7 ms·
White House asks agencies to step up internet routing security efforts
- throw0101c 2y agoThis article leans more towards a general audience. For more a tech-leaning audience, perhaps see: * https://arstechnica.com/tech-policy/2024/06/fcc-pushes-isps-to-fix-security-flaws-in-internet-routing/ https://arstechnica.com/tech-policy/2024/06/fcc-pushes-isps-... * https://www.techspot.com/news/104590-white-house-declares-bgp-security-issues-national-priority.html https://www.techspot.com/news/104590-white-house-declares-bg... * https://www.securityweek.com/white-house-outlines-plan-for-addressing-bgp-vulnerabilities/ https://www.securityweek.com/white-house-outlines-plan-for-a... WH PR (linked to by Reuters): > While there is no single solution to address all internet routing vulnerabilities, the roadmap advocates for the adoption of Resource Public Key Infrastructure (RPKI) as a mature, ready-to-implement approach to mitigate BGP’s vulnerabilities. RPKI consists of two primary components: Route Origin Authorizations (ROA) and Route Origin Validation (ROV). A ROA is a digitally-signed certificate that a network is authorized to announce a specific block of internet space (i.e., IP addresses). ROV is the process by which BGP routers use ROA data to filter BGP announcements flagged as invalid. Importantly, ROV can help protect an organization’s internet address resources only if that organization has created ROAs. * https://www.whitehouse.gov/oncd/briefing-room/2024/09/03/fact-sheet-biden-harris-administration-releases-roadmap-to-enhance-internet-routing-security/ https://www.whitehouse.gov/oncd/briefing-room/2024/09/03/fac... Roadmap/whitepaper (PDF): * https://www.whitehouse.gov/wp-content/uploads/2024/09/Roadmap-to-Enhancing-Internet-Routing-Security.pdf https://www.whitehouse.gov/wp-content/uploads/2024/09/Roadma...
- kortilla 2y agoRPKI unfortunately doesn’t prevent BGP hijacking though. You need every message to be signed.
- fach 2y agoIt solves a class of hijacks, where an autonomous system announces a prefix it is not authorized to announce. This is typically the operator error use case or uneducated bad actor use case. What it does not cover is if an autonomous system crafts an announcement containing the valid origin autonomous system in which case you would need a mechanism to validate the entire AS_PATH itself. ROA is only concerned about the origin in the AS_PATH.
- Stevvo 2y agoThe whole thing feels dishonest. BGP is working as intended, so should we really call hijacking a "vulnerability"? A failure to acknowledge that the protocol is fundamentally flawed and not fit for purpose.
- hnuser123456 2y agoBGP is working as intended, according to how it was designed before we had the opportunity to have decades of observations about how it can be abused. And BGP is not really fundamentally flawed, what is fundamentally flawed is trying to get everyone to build an authoritative database on who owns which IPs and how they connect to their upstreams/downstreams, without it being possible for someone to manipulate that database nefariously. As we are on hacker news, you are probably aware that there is no such thing as a hack-proof system. The old IRR system would have been perfect if every IRR hoster had a dedicated team of highly trained NOC engineers who are capable of making cross references using the RIR databases to the fullest and investigate any anomalies to prevent any malicious submissions. Unfortunately, that doesn't scale as well as rolling out something smarter like RPKI. Unfortunately, everything was already setup to use the IRRs and some people like it that way, so getting to 100% RPKI adoption has been slow, just like IPv4 addresses will probably always be worth more than IPv6 even though in principle, IP address space should have zero inherent value because it's just a number and should not have any limited supply. Source: Former RADB admin.
- xyst 2y agoSo ROA/ROV are for preventing prefix hijacking and IANA will personally issue a certificate to verify organization owns ASN. But what impacts does this have on performance? Great we solved hijacking issue. But this other ASN which used to be a preferred route doesn’t use ROA/ROV (yet or refuses). Now traffic reroutes to a less efficient path?
- deleted 2y ago[deleted]
- codebje 2y ago> But what impacts does this have on performance? Great we solved hijacking issue. But this other ASN which used to be a preferred route doesn’t use ROA/ROV (yet or refuses). No performance impact: a routing table is a very (ahaha) binary thing, it takes a destination address and does a longest prefix match search in a table to find the next hop interface, to which it routes the packet. Route validity is considered (alongside a bunch of other routing policy inputs) when constructing the table, not when a packet arrives.
- vitus 2y agoI think you missed the parent commenter's point. The purported performance hit wouldn't be from the propagation delay on any given router, but rather from shifts in traffic resulting in a longer path. In practice, I suspect there will be very little impact for most traffic, since typical aspath lengths are, like, 2. (Mostly, direct peering between CDNs and ISPs if the data isn't cached within the ISP network to begin with) edit for source: > The average AS path length in a well-developed content network is about 1. Maybe 1.1. https://youtu.be/gxO73fH0VqM?t=1387 https://youtu.be/gxO73fH0VqM?t=1387
- jabart 2y agoAverage AS Path being about 1 isn't right. For direct peer CDN content sure Even AWS has their own path that's at least 2 from GTT, Areilon, NTT, etc from wherever you connect. if you are at a data center and use blended IP Transit that's another ASN to add to the path RIPE report had the average at 3-4 in 2012.
- d33 2y agoI don't want this to sound cynical, but do we have any examples where the US government successfully got the corporations to actually increase security, as opposed to just gaming the regulations to make more money instead?
- unethical_ban 2y agoYes. Edit: SOX, HIPAA, NIST CSF. Government is not always bad.
- AnthonyMouse 2y agoThese aren't great examples. HIPAA is extraordinarily expensive, meanwhile healthcare providers continue to have abominable security because compliance is offloaded to a "compliance team" who comes around once in a while to check boxes without really understanding the system, which is managed by other people who don't really understand HIPAA. This is one of the reasons security in large organizations is hard. Bureaucracies gravitate toward bureaucratic solutions, but then the left hand doesn't know what the right hand is doing, which is a direct mechanism for security to get messed up. SOX isn't really about "security", it's about auditing and so on, but it suffers from a disadvantageous trade off. Large companies are less likely to have accounting problems than smaller ones. The law was passed in response to major outliers like Enron, but basing rules on rare outliers generally results in bad rules. Meanwhile the smaller companies have disproportionately higher compliance costs, to the point that there have been proposals to exempt smaller companies. But that implies it probably isn't worth it for large companies because the rate of fraud is so low and it probably isn't worth it for small companies because the compliance costs are so high, and then there's nothing left. Whereas NIST CSF is a different kind of thing because it's voluntary. This is where government publications can really do some good, because if they publish rubbish then nobody has to pay any attention to it and the cost is limited to the money they spent creating it, but if it's good then it's valuable to anyone who uses it. The government should definitely lean towards this method, but it's hard to call this one "regulations" -- and the criticism you're responding to was that corporations would end up "just gaming the regulations".
- ChrisArchitect 2y ago[dupe] Some more discussion: https://news.ycombinator.com/item?id=41453975 https://news.ycombinator.com/item?id=41453975 And official release: https://www.whitehouse.gov/oncd/briefing-room/2024/09/03/press-release-white-house-office-of-the-national-cyber-director-releases-roadmap-to-enhance-internet-routing-security/ https://www.whitehouse.gov/oncd/briefing-room/2024/09/03/pre... (https://news.ycombinator.com/item?id=41439488 https://news.ycombinator.com/item?id=41439488)
- throwaway63467 2y agoIt’s interesting how easy it is to get someone to announce your prefixes, it often just takes a credible letter of authority, in my understanding all processes rely on manual due diligence. If an organization e.g. has a valid RIPE database entry that it can announce a given prefix under its own ASN I could set up an account at a cloud provider like Vultr using the business data of said company, charge it with 10 USD and then ask them to announce the prefixes of the organization under their ASN, pulling in traffic for these IPs. I could then try to reroute them to the actual destination (not always trivial but often doable), giving me a MitM setup. Not sure if it would work but it’s essentially what I did for my own organization and in my RIPE data there’s nothing that specifically says Vultr can announce my prefixes. I think today you need a service that monitors all BGP routes for your prefixes to detect this kind of incident, and then of course someone from the announcing ASN needs to delete the announcement.
- growse 2y ago> what I did for my own organization and in my RIPE data there’s nothing that specifically says Vultr can announce my prefixes In RIPE, each as-num should list out a policy of which other ASNs can import/export routes from that ASN. I think there should also be a route/route6 object. Do vultr not check/enforce this? (Other providers do).
- hnuser123456 2y agoThey do not validate this and it's probably part of their appeal.
- Onavo 2y agoCan get US government also strong arm the organizations to do so?
- hnuser123456 2y agoI have had to delete a lot of invalid routes from an IRR database due to things like this. Generally, we needed someone to notify us that someone was using a cloud provider to announce their prefix unexpectedly. I would love to build a system to be constantly cross referencing IRR changes to detect stuff like this proactively, it wouldn't be simple but it would be possible. Unfortunately very, very few people understand how the IRR works.
- aucisson_masque 2y ago> The White House said on Tuesday it wants federal agencies to boost internet routing security on networks in the face of concerns raised by U.S. officials about China's ability to divert internet traffic. Isn't that funny when the white house has been exposed secretly tapping every single non American (Chinese included) and American online activity, phones calls, mails, etc. I'm not saying the Chinese should be able to do what the USA is already doing to the world but it's like seeing a thieft getting robbed by another criminal. Somehow its funny.
- Spivak 2y agoThieves are probably more likely to want good locks on their house, it's for sure true with pentesters. Security issues is a security issue, the justification is mostly just puffery. Even the white house statement is vague as hell with things some adversary might be able to do grasping at something to relate what is an industry-specific esoteric issue to some hypothetical tangible real world consequence. It's like how Net Neutrality had that fake Comcast ad where you had to pay for tiers of internet to try to make sense of what really was a B2B market intervention to stop ISPs from rent-seeking tech companies. It made it relatable even if it wasn't at all what would have (and didn't happen I suppose) happened.
- deepsun 2y agoWhy thief? All countries do protect their citizens and government from external dangers. Why is one of them suddenly "thief"?
- _djo_ 2y agoDo you really think that only the US has been doing international electronic espionage? Russia (and before them the Soviets), the Chinese, the French, the Brits, and many others have been doing it for decades. This isn’t a response from China to US revelations, it’s a continuation and escalation of a practice they’ve been doing all along.
- nwav 2y agoI don't understand why IT laypeople so often appeal to moral hypocrisy in matters of internal state interests: The basis for national security recommendations is not fairness for all human beings. Yes, if you're not a citizen, you are discriminated against. Sometimes, even if you are. That's the case for every nation. It also has limited bearing on whether a security policy is in the government's self-interest.
- motohagiography 2y agoit looks like route views and bgpmon got embraced, extended, and largely extinguished by cisco? I've been out of this loop for a long time. is there a free service around for monitoring tables or something you can connect an openbgpd instance to for doing analysis?
- icedchai 2y agoThere are several such sites. bgp.tools and bgp.he.net are two of the ones I use for web based monitoring.
- 1over137 2y agoSo my ISP fails https://isbgpsafeyet.com/ https://isbgpsafeyet.com/ What would be the most convincing arguments to email my ISP with?