5 ms·

The open trusting nature of BGP is kind of problematic isn’t it? https://en.wikipedia.org/wiki/BGP_hijacking https://en.wikipedia.org/wiki/BGP_hijacking

by riffic 9y ago

iDemonix 9y ago
I work for a medium sized ISP, we have about 500 peers over exchanges like LONAP and Linx. You'd be surprised how many of our peers won't use MD5 passwords or even filter properly.
- riffic 9y ago
  Name and shame?
  - a012 9y ago
    Probably he's still working at there, so he'd be forbidden to disclose customers name.
    - dredmorbius 9y ago
      BGP peerings are publically published, that's how they work. Knowing which customers fail to secure their comms is another matter.
      - a012 9y ago
        > Knowing which customers fail to secure their comms is another matter. Exactly what I meant.
  - maltalex 9y ago
    Bad idea. These are customers he's talking about. If you want to stay in business, naming and shaming your customers isn't a good strategy.
  - iDemonix 9y ago
    Sorry, no, I don’t really see how that contributes to the discussion.
- pas 9y ago
  They propagate a few prefixes toward you, right? So you have to filter what you accept from them, no? What mechanisms do you have for this? If it's a lookup, why it's not feasible for higher Tier ISPs?
jlgaddis 9y ago
Yes, and, to be fair, it's been a known problem for years. There are some potential solutions in the works but you can't just pick an arbitrary day and flip a switch and turn it on. Most of these incidents are accidental and could easily be prevented. The network operator community can't even get everyone to implement BCP38, though, so something like a full Internet-wide RPKI is a pipe dream. Even basic filtering would prevent much of this but that's apparently asking too much as well. The amount of filtering, if any, varies tremendously from network to network. Some won't accept routes without IRR entries, LOAs, and a bunch of paperwork. Others (such as AS31133, apparently) will accept any prefix you want and as many of 'em as you want. I'll give (some of) the Tier 1's a bit of a break, as filtering on every single BGP session just isn't feasible (although some of them wouldn't bother filtering even if they could!). Pretty much everyone else should be filtering. But they aren't. And they won't be any time soon. And so we'll continue to have incidents like this for the foreseeable future.
- pas 9y ago
  Why can't higher Tier ISPs require that each prefix they get from downstream must be recorded in some DB and do the lookup before [propagating the prefix and] installing the forwarding table entries?
  - topranks 9y ago
    They generally do for their direct end-customers who announces their own address space. The problem is when peering with other Tier 1's and large ISPs, with multiple downstream customers. How do they keep and update a list of the other ISPs customers and the routes they should expect from them? Once someone manages to get a bogus route into a large ISPs table it tends to propagate further.
maltalex 9y ago
Yes, but to be honest, it's not just BGP. One of the things that BGPMon won't tell you about since they're in the business of monitoring BGP is that the same attack is often performed by changing forwarding tables i.e. in network's data plane. An attacker compromises a router (there are known vulnerabilities and back-doors) or gains leverage over a technician authorized to configure routers in some network. The attacker then manually changes the router's local routing table to forward packets to specific destinations through a different path. In such cases, the BGP path and announcements look absolutely fine and you'd need to look at the actual path at the data plane level to detect that something is wrong. This is often done in big exchange points where many networks interconnect. These are places in which routers from major western countries can sit basically side-by-side with routers from Russia and China. This isn't a paranoid fantasy by the way, I work for a company that monitors these kinds of attacks for a living.
- skj 9y ago
  > This isn't a paranoid fantasy by the way, I work for a company that monitors these kinds of attacks for a living. Then you'll certainly be familiar with some citation or documentation of evidence? I'm curious to see some.
  - maltalex 9y ago
    I've asked around the company and unfortunately I can't talk about attacks (and/or suspicious "configuration errors") we've detected. There are legal issues involved, plus some of these cases are currently being investigated by law enforcement. Moreover, I don't know of any other company or person that deals with such attacks, so I have no one to quote. The only thing I can do is to offer some hand waving: 1. It's known publicly that nation states as well as criminal organizations are deflecting Internet routes. There are numerous reports of such cases; these cases aren't that hard to find since BGP information is (mostly) public. A few published examples: - Russian network "Rostelecom" hijacks sites of financial services: https://arstechnica.com/information-technology/2017/04/russian-controlled-telecom-hijacks-financial-services-internet-traffic/ https://arstechnica.com/information-technology/2017/04/russi... - Global Large scale BGP hijacks in 2013, some through "Rostelecom": https://arstechnica.com/information-technology/2013/11/repeated-attacks-hijack-huge-chunks-of-internet-traffic-researchers-warn/ https://arstechnica.com/information-technology/2013/11/repea... - Spammers use BGP to announce fake IP addresses to spam yahoo mail users: https://ripe72.ripe.net/presentations/45-Invisible_Hijacking.pdf https://ripe72.ripe.net/presentations/45-Invisible_Hijacking... - Traffic to UK organization that deals with nuclear weapons hijacked using BGP to the Ukraine: http://hub.dyn.com/dyn-research/uk-traffic-diverted-through-ukraine http://hub.dyn.com/dyn-research/uk-traffic-diverted-through-... - BGP hijack of bitcoin miners: https://bgpmon.net/the-canadian-bitcoin-hijack/ https://bgpmon.net/the-canadian-bitcoin-hijack/ - "Hacking Team" (Italian company selling spyware to law enforcement) helps Italian police perform BGP hijack: https://arstechnica.com/information-technology/2015/07/hacking-team-orchestrated-brazen-bgp-hack-to-hijack-ips-it-didnt-own/ https://arstechnica.com/information-technology/2015/07/hacki... - Chinese hijack of US military an governmental networks (2010): http://www.theregister.co.uk/2010/11/17/bgp_hijacking_report/ http://www.theregister.co.uk/2010/11/17/bgp_hijacking_report... 2. There are known attacks against routing protocols which aren't BGP (e.g. OSPF, Black Hat 2011) and against routers (see CVEs for CISCO IOS). 3. Routing changes that happen within an autonomous system leave a much smaller footprint compared to BGP. 4. Nation states are known to have an interest in direct access into routers: - Suspected NSA example: http://www.theregister.co.uk/2015/09/15/compromised_cisco_routers/ http://www.theregister.co.uk/2015/09/15/compromised_cisco_ro... - Suspected Chinese example: http://www.abovetopsecret.com/forum/thread350381/pg1 http://www.abovetopsecret.com/forum/thread350381/pg1 5. Network connect to each other (mainly) in central exchange points. In these exchanges networks can pay for a direct point-to-point connection from network to network, or use open peering through a layer 2 switch that aggregates connections from dozens or hundreds of different networks at once (Example: https://www.de-cix.net/en/de-cix-service-world/globepeer https://www.de-cix.net/en/de-cix-service-world/globepeer). Hundreds of networks use these switches with very little visibility. Everyone can talk to everyone else on the same switch without leaving a trace. If a router connected to such a switch is locally configured to forward traffic to some other router on the same switch, it can do so regardless of BGP routing or any common sense.

The open trusting nature of BGP is kind of problematic isn’t it? https://en.wikipedia.org/wiki/BGP_hijacking https://en.wikipedia.org/wiki/BGP_hijacking

by riffic 9y ago

The open trusting nature of BGP is kind of problematic isn’t it? https://en.wikipedia.org/wiki/BGP_hijacking https://en.wikipedia.org/wiki/BGP_hijacking

iDemonix 9y ago

I work for a medium sized ISP, we have about 500 peers over exchanges like LONAP and Linx. You'd be surprised how many of our peers won't use MD5 passwords or even filter properly.

riffic 9y ago
Name and shame?
- a012 9y ago
  Probably he's still working at there, so he'd be forbidden to disclose customers name.
  - dredmorbius 9y ago
    BGP peerings are publically published, that's how they work. Knowing which customers fail to secure their comms is another matter.
    - a012 9y ago
      > Knowing which customers fail to secure their comms is another matter. Exactly what I meant.
- maltalex 9y ago
  Bad idea. These are customers he's talking about. If you want to stay in business, naming and shaming your customers isn't a good strategy.
- iDemonix 9y ago
  Sorry, no, I don’t really see how that contributes to the discussion.
pas 9y ago
They propagate a few prefixes toward you, right? So you have to filter what you accept from them, no? What mechanisms do you have for this? If it's a lookup, why it's not feasible for higher Tier ISPs?

jlgaddis 9y ago

Yes, and, to be fair, it's been a known problem for years. There are some potential solutions in the works but you can't just pick an arbitrary day and flip a switch and turn it on. Most of these incidents are accidental and could easily be prevented. The network operator community can't even get everyone to implement BCP38, though, so something like a full Internet-wide RPKI is a pipe dream. Even basic filtering would prevent much of this but that's apparently asking too much as well. The amount of filtering, if any, varies tremendously from network to network. Some won't accept routes without IRR entries, LOAs, and a bunch of paperwork. Others (such as AS31133, apparently) will accept any prefix you want and as many of 'em as you want. I'll give (some of) the Tier 1's a bit of a break, as filtering on every single BGP session just isn't feasible (although some of them wouldn't bother filtering even if they could!). Pretty much everyone else should be filtering. But they aren't. And they won't be any time soon. And so we'll continue to have incidents like this for the foreseeable future.

pas 9y ago
Why can't higher Tier ISPs require that each prefix they get from downstream must be recorded in some DB and do the lookup before [propagating the prefix and] installing the forwarding table entries?
- topranks 9y ago
  They generally do for their direct end-customers who announces their own address space. The problem is when peering with other Tier 1's and large ISPs, with multiple downstream customers. How do they keep and update a list of the other ISPs customers and the routes they should expect from them? Once someone manages to get a bogus route into a large ISPs table it tends to propagate further.

maltalex 9y ago

Yes, but to be honest, it's not just BGP. One of the things that BGPMon won't tell you about since they're in the business of monitoring BGP is that the same attack is often performed by changing forwarding tables i.e. in network's data plane. An attacker compromises a router (there are known vulnerabilities and back-doors) or gains leverage over a technician authorized to configure routers in some network. The attacker then manually changes the router's local routing table to forward packets to specific destinations through a different path. In such cases, the BGP path and announcements look absolutely fine and you'd need to look at the actual path at the data plane level to detect that something is wrong. This is often done in big exchange points where many networks interconnect. These are places in which routers from major western countries can sit basically side-by-side with routers from Russia and China. This isn't a paranoid fantasy by the way, I work for a company that monitors these kinds of attacks for a living.

skj 9y ago
> This isn't a paranoid fantasy by the way, I work for a company that monitors these kinds of attacks for a living. Then you'll certainly be familiar with some citation or documentation of evidence? I'm curious to see some.
- maltalex 9y ago
  I've asked around the company and unfortunately I can't talk about attacks (and/or suspicious "configuration errors") we've detected. There are legal issues involved, plus some of these cases are currently being investigated by law enforcement. Moreover, I don't know of any other company or person that deals with such attacks, so I have no one to quote. The only thing I can do is to offer some hand waving: 1. It's known publicly that nation states as well as criminal organizations are deflecting Internet routes. There are numerous reports of such cases; these cases aren't that hard to find since BGP information is (mostly) public. A few published examples: - Russian network "Rostelecom" hijacks sites of financial services: https://arstechnica.com/information-technology/2017/04/russian-controlled-telecom-hijacks-financial-services-internet-traffic/ https://arstechnica.com/information-technology/2017/04/russi... - Global Large scale BGP hijacks in 2013, some through "Rostelecom": https://arstechnica.com/information-technology/2013/11/repeated-attacks-hijack-huge-chunks-of-internet-traffic-researchers-warn/ https://arstechnica.com/information-technology/2013/11/repea... - Spammers use BGP to announce fake IP addresses to spam yahoo mail users: https://ripe72.ripe.net/presentations/45-Invisible_Hijacking.pdf https://ripe72.ripe.net/presentations/45-Invisible_Hijacking... - Traffic to UK organization that deals with nuclear weapons hijacked using BGP to the Ukraine: http://hub.dyn.com/dyn-research/uk-traffic-diverted-through-ukraine http://hub.dyn.com/dyn-research/uk-traffic-diverted-through-... - BGP hijack of bitcoin miners: https://bgpmon.net/the-canadian-bitcoin-hijack/ https://bgpmon.net/the-canadian-bitcoin-hijack/ - "Hacking Team" (Italian company selling spyware to law enforcement) helps Italian police perform BGP hijack: https://arstechnica.com/information-technology/2015/07/hacking-team-orchestrated-brazen-bgp-hack-to-hijack-ips-it-didnt-own/ https://arstechnica.com/information-technology/2015/07/hacki... - Chinese hijack of US military an governmental networks (2010): http://www.theregister.co.uk/2010/11/17/bgp_hijacking_report/ http://www.theregister.co.uk/2010/11/17/bgp_hijacking_report... 2. There are known attacks against routing protocols which aren't BGP (e.g. OSPF, Black Hat 2011) and against routers (see CVEs for CISCO IOS). 3. Routing changes that happen within an autonomous system leave a much smaller footprint compared to BGP. 4. Nation states are known to have an interest in direct access into routers: - Suspected NSA example: http://www.theregister.co.uk/2015/09/15/compromised_cisco_routers/ http://www.theregister.co.uk/2015/09/15/compromised_cisco_ro... - Suspected Chinese example: http://www.abovetopsecret.com/forum/thread350381/pg1 http://www.abovetopsecret.com/forum/thread350381/pg1 5. Network connect to each other (mainly) in central exchange points. In these exchanges networks can pay for a direct point-to-point connection from network to network, or use open peering through a layer 2 switch that aggregates connections from dozens or hundreds of different networks at once (Example: https://www.de-cix.net/en/de-cix-service-world/globepeer https://www.de-cix.net/en/de-cix-service-world/globepeer). Hundreds of networks use these switches with very little visibility. Everyone can talk to everyone else on the same switch without leaving a trace. If a router connected to such a switch is locally configured to forward traffic to some other router on the same switch, it can do so regardless of BGP routing or any common sense.