Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is BGP safe yet?

isbgpsafeyet.com

Post reply on HN
Print view View original

21–30 of 98 posts

Re: Is BGP safe yet?

#21

Post by SCdF »

chrismustcode wrote: post #6
nemomarx wrote: post #2

This actually shows pretty good coverage for this feature, it seems to me. The big American isps do it, the mobile ones do too... How many major isps would we want to implement it to be "safe" and what would that look like? Is this a regional thing? They've only listed 4 unsafe ones on the site and that doesn't seem like a major issue, but maybe they're very large somewhere.

I'm on sky in the UK which is marked as not safe due to no RPKI. It's not on the list so imagine there is a fair few missing, would be neat to have a table you could filter by country, provider type (cloud/isp etc) based on real results from users. edit: there's a show all button to expand the table

If you're interested, Community Fibre is a yes from this website

Re: Is BGP safe yet?

#22

Post by jon-wood »

NewsaHackO wrote: post #13

> A BGP hijack occurs when a malicious node deceives another node, lying about what the routes are for its neighbors. Without any security protocols, this misinformation can propagate from node to node, until a large number of nodes now know about, and attempt to use these incorrect, nonexistent, or malicious routes. But with HTTPS, they wouldn't be able to actually pose as another website, just delay/black hole the…

For anything major you're right, you'd expect them to be on the HSTS preload list in people's browsers which forces all requests over SSL which would then pick up an invalid certificate. That doesn't make this harmless though, just being able to blackhole traffic for something is a pretty significant attack - Pakistan a few years back accidentally caused YouTube to be unavailable ~worldwide when they only intended to make it unavailable within the country. There's also a lot of sites not on the preload list, and those you could fairly easily MITM, especially if you've also got access to a tame certificate issuer and I don't doubt that a nation state could persuade someone to issue them some certificates given the proper levers.

Re: Is BGP safe yet?

#23

Post by foobiekr »

NewsaHackO wrote: post #13

> A BGP hijack occurs when a malicious node deceives another node, lying about what the routes are for its neighbors. Without any security protocols, this misinformation can propagate from node to node, until a large number of nodes now know about, and attempt to use these incorrect, nonexistent, or malicious routes. But with HTTPS, they wouldn't be able to actually pose as another website, just delay/black hole the…

BGP attacks have nothing to do with spoofed peers. They have to do with accepted peers behaving maliciously in terms of the AS Paths they advertise.

Once you control BGP you control any IP and can subvert certificate issuance that effectively uses IP to validate certificate issuance requests. For example anything that relies on a file or dns at a specific IP. Once you have done so, you ARE the site, no matter what HSTS says.

We’ve tried to solve this problem a few times with certificate pinning (dangerous) and more recently just giving up and using certificate transparency to try and mitigate the blast radius by hoping the duration can be curtailed. The whole system is incredibly fragile.

As an aside, BGP should move over to TLS (not https, http is a terrible protocol for this) for other reasons (it’s a better option than tcp aom/md5). That this is not already the case should inform people’s opinion of where this stuff is on the security timeline.

Re: Is BGP safe yet?

#26

Post by tialaramex »

badgersnake wrote: post #11
chrismustcode wrote: post #6

Earlier quoted context omitted.

I'm on sky in the UK which is marked as not safe due to no RPKI. It's not on the list so imagine there is a fair few missing, would be neat to have a table you could filter by country, provider type (cloud/isp etc) based on real results from users. edit: there's a show all button to expand the table

I get the same result for A&A, but frankly I trust them more than some random site with (apparently) an axe to grind.

My hope would be that A&A have a process manually whitelisting the route that made the test fail because in fact (as of course it would be) it's actually deliberately not signed but it is really their route.

But on some level that's like assuming the reason the guy with the handgun is on your plane is that he's a sky marshal and not that some idiot let a concealed handgun through security. I mean, sure, maybe, but, maybe not.

Without asking it's just a guess and I haven't asked. Maybe I should.

Re: Is BGP safe yet?

#27

Post by jsty »

badgersnake wrote: post #11
chrismustcode wrote: post #6

Earlier quoted context omitted.

I'm on sky in the UK which is marked as not safe due to no RPKI. It's not on the list so imagine there is a fair few missing, would be neat to have a table you could filter by country, provider type (cloud/isp etc) based on real results from users. edit: there's a show all button to expand the table

I get the same result for A&A, but frankly I trust them more than some random site with (apparently) an axe to grind.

https://www.aa.net.uk/etc/news/bgp-and-rpki/

Re: Is BGP safe yet?

#28

Post by impl »

maltalex wrote: post #15

RPKI doesn't make BGP safe, it makes it safer . BGP hijacks can still happen. RPKI only secures the ownership information of a given prefix, not the path to that prefix. Under RPKI, an attacker can still claim to be on the path to a victim AS, and get the victim's traffic sent to it. The solution to this was supposed to be BGPSec, but it's widely seen as un-deployable.

I believe the current attempt at mitigation for this is ASPA[0]. It still has a long way to go, but there are some big names behind it.

[0]: https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-asp...

Re: Is BGP safe yet?

#29

Post by arnorhs »

john_strinlai wrote: post #12
olivier5199 wrote: post #10

An ISP is marked as unsafe in the table, yet running the test says it is. (same ASN)

the last update on the table was feb 3. presumably rpki was implemented between then and now

ISP's often have different infrastructure for different sets of customers (regional, mobile/landline differences etc) - often due to legacy M&As etc..

Re: Is BGP safe yet?

#30

Post by [deleted] »

arnorhs wrote: post #29
john_strinlai wrote: post #12

Earlier quoted context omitted.

the last update on the table was feb 3. presumably rpki was implemented between then and now

ISP's often have different infrastructure for different sets of customers (regional, mobile/landline differences etc) - often due to legacy M&As etc..

[deleted]
Post reply on HN