3 ms·

If you've worked in the industry, you know you can get a BGP uplink these days with bare minimum IRR source validation with only a signature on a contract (not

If you've worked in the industry, you know you can get a BGP uplink these days with bare minimum IRR source validation with only a signature on a contract (not even payment is required to turn up generally). Using this, you can advertise any IP prefix you want. Since a lot of providers advertise /23+ as well, if you hijack the /24, you will always be the BGP best path and will be able to accomplish a full internet-wide hijack. Of course, the task requires a few weeks of planning and execution, but that doesn't stop it from being possible. If you are a nation-state, you already have all of the above, and nobody to hold you accountable for using it.

ryanlol 6y ago
> Of course, the task requires a few weeks of planning and execution, but that doesn't stop it from being possible. Few weeks? With most providers you can get this done within 24h from the initial email to sales@
- iscoelho 6y ago
  Getting the colocation, hardware, BGP uplink, and the creativity involved in not using your identity at all & minimizing (or eliminating) expenses. Possible, but it'll take a few weeks.
  - ryanlol 6y ago
    You don’t need any of those things, you can just rent a dedicated server (perhaps even a VPS) and send over a LoA and have the host route the IPs to your box. I’ve never had to deal with colo or think about hardware to have my IPs announce.
    - iscoelho 6y ago
      Generally the reason an attacker would do those things is because their hijacks will last much longer due to lack of an abuse department and victims having to contact upstreams. Shorter ASPath, planning which Tier 1/2 is the best to hijack from, and lack of LOA requirement or RPKI. If an attacker wants to do this - they don't want to "just" cause damage. This is a limited opportunity. They want to do it right, and that takes planning. I do agree that your idea is possible, but I don't think it captures the full severity of the issue.

ryanlol 6y ago

> Of course, the task requires a few weeks of planning and execution, but that doesn't stop it from being possible. Few weeks? With most providers you can get this done within 24h from the initial email to sales@

iscoelho 6y ago
Getting the colocation, hardware, BGP uplink, and the creativity involved in not using your identity at all & minimizing (or eliminating) expenses. Possible, but it'll take a few weeks.
- ryanlol 6y ago
  You don’t need any of those things, you can just rent a dedicated server (perhaps even a VPS) and send over a LoA and have the host route the IPs to your box. I’ve never had to deal with colo or think about hardware to have my IPs announce.
  - iscoelho 6y ago
    Generally the reason an attacker would do those things is because their hijacks will last much longer due to lack of an abuse department and victims having to contact upstreams. Shorter ASPath, planning which Tier 1/2 is the best to hijack from, and lack of LOA requirement or RPKI. If an attacker wants to do this - they don't want to "just" cause damage. This is a limited opportunity. They want to do it right, and that takes planning. I do agree that your idea is possible, but I don't think it captures the full severity of the issue.