Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is BGP safe yet?

isbgpsafeyet.com

Post reply on HN
Print view View original

71–80 of 98 posts

Re: Is BGP safe yet?

#71

Post by xyquadrat »

q3k wrote: post #63
xyquadrat wrote: post #38

Earlier quoted context omitted.

Hmm, I'd disagree. The fact that Anapaya Systems (the for profit company mentioned) has the only commercial implementation/adjacent software is a problem, yes. But "snake oil" doesn't quite match up with the fact that SCION right now provides the backbone for the Swiss financial network moving 200 billion CHF each day [1], so at least some level of workable technology has to be there. And for no one to be taking it s…

> SCION right now provides the backbone for the Swiss financial network moving 200 billion CHF each day This is a meaningless benchmark - for a small group of trusted big enterprises with insurance policies and mutually signed contracts you could've just as well used OSPF with zero filters. The benchmark would be adoption by an actual large number of parties that don't/can't talk to eachother spread across the world.…

I'm not claiming that this shows SCION can replace the respective parts of the network stack right now, and you're right that at a global scale this is still an unproven technology. But I would argue that a technology needs a certain level of matureness / is not "snake oil" if it is deployed in a heavily regulated and comparatively conservative sector such as banking.

Re: Is BGP safe yet?

#73

Post by maltalex »

hugo1789 wrote: post #70
maltalex wrote: post #15

RPKI doesn't make BGP safe, it makes it safer . BGP hijacks can still happen. RPKI only secures the ownership information of a given prefix, not the path to that prefix. Under RPKI, an attacker can still claim to be on the path to a victim AS, and get the victim's traffic sent to it. The solution to this was supposed to be BGPSec, but it's widely seen as un-deployable.

I think RPKI is good enough. As we have TLS on top it doesn't need to be perfect.

Only with certificate pinning or something similar. Otherwise, the attacker can get valid TLS certificates for any domain hosted on the hijacked IP addresses.

Re: Is BGP safe yet?

#74

Post by ThomasGlanzmann »

dsr_ wrote: post #18
NewsaHackO wrote: post #13

> A BGP hijack occurs when a malicious node deceives another node, lying about what the routes are for its neighbors. Without any security protocols, this misinformation can propagate from node to node, until a large number of nodes now know about, and attempt to use these incorrect, nonexistent, or malicious routes. But with HTTPS, they wouldn't be able to actually pose as another website, just delay/black hole the…

If you can inject arbitrary malicious routes, you can make ACME requests for a new cert.

You can mitigate this with DNSSEC, CAA records and account pinning. See: https://www.devever.net/~hl/xmpp-incident

Re: Is BGP safe yet?

#75

Post by altairprime »

maltalex wrote: post #15

RPKI doesn't make BGP safe, it makes it safer . BGP hijacks can still happen. RPKI only secures the ownership information of a given prefix, not the path to that prefix. Under RPKI, an attacker can still claim to be on the path to a victim AS, and get the victim's traffic sent to it. The solution to this was supposed to be BGPSec, but it's widely seen as un-deployable.

“Safe” the platonic ideal is an impossibility. Any cryptographic solution depends ultimately on handshake agreements between fallible human executives and/or fallible human registries, and there’s no known alternative to that today. Is RPKI “safe”, relative to not RPKI? Yes, obviously, it is. Is it reasonable to interpret “safe” as ‘no further improvement is required’? Never: this is the Internet; one could expect the domain to be repurposed to cover more than RPKI someday. Yes, short-sighted leaders may use “RPKI is safe” as justification to withhold investment forward past it; but that outcome is certain regardless of how they justify it.

Re: Is BGP safe yet?

#76

Post by rot256 »

hugo1789 wrote: post #70
maltalex wrote: post #15

RPKI doesn't make BGP safe, it makes it safer . BGP hijacks can still happen. RPKI only secures the ownership information of a given prefix, not the path to that prefix. Under RPKI, an attacker can still claim to be on the path to a victim AS, and get the victim's traffic sent to it. The solution to this was supposed to be BGPSec, but it's widely seen as un-deployable.

I think RPKI is good enough. As we have TLS on top it doesn't need to be perfect.

For LetsEncrypt, routing is authentication: if packets routed to the IP in the A record end up at your place, you can get a cert for that domain.

Re: Is BGP safe yet?

#78

Post by zymhan »

hugo1789 wrote: post #70
maltalex wrote: post #15

RPKI doesn't make BGP safe, it makes it safer . BGP hijacks can still happen. RPKI only secures the ownership information of a given prefix, not the path to that prefix. Under RPKI, an attacker can still claim to be on the path to a victim AS, and get the victim's traffic sent to it. The solution to this was supposed to be BGPSec, but it's widely seen as un-deployable.

I think RPKI is good enough. As we have TLS on top it doesn't need to be perfect.

Those two things address orthogonal issues

Re: Is BGP safe yet?

#79

Post by surround »

The graphic that shows that a hijacker can route traffic to their malicious website is a little misleading. Since the SSL certificate would be invalid, browsers would block the connection and show a warning.

I guess the attack could still be used for denial of service.

Re: Is BGP safe yet?

#80

Post by icedchai »

surround wrote: post #79

The graphic that shows that a hijacker can route traffic to their malicious website is a little misleading. Since the SSL certificate would be invalid, browsers would block the connection and show a warning. I guess the attack could still be used for denial of service.

Once you have control of the destination, you could get a valid SSL certificate with Letsencrypt or whatever.
Post reply on HN