Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shutting Down the BGP Hijack Factory

dyn.com

Post reply on HN
Print view View original

41–50 of 63 posts

Re: Shutting Down the BGP Hijack Factory

#41

Post by lormayna »

eecc wrote: post #12
lormayna wrote: post #10

I have worked for a medium size ISP for many years (3 upstream Tier-1 provider, presence on 2 IXP) and we sometimes suffer from BGP hijaking. We had developed a software that every hour checks the BGP prefix assigned to every peer and update the BGP filter automatically. It takes some time to engineering it and develop but after then, it works like a charm.

That’s a 1-hour attack window though. It should be event driven, something where peers can securely signal changes as they happen

You can run every 15 minutes if you want.

It's a shame that the ISP is bankrupted, it could be a very nice product also to sell. I was in charge of this software, I can reproduce it easily (unfortunately I don't get the source code) and put online then everyone can use and improve.

Re: Shutting Down the BGP Hijack Factory

#42

Post by lormayna »

im3w1l wrote: post #36
walrus01 wrote: post #8

Earlier quoted context omitted.

BGP is still very much built on trust and reputation... At a local ix level if you were to show up at an ix like the ams-ix and regularly announce prefixes you have no right to, your company name and AS# would quickly develop the reputation of a rancid turd.

The BGP authentication method doesn't seem very secure, so how do you know who you are trusting?

There is no real need for BGP authentication: if you want to create a peer relathionship, it need to be configured on both routers, then there is a native trust relationship.

Re: Shutting Down the BGP Hijack Factory

#43

Post by AndyMcConachie »

blueish wrote: post #27
akerl_ wrote: post #21

Earlier quoted context omitted.

Who would be in charge of the moderation? This very article describes the closest thing to that: NANOG is a collection of network operators, and they communicate with each other about the overall state and coordination of "the internet", which realistically is just "the total set of a lot of network operators agreeing to connect to each other". Domain registration and DNS have much more centralization because there e…

I had a conversation with a friend about this, and the outcome was the idea that BGP could be extended with functionality for this case. There needs to be a way to brand "negative" traffic or routes advertised with some sort of reputation system. In the event of a DDoS attack coming from an AS, you could have intra-AS weight for any given AS such that if an AS reports malicious traffic from a route, it's given a lowe…

You might be interested in the DOTS working group at the IETF.

https://datatracker.ietf.org/wg/dots/charter/

Re: Shutting Down the BGP Hijack Factory

#45

Post by ge0rg »

walrus01 wrote: post #39
akerl_ wrote: post #23

Earlier quoted context omitted.

How do you decide whether the bad BGP announcement was an accident or malicious?

When the announcer doesn't immediately retract it in embarrassment, continues to announce it, the RIPE/APNIC/ARIN WHOIS data for the block continues to show ownership info other than the announcer, and the announcer doesn't produce a legitimate business relationship and LOA for why they should be announcing that "new" /18. It's usually pretty obvious.

How many hours / days / weeks do you need to give the announcer to produce all that evidence, before considering the action as malicious and undoing the announcement?

Proving a business relationship sounds like a multi-day endeavor, whereas you typically want to undo the damage ASAP.

Re: Shutting Down the BGP Hijack Factory

#46

Post by JdeBP »

duxup wrote: post #9

Bitcanal sounds like an appropriately terrible name as it sounds like root canal... but for bits. BGP really needs some more organized security, but that's nothing new, and i'm sure not super easy to organize.

Not in its native language it doesn't.

* https://en.wiktionary.org/wiki/canal#Portuguese

Re: Shutting Down the BGP Hijack Factory

#47

Post by mnx »

an_account_name wrote: post #30
dsr_ wrote: post #17

Earlier quoted context omitted.

It makes sense from a not-wanting-to-get-sued-for-breach-of-contract standpoint. The contract at IXPs almost universally includes a phrase like "will not engage in fraudulent announcement of routes", but proving that happened to the satisfaction of a non-profit's board of directors is difficult. You really have to have completely collinear anatidae.

> collinear anatidae I'm stealing this phrase, please and thank you.

Could you explain what it means? I read about rhyming slang, but can't figure this out

Re: Shutting Down the BGP Hijack Factory

#49

Post by treerock »

mnx wrote: post #47
an_account_name wrote: post #30

Earlier quoted context omitted.

> collinear anatidae I'm stealing this phrase, please and thank you.

Could you explain what it means? I read about rhyming slang, but can't figure this out

I'm guessing another way of saying "ducks in a row"?

https://idioms.thefreedictionary.com/have+ducks+in+a+row

Post reply on HN