Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is BGP safe yet?

isbgpsafeyet.com

Post reply on HN
Print view View original

41–50 of 98 posts

Re: Is BGP safe yet?

#41

Post by ck2 »

asveikau wrote: post #33
nemomarx wrote: post #2

This actually shows pretty good coverage for this feature, it seems to me. The big American isps do it, the mobile ones do too... How many major isps would we want to implement it to be "safe" and what would that look like? Is this a regional thing? They've only listed 4 unsafe ones on the site and that doesn't seem like a major issue, but maybe they're very large somewhere.

I got a fail on T-Mobile USA. It seems in the full list that T-Mobile is listed as both passing and failing.

same

     T-Mobile USA, AS21928 does NOT implement BGP safely

Re: Is BGP safe yet?

#42

Post by rot256 »

maltalex wrote: post #15

RPKI doesn't make BGP safe, it makes it safer . BGP hijacks can still happen. RPKI only secures the ownership information of a given prefix, not the path to that prefix. Under RPKI, an attacker can still claim to be on the path to a victim AS, and get the victim's traffic sent to it. The solution to this was supposed to be BGPSec, but it's widely seen as un-deployable.

I think that way to solve BGPs security problems might be to use a new cryptographic hammer, "Proof-Carraying Data", where messages come with cryptographic proofs that they were produced correctly. This allows you to basically just run BGP, but every AS proves that it ran it correctly. The proofs take constant time to verify, regardless of how large the network is, or how many hops the routing message has taken. Feasibility is helped by latency not being super critical in BGP and BGP being a pretty simple protocol; which makes computing these proofs plausible.

https://rot256.dev/post/bgp-pcd/

Proof-carrying data has come a long way in the last 10 years.

EDIT: you would still need RPKI, but not BGPSec

Re: Is BGP safe yet?

#43

Post by jeroenhd »

jon-wood wrote: post #22
NewsaHackO wrote: post #13

> A BGP hijack occurs when a malicious node deceives another node, lying about what the routes are for its neighbors. Without any security protocols, this misinformation can propagate from node to node, until a large number of nodes now know about, and attempt to use these incorrect, nonexistent, or malicious routes. But with HTTPS, they wouldn't be able to actually pose as another website, just delay/black hole the…

For anything major you're right, you'd expect them to be on the HSTS preload list in people's browsers which forces all requests over SSL which would then pick up an invalid certificate. That doesn't make this harmless though, just being able to blackhole traffic for something is a pretty significant attack - Pakistan a few years back accidentally caused YouTube to be unavailable ~worldwide when they only intended to…

Only as long as all certificate authorities ensure that all networks they host servers on secure. If you can BGP spoof a domain-validating CA, you can get a valid certificate for any domain of your choice (unless maybe if that domain is DNSSEC-enabled, the CA does strict validation, and the domain has a CAA record for another CA that is not BGP-spoofable).

Major news outlets, government websites from various countries, the American army, and many more all lack CAA records, for instance. Any CA can generate a valid certificate for those domains and it's up to the people watching the public certificate transparency logs to catch any malicious certificates.

Re: Is BGP safe yet?

#44

Post by diablevv »

maltalex wrote: post #15

RPKI doesn't make BGP safe, it makes it safer . BGP hijacks can still happen. RPKI only secures the ownership information of a given prefix, not the path to that prefix. Under RPKI, an attacker can still claim to be on the path to a victim AS, and get the victim's traffic sent to it. The solution to this was supposed to be BGPSec, but it's widely seen as un-deployable.

[dead]

Re: Is BGP safe yet?

#45

Post by maltalex »

Retr0id wrote: post #39
maltalex wrote: post #15

RPKI doesn't make BGP safe, it makes it safer . BGP hijacks can still happen. RPKI only secures the ownership information of a given prefix, not the path to that prefix. Under RPKI, an attacker can still claim to be on the path to a victim AS, and get the victim's traffic sent to it. The solution to this was supposed to be BGPSec, but it's widely seen as un-deployable.

> and get the victim's traffic sent to it This sounds "obviously bad" but the intricacies of routing aren't really my field, could you expand on why this is bad? (i.e. what specific bad things does it enable)

Here are some examples:

The attacker can impersonate the victim, get a valid x509 certificate issued to it, and create a perfect replica of their website/api/whatever.

The attacker can perform a man-in-the-middle attack on the victim - record traffic, inject traffic, manipulate traffic, etc.

The attacker can just deny access to the victim - just drop packets meant for the victim.

Re: Is BGP safe yet?

#46

Post by greyface- »

RPKI isn't just ROAs anymore, and BGP hijacks can happen at other places than just the first/last hop. Why hasn't this site been updated to test ASPA-invalid prefixes in addition to ROA-invalid ones?

Re: Is BGP safe yet?

#47

Post by lucasay »

RPKI makes BGP safer, not safe. It helps prevent some hijacks, but attackers can still mess with routing paths. Feels like we’re patching a trust-based system rather than fixing it.

Re: Is BGP safe yet?

#48

Post by tonetegeatinst »

xyquadrat wrote: post #38
pigggg wrote: post #20

Earlier quoted context omitted.

SCION is generally considered snake oil within the network operator community. Its weird single vendor for profit company that ships it's software, the fact that no router hw asic fwding supports what they want to do and then the general scummy inclusion of block chain / crypto as well as some "green washing" for PR hype. Sure the swiss have their toy but no one is taking it seriously.

Hmm, I'd disagree. The fact that Anapaya Systems (the for profit company mentioned) has the only commercial implementation/adjacent software is a problem, yes. But "snake oil" doesn't quite match up with the fact that SCION right now provides the backbone for the Swiss financial network moving 200 billion CHF each day [1], so at least some level of workable technology has to be there. And for no one to be taking it s…

200billion CHF....how big is that in bandwidth?

Re: Is BGP safe yet?

#49

Post by greyface- »

impl wrote: post #28
maltalex wrote: post #15

RPKI doesn't make BGP safe, it makes it safer . BGP hijacks can still happen. RPKI only secures the ownership information of a given prefix, not the path to that prefix. Under RPKI, an attacker can still claim to be on the path to a victim AS, and get the victim's traffic sent to it. The solution to this was supposed to be BGPSec, but it's widely seen as un-deployable.

I believe the current attempt at mitigation for this is ASPA[0]. It still has a long way to go, but there are some big names behind it. [0]: https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-asp...

It has a long way to go, in the same sense that ROA had a long way to go when Cloudflare first launched this site in 2020. ASPA records are fully supported by both RIPE and ARIN these days.
Post reply on HN