Shutting Down the BGP Hijack Factory • Hacker News Board

Re: Shutting Down the BGP Hijack Factory

#21

Post by akerl_ » Tue, Jul 10, 2018, 11:00 PM UTC

NKosmatos wrote: post #19

I fail to understand why there is no quick and official way to terminate such bad actors. Isn’t there a task force for monitoring and enforcing some rules? There should be a SPoC for every AS, available 24/7 so that such notorious players are kicked out immediately. We live in an age where everything can be traced and monitored and we allow BGP hijacking and other similar acts. Oh well, my romantic idea for a properl…

Who would be in charge of the moderation?

This very article describes the closest thing to that: NANOG is a collection of network operators, and they communicate with each other about the overall state and coordination of "the internet", which realistically is just "the total set of a lot of network operators agreeing to connect to each other".

Domain registration and DNS have much more centralization because there exists a root entity for the entire (public) system and an owner of each TLD: if an entity wants to remove example.com from existence, they can go to the .com operator and attempt to compel them to do that. For IP routing, you're talking about BGP between a vast number of different entities. By design, traffic can route a variety of ways between each point.

Re: Shutting Down the BGP Hijack Factory

#22

Post by NKosmatos » Tue, Jul 10, 2018, 11:18 PM UTC

akerl_ wrote: post #21

NKosmatos wrote: post #19

I fail to understand why there is no quick and official way to terminate such bad actors. Isn’t there a task force for monitoring and enforcing some rules? There should be a SPoC for every AS, available 24/7 so that such notorious players are kicked out immediately. We live in an age where everything can be traced and monitored and we allow BGP hijacking and other similar acts. Oh well, my romantic idea for a properl…

Who would be in charge of the moderation? This very article describes the closest thing to that: NANOG is a collection of network operators, and they communicate with each other about the overall state and coordination of "the internet", which realistically is just "the total set of a lot of network operators agreeing to connect to each other". Domain registration and DNS have much more centralization because there e…

Yes that’s true, most of the work and moderation is done via mailing lists (like in Linux dev or with IETF/RFCs) but when we’re talking about the infrastructure I would expect something more efficient. Sure someone must notice it and report it, but I don’t get why it takes so long. And just to avoid misunderstandings I’m not talking about censorship, but actual WTF situations as this one described in the post where it’s obvious what is happening with Bitcanal.

Re: Shutting Down the BGP Hijack Factory

#23

Post by akerl_ » Tue, Jul 10, 2018, 11:21 PM UTC

NKosmatos wrote: post #22

akerl_ wrote: post #21

Earlier quoted context omitted.

Who would be in charge of the moderation? This very article describes the closest thing to that: NANOG is a collection of network operators, and they communicate with each other about the overall state and coordination of "the internet", which realistically is just "the total set of a lot of network operators agreeing to connect to each other". Domain registration and DNS have much more centralization because there e…

Yes that’s true, most of the work and moderation is done via mailing lists (like in Linux dev or with IETF/RFCs) but when we’re talking about the infrastructure I would expect something more efficient. Sure someone must notice it and report it, but I don’t get why it takes so long. And just to avoid misunderstandings I’m not talking about censorship, but actual WTF situations as this one described in the post where i…

How do you decide whether the bad BGP announcement was an accident or malicious?

Re: Shutting Down the BGP Hijack Factory

#24

Post by petee » Wed, Jul 11, 2018, 12:09 AM UTC

And yet still being peered - https://bgp.he.net/AS197426#_peers

Re: Shutting Down the BGP Hijack Factory

#25

Post by petee » Wed, Jul 11, 2018, 12:17 AM UTC

driverdan wrote: post #11

If they have been bad actors for years why didn't they lose access earlier?

They were booted last year by a German IXP, DE-CIX after reported abuse. Nice to see a company with an abuse handle that works

http://seclists.org/nanog/2018/Jun/370

Re: Shutting Down the BGP Hijack Factory

#26

Post by petee » Wed, Jul 11, 2018, 12:19 AM UTC

EthanHeilman wrote: post #2

http://www.bitcanal.com is down. Did they host it in their AS and now their AS is unreachable?

I timeout on getting an IP, but I noticed Opera/Chrome already flagged the url as unsafe despite the dns fail.

Re: Shutting Down the BGP Hijack Factory

#27

Post by blueish » Wed, Jul 11, 2018, 12:38 AM UTC

akerl_ wrote: post #21

NKosmatos wrote: post #19

I fail to understand why there is no quick and official way to terminate such bad actors. Isn’t there a task force for monitoring and enforcing some rules? There should be a SPoC for every AS, available 24/7 so that such notorious players are kicked out immediately. We live in an age where everything can be traced and monitored and we allow BGP hijacking and other similar acts. Oh well, my romantic idea for a properl…

Who would be in charge of the moderation? This very article describes the closest thing to that: NANOG is a collection of network operators, and they communicate with each other about the overall state and coordination of "the internet", which realistically is just "the total set of a lot of network operators agreeing to connect to each other". Domain registration and DNS have much more centralization because there e…

I had a conversation with a friend about this, and the outcome was the idea that BGP could be extended with functionality for this case. There needs to be a way to brand "negative" traffic or routes advertised with some sort of reputation system. In the event of a DDoS attack coming from an AS, you could have intra-AS weight for any given AS such that if an AS reports malicious traffic from a route, it's given a lower weight and traffic is less likely to route to that AS in favor of a less specific prefix. This would encourage any given AS to act in desirable ways, as their actions (or actions coming from within them, e.g. a customer of theirs being the source of a DoS attack) would have consequences.

Re: Shutting Down the BGP Hijack Factory

#28

Post by akerl_ » Wed, Jul 11, 2018, 12:43 AM UTC

blueish wrote: post #27

akerl_ wrote: post #21

Earlier quoted context omitted.

Who would be in charge of the moderation? This very article describes the closest thing to that: NANOG is a collection of network operators, and they communicate with each other about the overall state and coordination of "the internet", which realistically is just "the total set of a lot of network operators agreeing to connect to each other". Domain registration and DNS have much more centralization because there e…

I had a conversation with a friend about this, and the outcome was the idea that BGP could be extended with functionality for this case. There needs to be a way to brand "negative" traffic or routes advertised with some sort of reputation system. In the event of a DDoS attack coming from an AS, you could have intra-AS weight for any given AS such that if an AS reports malicious traffic from a route, it's given a lowe…

How would that work in practice? If I compromise a pile of IoT devices running on Comcast users' networks, and use them to launch and attack, all Comcast users on their subnet get marked as uncool? And if we're marking them as "bad", doesn't that mean all of their BGP peers mark them as uncool and then the weights for their prefix are lower but still even, so routing still ends up the same?

The only way they'd be impacted would be if some networks didn't implement your bad-actor-prefix-weight-mod, and then we'd just be penalizing the people who don't use your system along with the attackers, since we'd be routing the bad traffic via their networks.

Re: Shutting Down the BGP Hijack Factory

#29

Post by inetknght » Wed, Jul 11, 2018, 1:32 AM UTC

eecc wrote: post #12

lormayna wrote: post #10

I have worked for a medium size ISP for many years (3 upstream Tier-1 provider, presence on 2 IXP) and we sometimes suffer from BGP hijaking. We had developed a software that every hour checks the BGP prefix assigned to every peer and update the BGP filter automatically. It takes some time to engineering it and develop but after then, it works like a charm.

That’s a 1-hour attack window though. It should be event driven, something where peers can securely signal changes as they happen

Write a protocol for it then and demonstrate its use

Re: Shutting Down the BGP Hijack Factory

#30

Post by an_account_name » Wed, Jul 11, 2018, 1:50 AM UTC

dsr_ wrote: post #17

viridian wrote: post #15

Earlier quoted context omitted.

The lessons learned section of the article hints at orgs being way too permissive or unresponsive when bad behavior occurs. The thing is though, this isn't a world where that kind of softness and leniency makes any sort of sense.

It makes sense from a not-wanting-to-get-sued-for-breach-of-contract standpoint. The contract at IXPs almost universally includes a phrase like "will not engage in fraudulent announcement of routes", but proving that happened to the satisfaction of a non-profit's board of directors is difficult. You really have to have completely collinear anatidae.

> collinear anatidae

I'm stealing this phrase, please and thank you.