4 ms·
It’s interesting how easy it is to get someone to announce your prefixes, it often just takes a credible letter of authority, in my understanding all processes
by throwaway63467 2y ago
It’s interesting how easy it is to get someone to announce your prefixes, it often just takes a credible letter of authority, in my understanding all processes rely on manual due diligence. If an organization e.g. has a valid RIPE database entry that it can announce a given prefix under its own ASN I could set up an account at a cloud provider like Vultr using the business data of said company, charge it with 10 USD and then ask them to announce the prefixes of the organization under their ASN, pulling in traffic for these IPs. I could then try to reroute them to the actual destination (not always trivial but often doable), giving me a MitM setup. Not sure if it would work but it’s essentially what I did for my own organization and in my RIPE data there’s nothing that specifically says Vultr can announce my prefixes. I think today you need a service that monitors all BGP routes for your prefixes to detect this kind of incident, and then of course someone from the announcing ASN needs to delete the announcement.
- growse 2y ago> what I did for my own organization and in my RIPE data there’s nothing that specifically says Vultr can announce my prefixes In RIPE, each as-num should list out a policy of which other ASNs can import/export routes from that ASN. I think there should also be a route/route6 object. Do vultr not check/enforce this? (Other providers do).
- hnuser123456 2y agoThey do not validate this and it's probably part of their appeal.
- Onavo 2y agoCan get US government also strong arm the organizations to do so?
- hnuser123456 2y agoI have had to delete a lot of invalid routes from an IRR database due to things like this. Generally, we needed someone to notify us that someone was using a cloud provider to announce their prefix unexpectedly. I would love to build a system to be constantly cross referencing IRR changes to detect stuff like this proactively, it wouldn't be simple but it would be possible. Unfortunately very, very few people understand how the IRR works.