4 ms·
If BGP is open and anybody can modify routes, why don't these attacks happen constantly? What prevents these sort of attacks and how are they fixed?
by nodesocket 8y ago
If BGP is open and anybody can modify routes, why don't these attacks happen constantly? What prevents these sort of attacks and how are they fixed?
- notyourday 8y agoIt is not open. Sane networks register prefixes. Other sane networks do not accept prefixes that are not registered to parties announcing them. If your network does not register prefixes, you need to fire them and move to someone else. If your network does not accept only registered prefixes, you need to fire them and move somewhere else. Not registering prefixes/filtering based on registrations is having sex without condoms with a toothless hooker behind a dumpster who charges $5 for a full service.
- zero_intp 8y agoThis comment is only partially true, the realities of managing customers on routers with thousands of routes precludes this careful management at the rock bottom tier-1 transit prices of the lowest common demoninators. The way HE & Cogent operate for large web-hosters at data centers is by trust and prefix-counts. The churn of various web-operators between hosting companies is massive.
- notyourday 8y agoDid not Cogent pioneer massive use of multihop BGP to do prefix filtering outside the low powered edge in the nineties?
- zero_intp 8y agoStarting in 2000, yes.
- codetrotter 8y agoJust guessing here but it’s only open to the companies and countries that are peering with one another isn’t it? If so then companies that intentionally advertise routes that are not theirs to advertise would lose their peering agreements with others because other companies would no longer want to peer with them.
- noselasd 8y agoThere's an informal trust chain. You only set up BGP peering with companies you trust, and you implement filtering of it's traffic and advertised routes that you know can be trusted. You know that if you do something nefarious, or if someone at your downstream does something nefarious, your upstream will identify it and block your traffic, or the part of it that they identify to be the issue. Thus as long as you need to appear on the internet, you do your best to play nice, otherwise your traffic gets blocked, and you also do your part to identify and block traffic when something goes bad.
- nodesocket 8y agoSo if BGP is trust based and hard to compromise then how were these Russians able to? > They re-routed DNS traffic using a man in the middle attack using a server at Equinix in Chicago.
- notyourday 8y agoBecause large networks do not register all their prefixes or enforce policies on what they accept from other large networks. So a large network can do this. Allowing a small network to do this demonstrates incompetence. Frankly, I am having a hard time believing that HE.NET failed that badly. AS7007 incident demonstrated this being a bad idea in the nineties.
- pyvpx 8y ago> Frankly, I am having a hard time believing that HE.NET failed that badly. Believe it. HE has many, many netiron-based routers in their network and many, many ASNs as transit customers. the hardware doesn't have the capacity to implement complete filtering for everyone. between hardware-constrained equipment being replaced and the tireless work Job Snijders (& others) are doing with route security, these kinds of episodes will become far more difficult and occur much, much less.
- notyourday 8y ago