4 ms·

Ugh... that headline is abysmal. It's just a BGP hijack. Get over it.

• vermilingua 8y ago
  No, it’s actually quite accurate. BGP hijacks are a vulnerability in the very core fabric of the internet. Just because we’ve seen a lot of BGP hijacks recently, does not in any way, shape, or form downgrade their severity.
  • mcv 8y ago
    If it can be done once, I guess it can be done multiple times. I don't know nearly enough about this to understand how BGP hijacks work or why they are possible. Can anyone point me to a simple explanation for a layman?
    • Twirrim 8y ago
      BGP is a gossip protocol. BGP roughly works like this: As BGP nodes come online, they establish connections with "nearby" existing BGP nodes, saying what version and how frequently they'll check in, and what their AS number is (a unique identifier) Once communications have been established, then they can start to report any network routes they know about. "I'm AS 123456, and I am the originator for 3.0.0.0/0" (i.e. they're responsible for it), "Also, I can reach 4.0.0.0/8 with a cost of 6" (A fair number of hops away on the network). Any neighbouring BGP peers update their routing table: "AS 123456 is responsible for 3.0.0.0/8, and I can reach it with a cost of 1, and I can also reach 4.0.0.0/8 with a cost of 7 via AS 123456". If there's a cheaper route to a network address, no changes will happen. Routing changes can propagate quite quickly across the internet. The routing protocol is nice and lightweight, and updates are happening with reasonable frequency, as network connections come and go. The idea is that should damage occur to the network fabric, the network will automatically update and route around it, without need for any intervention. It's entirely built on trust, though. You have to trust that AS 123456 is indeed actually responsible for 3.0.0.0/8. If you get two parties indicating responsibility for a network range, it's possible to end up with routing loops etc, as things get in to a mess. What is legitimate behaviour, though, is for, say, AS 123456 to be the originator for 3.0.0.0/8, and another AS be the originator for 3.0.1.0/24 (i.e just 254 addresses under that space). That's not an unusual situation, and it won't cause routing issues, because more specific is taken as a priority over less specific, rough analogy: "In general mail for General Electric, should be sent here, but if it's for the electronics product division, send it straight to them" There have been different attempts to put filtering in place, provide authentication "Yes, AS 123456 is allowed to be responsible for 3.0.0.0/0" and the like, but nothing has really taken off.
      • mcv 8y ago
        Sounds like a bad actor could easily attract as much traffic as they wanted by claiming to have the shortest route to all sorts of places. With different data snooping/data protection policies in various countries, it would also be useful if you could order your traffic to avoid certain countries.
        • Twirrim 8y ago
          Absolutely. ISPs, backbone providers etc can all manually filter out updates from specific ASs, and in theory habitual bad actors will have that happen to them. Filters will get put in place even as a temporary measure during incidents sometimes, depending on how responsive / capable the NOC is.
  • NelsonMinar 8y ago
    What's particularly maddening is BGP hijacks have been happening for well over a decade. It's one of the weakest parts of the Internet infrastructure and I'm convinced something more disastrous is going to happen any time now, either by accident or malice.