Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is BGP safe yet?

isbgpsafeyet.com

Post reply on HN
Print view View original

81–90 of 98 posts

Re: Is BGP safe yet?

#81

Post by asveikau »

Melatonic wrote: post #69
RyJones wrote: post #37

Earlier quoted context omitted.

T-Mobile consists of at least five distinct networks depending on when your carrier was purchased, last time I was talking with some of the network security guys in Factoria. It’s been four years - they may have converged some of them.

Also failing here in the Los Angeles area. Used to be on Sprint before the acquisition. Probably location dependent

I got the failure message in San Francisco.

Not sure if it makes a difference, but I had a T-Mobile SIM card I bought in Seattle in 2010 and was carrying from phone to phone for years, but I recently replaced the SIM because I heard newer t-mobile SIMs can do better finding 5g coverage.

Re: Is BGP safe yet?

#83

Post by surround »

icedchai wrote: post #80
surround wrote: post #79

The graphic that shows that a hijacker can route traffic to their malicious website is a little misleading. Since the SSL certificate would be invalid, browsers would block the connection and show a warning. I guess the attack could still be used for denial of service.

Once you have control of the destination, you could get a valid SSL certificate with Letsencrypt or whatever.

Wow I'm surprised, you're right, and it has happened before:

> the attacker issued and registered a free temporary 3-month certificate for the developers[.]kakao.com domain through SSL certificate issuer called ZeroSSL. Because the routing policy was already manipulated by the BGP Hijacking, the attacker was able to register the certificate.

https://medium.com/s2wblog/post-mortem-of-klayswap-incident-...

Re: Is BGP safe yet?

#84

Post by q3k »

xyquadrat wrote: post #71
q3k wrote: post #63

Earlier quoted context omitted.

> SCION right now provides the backbone for the Swiss financial network moving 200 billion CHF each day This is a meaningless benchmark - for a small group of trusted big enterprises with insurance policies and mutually signed contracts you could've just as well used OSPF with zero filters. The benchmark would be adoption by an actual large number of parties that don't/can't talk to eachother spread across the world.…

I'm not claiming that this shows SCION can replace the respective parts of the network stack right now, and you're right that at a global scale this is still an unproven technology. But I would argue that a technology needs a certain level of matureness / is not "snake oil" if it is deployed in a heavily regulated and comparatively conservative sector such as banking.

Aren't heavily regulated sectors the one where you usually encounter snake oil? Useless WAFs and other security snake oil products, Microsoft 'collaboration' jank like Teams and Sharepoint, MitM proxies, etc?

Re: Is BGP safe yet?

#85

Post by raron »

xyquadrat wrote: post #71
q3k wrote: post #63

Earlier quoted context omitted.

> SCION right now provides the backbone for the Swiss financial network moving 200 billion CHF each day This is a meaningless benchmark - for a small group of trusted big enterprises with insurance policies and mutually signed contracts you could've just as well used OSPF with zero filters. The benchmark would be adoption by an actual large number of parties that don't/can't talk to eachother spread across the world.…

I'm not claiming that this shows SCION can replace the respective parts of the network stack right now, and you're right that at a global scale this is still an unproven technology. But I would argue that a technology needs a certain level of matureness / is not "snake oil" if it is deployed in a heavily regulated and comparatively conservative sector such as banking.

Why does a routing protocol matter for the banking sector? With proper encryption the route the packets of transaction data takes should not matter at all.

Re: Is BGP safe yet?

#86

Post by sureglymop »

surround wrote: post #83
icedchai wrote: post #80

Earlier quoted context omitted.

Once you have control of the destination, you could get a valid SSL certificate with Letsencrypt or whatever.

Wow I'm surprised, you're right, and it has happened before: > the attacker issued and registered a free temporary 3-month certificate for the developers[.]kakao.com domain through SSL certificate issuer called ZeroSSL. Because the routing policy was already manipulated by the BGP Hijacking, the attacker was able to register the certificate. https://medium.com/s2wblog/post-mortem-of-klayswap-incident-...

You could mitigate this by monitoring certificate transparency logs for unwanted certificates issued for your domain.

Currently there are no good monitors though aka the system is a bit broken.

Re: Is BGP safe yet?

#87

Post by gerdesj »

rot256 wrote: post #76
hugo1789 wrote: post #70

Earlier quoted context omitted.

I think RPKI is good enough. As we have TLS on top it doesn't need to be perfect.

For LetsEncrypt, routing is authentication: if packets routed to the IP in the A record end up at your place, you can get a cert for that domain.

DNSSEC and DNS-01 challenges might do the trick at the cost of significant effort, provided LE could be directed to check, similar to the way MTA-STS works.

Re: Is BGP safe yet?

#88

Post by pigggg »

xyquadrat wrote: post #71
q3k wrote: post #63

Earlier quoted context omitted.

> SCION right now provides the backbone for the Swiss financial network moving 200 billion CHF each day This is a meaningless benchmark - for a small group of trusted big enterprises with insurance policies and mutually signed contracts you could've just as well used OSPF with zero filters. The benchmark would be adoption by an actual large number of parties that don't/can't talk to eachother spread across the world.…

I'm not claiming that this shows SCION can replace the respective parts of the network stack right now, and you're right that at a global scale this is still an unproven technology. But I would argue that a technology needs a certain level of matureness / is not "snake oil" if it is deployed in a heavily regulated and comparatively conservative sector such as banking.

I gotta say some of the proposed use cases are things no one is looking/asking for. One I recall was having a network decide to reach another network by avoiding countries that aren't carbon neutral (which could take longer hops and use more infra / more energy...) feels like they're trying to say they're the green/environmental friendly protocol.

Re: Is BGP safe yet?

#89

Post by fanf2 »

gerdesj wrote: post #87
rot256 wrote: post #76

Earlier quoted context omitted.

For LetsEncrypt, routing is authentication: if packets routed to the IP in the A record end up at your place, you can get a cert for that domain.

DNSSEC and DNS-01 challenges might do the trick at the cost of significant effort, provided LE could be directed to check, similar to the way MTA-STS works.

Let’s Encrypt has been doing DNSSEC validation for years. DNSSEC could have prevented the jabber.ru MITM attack.

Re: Is BGP safe yet?

#90

Post by pocksuppet »

RPKI and ASPA keeps you safer from other networks, but less safe from the registries. Consider what happens if your registry's country sanctions your country and you are unable to update any records held at the registry.
Post reply on HN