mean you get trustworthy answers with a promise that your honest broker doesn't know what you asked, and the authoritative servers know what was asked but not who asked it)

I guess he meant the ip address

Just wait till the people freaking out about BGP find out what you can accomplish with a fake court order!

How do you do these attacks exactly??