Possible BGP hijack of 1.1.1.1

Traffic meant to go to 1.1.1.1 (cloudflare DNS) could be routed elsewhere. Since this is a common DNS server, this could be used to alter domain resolution for people that use it.

Re: Possible BGP hijack of 1.1.1.1

#5

Post by jacquesm » Tue, May 29, 2018, 1:37 PM UTC

Ah! That may have been the reason why my site wasn't resolving earlier today. It was the weirdest situation with people from all over the planet complaining without any apparent pattern, a RIPE check of the site from 10 different locations showed no issues in connectivity.

Thanks for posting this.

Re: Possible BGP hijack of 1.1.1.1

#6

Post by dec0dedab0de » Tue, May 29, 2018, 1:38 PM UTC

highace wrote: post #2

What does this mean for those unfamiliar?

could be a problem for wifi captive portals that redirect to 1.1.1.1, but most of them would never route to begin with. However, I believe the real issue is that it is a free DNS server, so someone could redirect all domains that do not use ssl pinning.

Re: Possible BGP hijack of 1.1.1.1

#7

Post by czbond » Tue, May 29, 2018, 1:39 PM UTC

highace wrote: post #2

What does this mean for those unfamiliar?

1.1.1.1 is a DNS resolver that does not track activity. A BGP compromise means that someone could have compromised it and redirect/intercept traffic of those trusting it to be Cloudflare.

Re: Possible BGP hijack of 1.1.1.1

#8

Post by sudhirj » Tue, May 29, 2018, 1:39 PM UTC

highace wrote: post #2

What does this mean for those unfamiliar?

Somebody other than Cloudflare (the current holders) of the IP is receiving some of the traffic meant for it. Usuall hijack reasons are to point users to fake sites (I point yourbank.com to my own server) and phish.

Re: Possible BGP hijack of 1.1.1.1

#9

Post by koolba » Tue, May 29, 2018, 1:39 PM UTC

highace wrote: post #2

What does this mean for those unfamiliar?

1.1.1.1 is the primary IP for CloudFlare’s new DNS service. A BGP Hijack is when the destination route for that IP changes from it’s legit target to somewhere else. Often times it’s accidental but could be part of a wider attack.

In the case of DNS it’s particularly nasty as the attacker would control address resolution (say redirecting traffic for your bank to a phishing site) for everyone using 1.1.1.1 without more specific mitigations. Combined with long DNS cache times this could be a problem for a while.

Re: Possible BGP hijack of 1.1.1.1

#10

Post by ancarda » Tue, May 29, 2018, 1:39 PM UTC

How effective is this? Looking at https://bgp.he.net/ip/1.1.1.1, 1.1.1.0/24 is apparently "ROA Signed and Valid". I don't know a lot about BGP. Does this mean hijacking this subnet is a bit harder than unsigned ones because some or all ISPs verify this announcement? Or is it faster/easier to detect?

Maybe a wider question: is there some way to prevent BGP hijacking?