3 ms·

There's an informal trust chain. You only set up BGP peering with companies you trust, and you implement filtering of it's traffic and advertised routes that yo

There's an informal trust chain. You only set up BGP peering with companies you trust, and you implement filtering of it's traffic and advertised routes that you know can be trusted. You know that if you do something nefarious, or if someone at your downstream does something nefarious, your upstream will identify it and block your traffic, or the part of it that they identify to be the issue. Thus as long as you need to appear on the internet, you do your best to play nice, otherwise your traffic gets blocked, and you also do your part to identify and block traffic when something goes bad.

nodesocket 9y ago
So if BGP is trust based and hard to compromise then how were these Russians able to? > They re-routed DNS traffic using a man in the middle attack using a server at Equinix in Chicago.
- notyourday 9y ago
  Because large networks do not register all their prefixes or enforce policies on what they accept from other large networks. So a large network can do this. Allowing a small network to do this demonstrates incompetence. Frankly, I am having a hard time believing that HE.NET failed that badly. AS7007 incident demonstrated this being a bad idea in the nineties.
  - pyvpx 9y ago
    > Frankly, I am having a hard time believing that HE.NET failed that badly. Believe it. HE has many, many netiron-based routers in their network and many, many ASNs as transit customers. the hardware doesn't have the capacity to implement complete filtering for everyone. between hardware-constrained equipment being replaced and the tireless work Job Snijders (& others) are doing with route security, these kinds of episodes will become far more difficult and occur much, much less.
    - notyourday 9y ago
      Half if not all of HE business model is to sell dirt cheap flat rate IPv4 with BGP to other companies in major carrier facilities. I find it extremely hard to believe that not filtered access to HE.NET is possible.

nodesocket 9y ago

So if BGP is trust based and hard to compromise then how were these Russians able to? > They re-routed DNS traffic using a man in the middle attack using a server at Equinix in Chicago.

notyourday 9y ago
Because large networks do not register all their prefixes or enforce policies on what they accept from other large networks. So a large network can do this. Allowing a small network to do this demonstrates incompetence. Frankly, I am having a hard time believing that HE.NET failed that badly. AS7007 incident demonstrated this being a bad idea in the nineties.
- pyvpx 9y ago
  > Frankly, I am having a hard time believing that HE.NET failed that badly. Believe it. HE has many, many netiron-based routers in their network and many, many ASNs as transit customers. the hardware doesn't have the capacity to implement complete filtering for everyone. between hardware-constrained equipment being replaced and the tireless work Job Snijders (& others) are doing with route security, these kinds of episodes will become far more difficult and occur much, much less.
  - notyourday 9y ago
    Half if not all of HE business model is to sell dirt cheap flat rate IPv4 with BGP to other companies in major carrier facilities. I find it extremely hard to believe that not filtered access to HE.NET is possible.