8 ms·
Is regulated BGP security coming?
- zokier 2y agoInternet community has had plenty of time and opportunity to self-organize sufficient security measures. The need for security has been long recognized, and it's understandable that powers that be are getting impatient. While obviously it would be preferable that industry would voluntarily do stuff, if they don't then I guess it is justifiable that they get regulated.
- ozr 2y agoBGP operators _have_ self-organized sufficient security measures. Compared to just about any other attack vector on the internet, BGP hijacking is among the least likely to impact most people.
- ronsor 2y agoThis is very true. Personally I would be more concerned about SS7 attacks.
- anilakar 2y agoThe SS7 telephone signaling network is regulated here because telcos could not be arsed to implement security measures themselves.
- sambazi 2y agoafaik there is filtering of 'announcements' in ss7 similar to manrs/rpki
- karma_pharmer 2y agoWith cryptography? I doubt it. Not the same thing as RPKI.
- immibis 2y agoWhat does the cryptography add? RIRs publish who owns which prefixes, and sign this list. If you're America worried about foreign countries hijacking BGP, you can ignore announcements received from overseas about prefixes that are owned by American actors, unless they add a record indicating they expect to deploy them overseas. You don't need any additional cryptography for this, or any protocol change.
- coretx 2y agoPolitical routing is a faux pas. Also, not the state(s) is/are a authority. The RIR's are. They operate a realm, and nation state and/or individual interests don't end at a border. The realm doesn't even have them. Never the less, you are right about the need for more information being shared although it's hard to oversee what new security issues that may introduce.
- immibis 2y agoYou might think the state is not an authority, but everyone else who thought that got jailed by the state, so it seems to be the case that it is one. If the state and some protocol disagree, and the state has the power to imprison people using the protocol if they don't cooperate to subvert it (something like this happened to Ethereum IIRC), the protocol has to just deal with it.
- coretx 2y agoStates often delegate some of their authority to other institutions. As is the case when it comes to internet governance. Look at the ITU/UN https://en.wikipedia.org/wiki/Multistakeholder_governance https://en.wikipedia.org/wiki/Multistakeholder_governance for example. It's outright crazy to see US diplomats work their ass off globally only to see some lower institution ( The FCC ) with less intelligence, capabilities, etc. undermine their work and formal US geopolitical grand strategy & policy. Or it's all just a ruse, and the joke is on us.
- karma_pharmer 2y agoAnd yet SS7 still has no cryptographic security measures.
- sambazi 2y agocould you elaborate on why would you ascribe different impact to this seemingly similar problem?
- awaythrow999 2y agoThreat models matter. If you're defending against nation state actors in a military/cyber context it is an essential part of the overall defense strategy. Ignoring BGP on the grounds that "it was always insecure" is then just weird, if not reckless. The SCION project (Iirc from ZTH) solved all of this and also has been extensively tried in the field.
- kaliszad 2y agoIf you are defending against a nation state, you should be worried about your staff being bribed, otherwise coerced or worse just being foreign agents. In properly run networks, BGP hijacks shouldn't have a noticeable impact.
- alephnerd 2y ago> In properly run networks, BGP hijacks shouldn't have a noticeable impact Bullshirt. Even AWS Route53 has fallen victim to BGP hijacking. It takes 1 mistake for SHTF
- ta1243 2y ago> you should be worried about your staff being bribed, otherwise coerced or worse just being foreign agents This is it, find a senior network operator, pick up their kids from school, and take them home. You now have an agent with full access over that network.
- hanszarkov 2y agoBut what I do have are a very particular set of skills, skills I have acquired over a very long career. Skills that make me a nightmare for people like you
- mschuster91 2y ago> Compared to just about any other attack vector on the internet, BGP hijacking is among the least likely to impact most people. But when it happens, it impacts massive amounts of people - about once a year on average [1]. Sometimes it's censorship gone bonkers, sometimes it's likely a three-letter agency, sometimes it's fat fingers, and sometimes it's cybercriminals attempting to loot cryptocurrency wallets. [1] https://en.wikipedia.org/wiki/BGP_hijacking https://en.wikipedia.org/wiki/BGP_hijacking
- phicoh 2y agoBGP hijacking also works on a small scale. If you don't use DNSSEC and somebody hijacks the prefix(es) that host your DNS, they can obtain a letsencrypt certificate and redirect all your traffic. If you don't have a CAA record and somebody hijacks the prefix(es) where your webserver is hosted, they can also obtain a letsencrypt certificate and redirect your traffic.
- foobiekr 2y agoThat issue isn’t a dnssec problem, it’s that Let’s Encrypt was not familiar with the route hijacking threat model. It was pointed out early to them and they ignored it.
- rixthefox 2y agoWhy blame LetsEncrypt? Instead blame the operators who are refusing to address basic network security. I run a network, we do the whole shabang of RPKI, DNSSEC, and CAA. It sounds a whole lot like operators who refuse to address clear security issues. LetsEncrypt is not to blame when someone spoofs your address space. LetsEncrypt is not a LIR/RIR, their business is not IP resources but SSL certificates. They are a CA. They have no tools available to them to address that problem.
- immibis 2y agoBecause Let's Encrypt is the CA that hands out certificates without actually verifying identity.
- g15jv2dp 2y agoIf everything but the least likely attack vector gets secured, then the least likely will soon become the most likely.
- rabite 2y agoGiven that accidents involving BGP within the past several years have led to worldwide outages in the world's most used websites this is just not true. Also thousands of known bad announcements occur every year, which are usually used in a very small window to send large volumes of abusive advertisements. There's no reason not to force the industry to hold people accountable for false announcements. The privilege of announcement should be acquired by posting a significant amount of capital as a bond, from which damages can be removed when a system makes a false announcement. The vast majority of damages are a result of network operators on the subcontinent -- it is high time we figure out how to make them take the issue seriously, and pay out the nose until they do.
- zokier 2y agoWell over a decade after publication of RPKI it has been deployed at only 22% of US networks https://observatory.manrs.org/ https://observatory.manrs.org/ There is no justification for that not to be 100% at this point. With this data at hand, can you really claim that the industry has sucessfully self-regulated itself?
- icedchai 2y agoLegacy prefixes do not support RPKI unless you sign ARIN’s registration agreement and agree to pay. Many early IP address holders (including myself!) have never signed.
- gonzo 2y agoWhy pay for something that was never agreed to be so?
- rixthefox 2y agoYou don’t have to pay a dime. But don’t expect the rest of the Internet (that DO pay for their resources) to continue to guarantee reachability to your address space. If you won’t get on board with RPKI/IRR you can’t cry foul when the rest of the Internet is paying the price to be reachable. I am a resource holder and I pay my dues. I have no problems with paying for that privilege. Internet access is not an inalienable right. It is a privilege. Even as it’s become increasingly more and more of a utility. Until laws start to reflect that, it is still a privilege at best. Edit: before someone says anything about the trust anchors. Reminder, There are two overarching namespaces to the Internet. IP and DNS. You are free to ignore the authorities of both but don’t expect the rest of the Internet to play along when you want to use .billybob as your TLD.
- icedchai 2y agoAs long as RPKI "unknown" / not-found prefixes are able to be globally routed, I will not pay. I have a legacy ARIN /24 from the 90's. It was cheaper for me to get an ASN and IPv6 block through a RIPE LIR than go through ARIN. As for IRR, one of my upstreams created an RADB entry for me on behalf of my ASN, so not too concerned there.
- coretx 2y agoThis is a dangerous power grab. RPKI and social security ( nobody wants to peer with a idiot ) are already here and many things are in development. The FCC and by extension the USA should GTFO and let the multi stakeholder models do their work.
- awaythrow999 2y agoIt's a power grab in tge same sense as when people got outraged that everything on HTTP suddenly had to have PKI and x509 certificates. While x509 is shit, ASN1 an outdated mess, nobody would today argue that TLS is bad.
- akira2501 2y ago> HTTP suddenly had to have PKI and x509 certificates. Was that because the government mandated that outcome?
- immibis 2y agoThat was definitely a power grab. Suddenly CAs had all the power. The ONLY reason we ever accepted a browser-mandated transition to TLS is that Let's Encrypt started existing. Without Let's Encrypt, this would have the effect of requiring every website operator to pay money to a CA, even with full self-hosting. When Let's Encrypt eventually stops behaving in an altruistic fashion, we'll stop doing near-mandatory TLS.
- sidewndr46 2y ago
- deleted 2y ago[deleted]
- mavercik1337 2y agoIn other words, BGP security is serious business, but that doesn't mean we can't have a little fun with it. After all, a little laughter is the best medicine, even for the internet.
- d33 2y agoRelated: https://security.stackexchange.com/questions/56069/what-security-mechanisms-are-used-in-bgp-and-why-do-they-fail https://security.stackexchange.com/questions/56069/what-secu...
- kristjank 2y agoThe problem with regulating BGP security is that there will always be some Elbonian sh*thole that won't care what their networks spew out and that consequently, things will only get worse for the people that already play nice, while nothing changes for the hijackers.
- immibis 2y agoThe idea is that if Elbonia doesn't improve, America will de-peer from Elbonia and reject indirect routes as well. Elbonia will voluntarily improve so that it can be allowed to connect to America. Basically the same way we enforce things like the US dollar and trade sanctions.
- denton-scratch 2y agoPerhaps the xenophobic and anti-western Elbonian government would prefer not to allow connections to the USA.
- coretx 2y agoPerhaps both the Elbonian and USA should not copy Russian/Chinese policy proposals. The internet is not State-Territory. It's a transnational network.
- rcaught 2y agoSomewhat related. I've been looking at RPKI lately, and there are two things I'm not overly impressed with: 1. LACNIC and RIPE have 100 year validity on their trust anchors. 2. All RIR trust anchors are valid for all IPs (past their allocations), due to, I assume, inter-RIR transfers.
- __MatrixMan__ 2y agoI'll have to learn more about the protocol but I immediately distrust anything with things called "trust anchors". Sounds like the kind of high-value-target that attracts corruption.
- mobilemidget 2y agoI think mandatory ip source checking would be a nice addition too for many ISPs that still don't, and now allow tons of crap spoofing DoS attack traffic.
- alexdns 2y agoAka strict rpf which none of the Tier1 does
- immibis 2y agoFor very good reason. Legitimate routing is often asymmetric and applying this rule would block a large percentage of Internet traffic.
- mobilemidget 2y agoCan you elaborate a little? I mean any ISP can check if a packet leaving their network is actually a network they have under their control, routing doesn't have anything to do with that?
- immibis 2y agoEnd ISPs can. If you're an ISP supplying internet service to a business you can and should block source addresses that don't belong to that business, on that business's line. It doesn't work in the "Internet core". If you're Verizon and you got a packet from Comcast that says it's originally from Cogent, how do you validate that? This router that happens to be checking the packet prefers to send packets to Cogent via Sprint, but that doesn't mean Cogent also prefers to send packets to you via Sprint. Each router can have a different preference, too. (Example scenario only)
- mobilemidget 2y agoAh I was only thinking hosting providers/consumer ISP yes, not transit parties. But then they aren't also the source imho. It would help already quite a bit if the parties that can, do the source checking. I think many providers now also limit UDP which might become an issue when http/3 gets more adopted.
- throw383y8 2y ago[flagged]
- TacticalCoder 2y agoI am not pro russian but you've got a point. The amount of hacking attributed, should we believe, to North Korea is beyond belief: we're supposed to to believe that a country which cannot properly Photoshop a picture (to make believe they've got military hoovercrafts!) and where there are still people eating roots, and where they're best computing feat is to change Red Hat Linux's background wallpaper is... Full of top-notch hacker infiltrating all the western world's infra? Please. Just fucking please.
- boffinAudio 2y agoCome on, you can't be serious. First of all, nationalistic hubris-derived agitprop is still agitprop. Second of all, Vault 7 is a very, very real thing. The mere existence of Vault 7, alone, should be reason enough for us all to be embracing this.
- alephnerd 2y ago> we're supposed to to believe that a country which cannot properly Photoshop a picture (to make believe they've got military hoovercrafts!) and where there are still people eating roots, and where they're best computing feat is to change Red Hat Linux's background wallpaper is... That's a 1990s and early 2000s image of North Korea. Sanctions are way less biting in NK now that China, Vietnam, and Russia have become much more affluent compared to back then. It's fairly common for the North Korean government to send their top talent to study CS in China, Russia, and Vietnam, and work as unofficial contractors as well as conduct attacks from abroad. Vietnam used to be a very common source of attack for that reason, due to it's permissiveness for Chinese and Korean (North and South) visitors, and why Vietnamese IP blocks tend to blocked by most western WAFs, and North Korean MSPs have been caught operating in Vietnam a lot. Also, poverty never stopped a country from building a strong MIC. Look at China, India, and Pakistan's domestic MIC capabilities which began being built in the 1970s-80s. To quote former President Zulfikar Ali Bhutto of Pakistan - "We will eat grass, even go hungry, but we will have our own atom bomb" (early 1970s). I also wouldn't judge technical prowess based on inability to use Photoshop or other basic tech correctly. Lots of Chinese and Indian government websites are riddled with misconfigured access controls, open ports, and unpatched stacks yet it doesn't mean these countries don't have the ability to innovate military technology.
- kjhcvkek77 2y agoHow far could you get with a scheme like "if router.country.is_shady and ip.is_western: route.deny()"
- alephnerd 2y agoThis is commonly done via WAFs and SSE products, but other methods are needed as well.
- kjhcvkek77 2y agoI think either you misunderstand me or I misunderstand you. Unless I'm mistaken a web application firewall is for a corporation to protect their intranet and not applicable for a core router.
- alephnerd 2y agoAt the router level you can do Geographic IP filtering, and for protecting your core router there will almost always be some firewalling (eg. pfSense) but it ain't foolproof. A WAF and any other Perimeter security product can be used to enforce geoblocking (and other sorts of filtering) from an inbound standpoint at L7 (and why they are increasingly being subsumed under the API Security/Gateway segment or the SSE segment if you want to merge L3/4 and L7 security capabilities) > I think either you misunderstand me or I misunderstand you Probably on my end.
- immibis 2y agoThis entire discussion is about the Internet itself, not companies that connect to it: how does the Internet know which direction to send traffic in? It's managed by a protocol called BGP. Other countries can say your addresses are present in that country, and steal your traffic.
- bitnasty 2y agoNot sure how this is supposed to be a convincing article when it doesn’t really discuss the actual issue the FCC is trying to solve.
- cess11 2y agoSo basically 'Great Firewall of the USA'?
- immibis 2y agoThe name's already taken for cloudflare captchas