Threat Level: green Handler on Duty: Johannes Ullrich

SANS ISC: Internet Storm Center - SANS Internet Storm Center Internet Storm Center


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Latest Diaries

BGP Hijacking: The Internet is Still/Again Broken

Published: 2017-04-27
Last Updated: 2017-04-27 14:25:14 UTC
by Johannes Ullrich (Version: 1)
1 comment(s)

The Internet is a network of networks. Each "Autonomous system" (AS) connects to the internet using a router that "speaks" the Border Gateway Protocol (BGP) to disseminate and receive routing information. The problem is that there is no authoritative way to figure out who is supposed to receive which IP address space (no, "whois" information is not authoritative). If I got a new IP address range assigned, or if I agree to route it as part of an agreement with another network, then I will use BGP to advertise this to the Internet. Sadly, nobody has figured out yet how to validate these advertisements. There are many proposals, but none of which has the necessary traction right now. 

As a result, it is somewhat common for BGP abused to advertise IP addresses that an organization doesn't actually own. This can lead to a denial of service, or miscreants can start using it for a man-in-the-middle attack. BGPMon, a company that monitors BGP traffic for anomalies, just yesterday discovered how part of a netblock assigned to VISA was re-routed to Rosetelecom, a large Russian telecom provider. This may not be entirely the fault of Rosetelecom. Any of its customers could have sent the announcement. Of course, Rosetelecom should have noticed this as well.

So in short, what can you do about it?

1 - The internet is an untrusted network. Deal with it. Assume people are rerouting, eavesdropping and manipulating your traffic. Technologies like TLS will help you detect these issues if properly implemented. VPNs can help to secure trusted connections within an organization or between trusted partners. But this is exactly why you have to audit these configurations and make sure they are configured based on current best practices.

2 - Monitor if someone is trying to hijack IP address space you are using. Tools like BPGMon are useful to do so if you don't want to set up your own monitoring infrastructure, which is quite costly. 

3 - If you do own IP address space, and if you do manage BGP yourself, then make sure you implement the few security features that are available. BPGMon has a nice blog post about some of the options [2] 

[1] https://bgpstream.com/event/80327
[2] https://bgpmon.net/securing-bgp-routing-with-rpki-and-roas/

---
Johannes B. Ullrich, Ph.D., Dean of Research, SANS Technology Institute
STI|Twitter|

Keywords: bgp rosetelecom
1 comment(s)

If you have more information or corrections regarding our diary, please share.

Recent Diaries

If there are some unexploited MSSQL Servers With Weak Passwords Left: They got you now (again)
Apr 26th 2017
1 day ago by Johannes (2 comments)

CAA Records and Certificate Issuance
Apr 25th 2017
2 days ago by Johannes (4 comments)

Analysis of the Shadow Z118 PayPal phishing site
Apr 24th 2017
3 days ago by Johannes (2 comments)

Malicious Documents: A Bit Of News
Apr 23rd 2017
4 days ago by DidierStevens (2 comments)

WTF tcp port 81
Apr 23rd 2017
4 days ago by Jim (6 comments)

Analysis of a Maldoc with Multiple Layers of Obfuscation
Apr 21st 2017
6 days ago by Xme (1 comment)

DNS Query Length... Because Size Does Matter
Apr 20th 2017
1 week ago by Xme (1 comment)

View All Diaries →

Latest Discussions

Curious Phishing Email
created Apr 27th 2017
9 hours ago by Rich (0 replies)

Preventing outside sources accessing the local network via open ports on a networked printer.
created Mar 28th 2017
4 weeks ago by mrectek (2 replies)

Very High DNS traffic
created Mar 26th 2017
1 month ago by Anonymous (0 replies)

Abnormal DNS Volumes
created Mar 26th 2017
1 month ago by Anonymous (3 replies)

"Insecure" technical requirements for online course?
created Mar 24th 2017
1 month ago by Marko (2 replies)

View All Forums →

Latest News

View All News →

Top Diaries

Malspam with password-protected Word documents
Mar 21st 2017
1 month ago by Brad (13 comments)

Dyn.com DDoS Attack
Oct 21st 2016
6 months ago by Johannes (9 comments)

Microsoft Patch Tuesday Delayed
Feb 18th 2017
2 months ago by Johannes (7 comments)

Distraction as a Service
Mar 25th 2017
1 month ago by Russell (6 comments)

The Side Effect of GeoIP Filters
Mar 10th 2017
1 month ago by Xme (8 comments)