Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is BGP safe yet?

isbgpsafeyet.com

Post reply on HN
Print view View original

91–98 of 98 posts

Re: Is BGP safe yet?

#91

Post by pocksuppet »

ifwinterco wrote: post #82

Ironic this is from Cloudfare, probably the single entity most likely to be responsible for breaking the internet in 2026

That's just how entrepreneurship is done these days. You aim to mislead the public in ways that benefit you, and somehow it actually works. If RPKI benefits you, you roll out a campaign that RPKI is great and necessary for internet safety. If you want to know all your users' real names, you roll out a campaign that age verification via identity document is needed to keep children safe on the internet. If your company sells separate measles, mumps and rubella vaccines, you roll out a campaign that the combined MMR vaccine makes children autistic. If your company sells weapons, you roll out a campaign to subsidize movies and video games that portray war as awesome and manly. If your company sells cigarettes but only men are buying them, you roll out a campaign that sells the freedom to smoke as a benefit of feminism. All of these things actually happened.

Re: Is BGP safe yet?

#92

Post by pocksuppet »

commandersaki wrote: post #9

I think the test for BGP is Safe is when we stop using it and instead use SCION: https://en.wikipedia.org/wiki/SCION_(Internet_architecture) .

When we abandon prefix routing based on I-told-you-so and start using Yggdrasil (https://yggdrasil-network.github.io/) we're safe.

Re: Is BGP safe yet?

#93

Post by pocksuppet »

surround wrote: post #83
icedchai wrote: post #80

Earlier quoted context omitted.

Once you have control of the destination, you could get a valid SSL certificate with Letsencrypt or whatever.

Wow I'm surprised, you're right, and it has happened before: > the attacker issued and registered a free temporary 3-month certificate for the developers[.]kakao.com domain through SSL certificate issuer called ZeroSSL. Because the routing policy was already manipulated by the BGP Hijacking, the attacker was able to register the certificate. https://medium.com/s2wblog/post-mortem-of-klayswap-incident-...

And another one: https://notes.valdikss.org.ru/jabber.ru-mitm/

Re: Is BGP safe yet?

#94

Post by icedchai »

pocksuppet wrote: post #93
surround wrote: post #83

Earlier quoted context omitted.

Wow I'm surprised, you're right, and it has happened before: > the attacker issued and registered a free temporary 3-month certificate for the developers[.]kakao.com domain through SSL certificate issuer called ZeroSSL. Because the routing policy was already manipulated by the BGP Hijacking, the attacker was able to register the certificate. https://medium.com/s2wblog/post-mortem-of-klayswap-incident-...

And another one: https://notes.valdikss.org.ru/jabber.ru-mitm/

It sounds like that one may have been the result of a "lawful intercept", so perhaps not necessarily BGP hijacking. If you have legitimate control of the ASN/network, it's not a hijack.

Re: Is BGP safe yet?

#95

Post by greyface- »

pocksuppet wrote: post #90

RPKI and ASPA keeps you safer from other networks, but less safe from the registries. Consider what happens if your registry's country sanctions your country and you are unable to update any records held at the registry.

Registries have always had the ability to revoke number assignments; RPKI just makes this revocation slightly more forceful. You're going to have a bad time announcing prefixes that don't belong to you, even in the absence of RPKI.

We're all internetworking at the pleasure of IANA. Getting them out of the picture, and removing their ability to deplatform Internet participants, is a much larger task than just moving away from RPKI. We'd need to completely rethink how ASN and IP assignments are done.

Re: Is BGP safe yet?

#96

Post by genuineDSD »

dsr_ wrote: post #17
wussboy wrote: post #14

Earlier quoted context omitted.

Why hasn't this happened?

Because BGP works, is understood, and has been debugged by thousands of people and billions of sessions between dozens or hundreds of implementations. So the benefit of changing out all that infrastucture needs to be much higher than the cost.

You are right. And it'd be absolutely irresponsible to expect _everybody_ to drop things on the floor and adopt a new protocol (implementation) over night.

However, it'd be equally irresponsible to ask for an innovation budget of 0 percent. The reason one bothers with new approaches is, of course, that fixing things on a conceptual level prevents many of the debugging sessions that you had to go through with the old approach. Why QUIC if there is TCP/TLS/HTTP?

IPv4 and NAT are literally _everywhere_. It's tested and well-understood (one would think). But—and that's just my opinion—I sure hope that, one day, we will not have to deal with that mess no more ...

Re: Is BGP safe yet?

#97

Post by pocksuppet »

greyface- wrote: post #95
pocksuppet wrote: post #90

RPKI and ASPA keeps you safer from other networks, but less safe from the registries. Consider what happens if your registry's country sanctions your country and you are unable to update any records held at the registry.

Registries have always had the ability to revoke number assignments; RPKI just makes this revocation slightly more forceful. You're going to have a bad time announcing prefixes that don't belong to you, even in the absence of RPKI. We're all internetworking at the pleasure of IANA. Getting them out of the picture, and removing their ability to deplatform Internet participants, is a much larger task than just moving a…

Registries have tended to leave existing registration data alone in case of a situation like sanctions. They won't let you register more numbers, nor will they deregister them. If you just need the numbers, that's fine. If you also depend on the registry regularly taking data updates from you, that's a problem.

Re: Is BGP safe yet?

#98

Post by flipped »

foobiekr wrote: post #23
NewsaHackO wrote: post #13

> A BGP hijack occurs when a malicious node deceives another node, lying about what the routes are for its neighbors. Without any security protocols, this misinformation can propagate from node to node, until a large number of nodes now know about, and attempt to use these incorrect, nonexistent, or malicious routes. But with HTTPS, they wouldn't be able to actually pose as another website, just delay/black hole the…

BGP attacks have nothing to do with spoofed peers. They have to do with accepted peers behaving maliciously in terms of the AS Paths they advertise. Once you control BGP you control any IP and can subvert certificate issuance that effectively uses IP to validate certificate issuance requests. For example anything that relies on a file or dns at a specific IP. Once you have done so, you ARE the site, no matter what HS…

> certificate pinning (dangerous)

Dangerous how? Create a CAA record which pins your CA and only allow dns01 challenge. Problem solved, a BGP hijack can't issue a valid certificate for your site.

Post reply on HN