3 ms·
I don't see how this resolves BGP hijacking attacks? If I announce a more specific route all four locations should still land on my hijacked network... Or is th
by spydum 7y ago
I don't see how this resolves BGP hijacking attacks? If I announce a more specific route all four locations should still land on my hijacked network... Or is this trying to race the BGP propagation?
- jaas 7y agoIt doesn't "resolve" BGP attacks. The point is an attacker would have to pull off three or four successful attacks at once, which is harder than pulling off just one, especially if they hope to go unnoticed.
- tialaramex 7y agoOr of course for smaller targets their attack is just much closer to the target than to any of the multiple viewpoints, and so this mitigation makes no difference to them whatsoever. We shall see how well this works in practice. Assuming it's relatively cheap it's harmless to at least try.
- mittalprat 7y agoIf the domain is hosted on a /24, then more specific routes will be filtered out by default in most ASes. Also, with the increasing adoption of RPKI, in conjunction with its maxlength option, more specific attacks will be a challenge for adversaries.
- mike_d 7y agoIf you announce a matching /24 it will fall back to shortest distance. If the original network has a long AS path, you can still hijack from a moderately well connected network.