10 ms·
Is BGP Safe Yet?
- eastdakota 7y agoMore details on the problem of BGP hijacking and how the IsBGPSafeYet.com test was implemented: https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-security-initiative/ https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-sec...
- eastdakota 7y agoAlso Wired story: https://www.wired.com/story/cloudflare-bgp-routing-safe-yet/ https://www.wired.com/story/cloudflare-bgp-routing-safe-yet/
- toomuchtodo 7y agoLove this effort. [EDIT: Removed poorly thought out idea]
- deleted 7y ago[deleted]
- ocdtrekkie 7y agoI would discourage this approach. Internet spam-generating campaigns aren't really an effective way of creating change, and the poor employee required to read the emails at that contact address is probably not responsible for the decisions holding up implementation. Which is to say: Please don't advocate for behaviors that harass line employees at corps you don't like.
- eastdakota 7y agoAgree. Mentioning them on Twitter is one thing. Harassing NOCs already stressed during this time of unprecedented Internet usage is another.
- deleted 7y ago[deleted]
- toomuchtodo 7y agoPoint taken. Please excuse the over exuberance during uncertain times.
- deleted 7y ago[deleted]
- bifrost 7y agoThis has already been done by William Leibzon, its a bad idea and for the most part everyone despises him now.
- tptacek 7y agoIt would be interesting to read more about the problems with RPKI. The set of organizations that need to implement RPKI to make it effective is pretty small, and yet it's been a long slog to get it even to this point. It's not like network engineers at Google, Comcast, and Verizon are unfamiliar with it. What's going wrong?
- corndoge 7y agoThe same thing that's going wrong with IPv6 adoption. Edit: It's true. RPKI works, it's just harder to use than not using it, and network engineers have been doing bgp without rpki since forever. Managing PKI is outside the scope of a Cisco flat file and so it's not getting done. Route maps are easier to write than managing PKI. In the same vein IPv4 networks work and have been done since forever and as long as it's easier to shim over your v4 core and do carrier NAT and memorize dotted quads v6 will not get done with haste.
- job 7y agoI've made an actual study of implementing RPKI's outcome in the route-map language, and its not pretty: https://github.com/job/rpki-ov-route-map https://github.com/job/rpki-ov-route-map I recommend using RTR and native origin validation, not to depend on the route-map language to accomplish the task ;-)
- eastdakota 7y agoThe excuse used to be there wasn’t adequate tooling. That’s changed over the last 18 months. See, for example, the open source GoRTR tool our team released: https://github.com/cloudflare/gortr https://github.com/cloudflare/gortr And the fact that major ISPs with complex networks like AT&T, NTT, and Telia have implemented it proves it’s possible.
- q3k 7y agoCertainly ARIN being weird [1] and not allowing to distribute their TAL (~CA cert, but for RPKI ROAs), or resulting RPKI data freely doesn't help. [1] - https://www.arin.net/resources/manage/rpki/rpa.pdf https://www.arin.net/resources/manage/rpki/rpa.pdf
- Bluecobra 7y agoI would argue that for BGP to be safe, all ~68,000 autonomous systems will need to embrace RPKI, not just a handful of ISPs/telcos/CDNs. Akamai is announcing ~2,300 prefixes, shouldn’t they use RPKI?
- eastdakota 7y agoYes, though it’s a bit like if every airline implemented an accurate COVID-19 health check. You’d still have local problems, but the infection would keep from spreading worldwide. In the case of BGP, if the major transit providers properly filter routes, hijacks do much less damage to the broad network.
- dsl 7y agoHow are you verifying compliance? It looks like to pass the test all I need to do is implement filtering on my interconnects with Cloudflare (or just drop 103.21.244.0/24 entirely). To your example, airlines could screen passengers flying out of Eastdakota Regional Airport but nowhere else.
- eastdakota 7y agoWe can always change up the bad IP range announced. But, more generally, I think the network engineers at ISPs want to implement RPKI. It’s the managers who haven’t prioritized. Hopefully this helps escalate it as a priority.
- bifrost 7y agoVery few people want to implement RPKI, those that are doing it either are really hot for it or are being forced to do it.
- lordleft 7y agoI have no comment re: the actual campaign but I find the site wonderfully clean.
- devmunchies 7y agogoing on a tangent here... I looked at the stylesheet (https://isbgpsafeyet.com/index.css?v=24 https://isbgpsafeyet.com/index.css?v=24) and saw things like `border-top-color: currentColor;` and other variables used in plain CSS that I didn't even know you could do.
- rodiger 7y agoLooks like all the animations were keyframed manually, pretty sweet!
- adamschwartz 7y ago(Designer here) YES! `currentColor` is amazingly useful and supported everywhere https://caniuse.com/#feat=currentcolor https://caniuse.com/#feat=currentcolor
- amelius 7y agoIt seems to me that trust is not a global thing. If A trusts B then that does not mean that C would also trust B. Does the protocol capture that principle?
- tialaramex 7y agoA PKI provides us with a globally trusted answer about identity only. If there is no global consensus about identity then you don't actually have a network. If you don't agree that this is news.ycombinator.com and believe instead it's 4chan or Reddit, then the Web PKI can't help you, and "improving" the Web PKI to some people decide this is Apple and others that it's PornHub is pointless. If you want other names, go build your own network. In RPKI the identities aren't DNS names like in the Web PKI they're number resources - IP addresses and Autonomous System numbers. Again though, if you can't agree with everybody else about global identity you can't participate in the network. If you believe maybe 1.1.1.1 is the IP address of your PC and everybody else thinks it's a distributed DNS service run by Cloudflare, there's no purpose to trying to allow us to "agree to disagree". We're right, and you're wrong, go away. Having global agreement about identity doesn't magically mean we all agree on who to trust, just because I agree with you that Reddit is Reddit, doesn't mean I agree about how much faith to put in a post you saw there.
- AnotherGoodName 7y agoNo it doesn't. I remember the first time i setup a rack of servers in a cage in a datacenter for a company i founded. We bought a block of IPs in bulk and then we bought an interconnect from a provider within the datacenter. To get those IPs pointing to our server we had our severs announce ownership over BGP. It's that easy. Usually BGP messages are filtered out by routers. Otherwise home users would announce ownership of the Google addresses and have all those messages come to them for example. But if you have access to an interconnect in a datacenter you can state you own whatever IP addresses you want. There's really nothing at all stopping it right now.
- icedchai 7y agoMany upstream transit providers have route filters in place. They won't accept any route, like they did in the 90's. Some still do, of course. Also, normally you have your router announce routes over BGP, not your servers.
- strbean 7y agoI remember doing an IP range scan with nmap from an EC2 instance in the early days, and finding a bunch of exposed BGP routers. I wonder how vulnerable they were.
- bifrost 7y agoTLDR; Not very unless they were general purpose operating systems vs network operating systems.
- thoraway1010 7y agoThis is actually a very very powerful idea. The trick is to get something VPs / "Decision Makers" can use to make decisions that's easy for them to digest especially if they are not technically sophisticated. This meets that criteria. They should add microsoft azure to this list. This could absolutely become an RFP requirement / preference point for a lot of compliance focused / not only tech focused buyers (govt / large agencies and companies) A huge thumbs up!
- DyslexicAtheist 7y agothe most promising replacement is the SCION[1] project. See section "Authentication and PKI"[2]. It's already used by SwissCom and another CH based ISP. It can do path selection, geo-fencing, and traffic shaping. Really cool DDoS mitigation[3] as well. It has been previously discussed on HN[4]. [1] https://www.scion-architecture.net/ https://www.scion-architecture.net/ [2] https://www.scion-architecture.net/pages/publications/ https://www.scion-architecture.net/pages/publications/ [3] https://news.ycombinator.com/item?id=21546214 https://news.ycombinator.com/item?id=21546214 [4] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=SCION%20project&sort=byPopularity&type=all https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
- bifrost 7y agoI'm not sure thats truly "promising" in any sense :)
- rodiger 7y agoWow the diagrams are really well done here. Really well-made and presented.
- imagine99 7y agoYes, they look really great and responsive, too. I'd actually like to know how they were done... Are they just basically coded by hand or is there a visual tool you can use to design interactive graphical stuff like this in what I guess is HTML5/CSS/maybe JavaScript, similar to (dare I mention the word) Flash in the olden days? (Sorry, haven't done any web development in decades, obviously :-)).
- adamschwartz 7y agoYup, they were coded by hand! Here was the initial commit which added the first diagram (originally there was only one): https://git.io/JfJ4K https://git.io/JfJ4K
- job 7y agoa really cool way to explain RPKI, thanks for sharing!
- neurostimulant 7y agoIt's basically animating SVG with CSS, which is very neat. Not using js at all except to toggle some class names when you click the button.
- adamschwartz 7y agoIt’s really just using CSS to animate regular HTML elements. SVG is used for the icons (the laptop, server, cloud), but the grid lines, connection lines, and packet animation are all just plain `<div/>`s :P But you’re totally correct about the JS only toggling between path="happy" and path="sad"
- joan_kode 7y ago
- Liblor 7y agoA professor at my University mentioned that when he was a student, the professors at that time claimed that the security of BGP is a solved problem and nobody is going to talk about it in ~2 years. This was +20 years ago. He has spent a lot of his research on an alternative for BGP called SCION[1], as the adaption of BGPSec is not very straight forward and rather an ugly fix. I think it is pretty interesting that the problems of BGP are not discussed more widely and often. [1] https://www.scion-architecture.net/ https://www.scion-architecture.net/
- bifrost 7y agoThere has been tooling for generating proper route filtering for quite some time now, the problem is virtually nobody uses it.
- cachestash 7y agoI worked for a big European network vendor and ended up on a project trying to sort out the utter mess that is legacy SS7. SS7 networks are basically wide open, with no auth and anyone can get an SS7 hub for cheap and start sending nefarious commands to peoples handsets. They can forward or record calls and read SMS. They can track you or they could just be a jerk and keep rebooting your phone. Worse still it can be used to intercept 2FA codes over SMS, which is the approach a lot of banks are taking for personal account security. intelligence agencies are without a doubt using it for intercepting and tracking. The Telcos are lost with how to address the issues combined with cost considerations, so most are taking the approach of hoping it stays out of the news and waiting for it to eventually be deprecated from the network.
- daxfohl 7y agoDoes this solution apply to private networks? I learned first hand how dangerous it can be when I brought down our datacenter with an accidental BGP announcement.
- kitteh 7y agoYou can do this. I know a few large well know networks which have suffered from internal BGP hijacks within their data centers from different business units stepping on each other. You can either try to implement via strict route policies or try to do RPKI.
- notaplumber 7y agoOpenBSD just released a portable version of their privsep rpki-client(8)* this week! https://www.rpki-client.org/ https://www.rpki-client.org/ rpki-client 6.6p1 was released Apr 13, 2020: https://www.rpki-client.org/txt/rpki-client-6.6p1.txt https://www.rpki-client.org/txt/rpki-client-6.6p1.txt * https://man.openbsd.org/rpki-client https://man.openbsd.org/rpki-client Looks like there may be problems with the mirror sites, a generated tarball is on the official portable github, but it may be worth waiting for an official announcement as github can re-roll these (it's not an uploaded release asset): https://github.com/rpki-client/rpki-client-portable/releases https://github.com/rpki-client/rpki-client-portable/releases
- job 7y agoplease check back in a few days, we are almost there. you can also work with https://github.com/rpki-client/rpki-client-portable https://github.com/rpki-client/rpki-client-portable currently runs on a bunch of systems! coming to packages in the popular formats close to you soon!
- notaplumber 7y agoThanks for the update!
- jamieweb 7y agoFor those who don't have their own Autonomous System, but want to play with RPKI validation, you can join DN42 [1] and validate routes there. Netravnen kindly provides a route export compatible with GoRTR and Routinator [2], which has been working nicely for me. [1] https://dn42.us https://dn42.us [2] https://github.com/netravnen/dn42-roa-export https://github.com/netravnen/dn42-roa-export
- stallmanite 7y agoThis is really frickin cool thanks for sharing it.
- rsync 7y agoHrm... I have been a huge fan of Hurricane Electric (he.net) for over ten years and have done a lot of evangelizing ... rsync.net uses he.net pops all over the world (except for Zurich, where we use init7...). They have been very progressive, clueful and efficient in all of our dealings with them. So I am surprised to see them marked unsafe. I have emailed my point of contact there and asked for some explanation - perhaps I can update this comment in a bit ...
- bsder 7y agoA startup company that several of my friends worked at many years ago had boxes that continuously monitored routing around that would and would flag and delay BGP updates that caused a significant topological change. They could be added manually immediately, or would be implemented with a delay after they had enough data that the route was legitimate. My ISP had one of these boxes and was quite proud of it. It worked really well against BGP idiocy. It might not have worked against a concerted attack, but it did stop several of the "Ooops. All the routes are belong to us." problems that seem to be the "normal" BGP "attacks". I am surprised that these big players don't already have something that does something similar.
- aspenmayer 7y agoOf course they do have such equipment, which makes you wonder how sophisticated the attacks are and now flimsy the security is. It’s obvious that this equipment exists. How else would the equipment in the same or likely next room over [0] know the state of packets that need further routing adjustments? Maybe the relevant parties didn’t get the message because the call was coming from inside the building. [1] [0] https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A [1] https://tvtropes.org/pmwiki/pmwiki.php/Main/TheCallsAreComingFromInsideTheHouse https://tvtropes.org/pmwiki/pmwiki.php/Main/TheCallsAreComin...
- topranks 7y agoI’m not so sure. The internet community (I.e. routing guys/Nanog/ietf etc) is fairly open. I’ve not heard much of such approaches being used. It is a very interesting idea.... I guess you gotta weight delaying inserting an update with potentially blackholing a destination until you do.
- surround 7y agohttp://isThisYourPaperOnSingleServingSites.com/ http://isThisYourPaperOnSingleServingSites.com/
- aspenmayer 7y agoThank you for this link. I really appreciate this kind of meta-commentary on the recent trend of single purpose sites. It would be easy to dismiss them, but they’re as much a part of the web as any other content a browser can render. It’s a sign of a mature platform when you have trends and norms while also admitting outliers and oddities.
- larkster 7y agoSemi-tangential, but an interesting alternative to RPKI that uses blockchain: https://ieeexplore.ieee.org/abstract/document/8751229 https://ieeexplore.ieee.org/abstract/document/8751229
- moondev 7y agoWhat is the barrier of entry for an individual or company to obtain a public ASN and theoretically announce a nefarious route? Would it come down to an irresponsible ISP blindly trusting the bad router? It does seem important for not putting this burden on each ISP, just trying to understand the scope of all this.
- ShakataGaNai 7y agoGetting a public ASN is relatively trivial. If you're curious, you can read more about it here: https://www.arin.net/resources/guide/request/ https://www.arin.net/resources/guide/request/ As for whats stopping the announcement of bad routes? Mostly just the ISPs, the big transit providers, and the IX's. The problem isn't the small users. You, as a nefarious individual, are unlikely to be able to cause much real damage. In datacenters where you don't bring your own dedicated transit (expensive), you have to tell them your ASN and IP information so it gets whitelisted. The problem is large players. If China Telecom wants to claim Google's IPs... well the entire world's transit providers may not acknowledge that - but enough will to cause a real problem. More examples: https://en.wikipedia.org/wiki/BGP_hijacking#Public_incidents https://en.wikipedia.org/wiki/BGP_hijacking#Public_incidents
- moondev 7y agoThank you for the detailed reply, exactly what I was looking for and very interesting!
- joan_kode 7y agoI was playing around with this, and it seems the entire section "What's a BGP hijack?" totally disappears on smaller screens. Is this intended? Seems like a pretty important section!
- shifty1 7y agoInteresting response to this by UK ISP Andrews & Arnold: https://www.aa.net.uk/etc/news/bgp-and-rpki/ https://www.aa.net.uk/etc/news/bgp-and-rpki/
- topranks 7y agoI love the way they basically say they are gonna do their own assessment and won’t roll in behind the consensus on RPKI. Like the trend-setting industry leaders they are. They deserve to be called out for this. It’s not hard to implement RPKI. Only valid excuse is if your routers don’t support it. Signing ROAs is trivially easy in the RIPE region. Why haven’t they done so before the pandemic??? Wasting time with this response instead isn’t maybe the best use of their time.
- topranks 7y agoWhile RPKI is great, saying BGP will be “secure” once it’s deployed is not true. It’ll be more secure, sure. But RPKI only addresses origin validation, not path validation. It won’t stop me announcing your space spuriously provided it has your AS as the origin. Path-validation a la BGPSEC would be needed to stop that. But that’s an extremely difficult problem to solve given the amount of churn in the global routing table. The amount of crypto validation routers would need to do is prohibitive. And Moore’s law doesn’t help because as CPU power goes up so do the key sizes we need to use. Either way people should implement RPKI, or at least sign ROAs for their space. It’s easy to do and makes a bit improvement.
- kmod 7y agoIt's interesting to note that the Bitcoin ecosystem depends on BGP being secure
- xyzte 7y agoAnother RPKI tool: https://rtrlib.rpki.net/ https://rtrlib.rpki.net/ allows to fetch RPKI data from a cache server. using the rtrclient, which is part of the package, you can export ROAs to any format.