5 ms·
Is BGP safe yet?
- nemomarx 7mo agoThis actually shows pretty good coverage for this feature, it seems to me. The big American isps do it, the mobile ones do too... How many major isps would we want to implement it to be "safe" and what would that look like? Is this a regional thing? They've only listed 4 unsafe ones on the site and that doesn't seem like a major issue, but maybe they're very large somewhere.
- KomoD 7mo agoWe want more than just major isps. They've listed way more than 4 (and those 4 are also massive), click "Show all". There's 254 operators marked as unsafe.
- chrismustcode 7mo agoI'm on sky in the UK which is marked as not safe due to no RPKI. It's not on the list so imagine there is a fair few missing, would be neat to have a table you could filter by country, provider type (cloud/isp etc) based on real results from users. edit: there's a show all button to expand the table
- badgersnake 7mo agoI get the same result for A&A, but frankly I trust them more than some random site with (apparently) an axe to grind.
- tialaramex 7mo agoMy hope would be that A&A have a process manually whitelisting the route that made the test fail because in fact (as of course it would be) it's actually deliberately not signed but it is really their route. But on some level that's like assuming the reason the guy with the handgun is on your plane is that he's a sky marshal and not that some idiot let a concealed handgun through security. I mean, sure, maybe, but, maybe not. Without asking it's just a guess and I haven't asked. Maybe I should.
- tialaramex 7mo agoAnd now thanks to jsty's sibling comment I don't have to ask, thanks! It does seem like they've been more than "cautious" enough at this point and should just implement RPKI.
- jsty 7mo agohttps://www.aa.net.uk/etc/news/bgp-and-rpki/ https://www.aa.net.uk/etc/news/bgp-and-rpki/
- OJFord 7mo agoAnd here we are six years on... I have a lot of respect for A&A, but I do find it hard to sympathise with that page.
- SCdF 7mo agoIf you're interested, Community Fibre is a yes from this website
- philipwhiuk 7mo agoClick show all. Major ISPs like British Telecom (core UK telephony), NTT Docomo (Japan), Vodafone Espana (showing that Vodafone isn't doing it globally), Starlink (showing it's not a old tech problem), Rogers (US ISP) are listed unsafe. I think the 31 is a misleadingly positive picture.
- asveikau 7mo agoI thought Rogers was Canadian.
- hrmtst93837 7mo ago[flagged]
- asveikau 7mo agoI got a fail on T-Mobile USA. It seems in the full list that T-Mobile is listed as both passing and failing.
- RyJones 7mo agoT-Mobile consists of at least five distinct networks depending on when your carrier was purchased, last time I was talking with some of the network security guys in Factoria. It’s been four years - they may have converged some of them.
- Melatonic 7mo agoAlso failing here in the Los Angeles area. Used to be on Sprint before the acquisition. Probably location dependent
- asveikau 7mo agoI got the failure message in San Francisco. Not sure if it makes a difference, but I had a T-Mobile SIM card I bought in Seattle in 2010 and was carrying from phone to phone for years, but I recently replaced the SIM because I heard newer t-mobile SIMs can do better finding 5g coverage.
- ck2 7mo agosame T-Mobile USA, AS21928 does NOT implement BGP safely
- toast0 7mo ago> How many major isps would we want to implement it to be "safe" and what would that look like? It would be "enough" if all the major transit ISPs did it and it would be helpful if all the major residential ISPs did it. If non-RPKI routes can't propagate through transit ISPs, that makes it a much less useful thing to do.
- nareyko 7mo ago[dead]
- RRRA 7mo agoGoogle being shown as unsafe makes me think they have some internal methods for filtering?
- bilekas 7mo agoGoogle And digital ocean are huge players here but is there a reason they would only have partial coverage? TIM is listed as insecure yet my test is successful. > Your ISP (Telecom Italia S.p.a., AS3269) implements BGP safely. It correctly drops invalid prefixes
- commandersaki 7mo agoI think the test for BGP is Safe is when we stop using it and instead use SCION: https://en.wikipedia.org/wiki/SCION_(Internet_architecture) https://en.wikipedia.org/wiki/SCION_(Internet_architecture).
- wussboy 7mo agoWhy hasn't this happened?
- benjojo12 7mo agoBecause SCION is mostly said as a joke in the more serious carrier world. SCION is practically speaking proprietary, and has 1 and maybe a half implementations. I have a laundry list of real problems with SCION but SCION feels like one of those entities that would get quite legal-ey if discussed publicly.
- genuineDSD 7mo ago[flagged]
- dsr_ 7mo agoBecause BGP works, is understood, and has been debugged by thousands of people and billions of sessions between dozens or hundreds of implementations. So the benefit of changing out all that infrastucture needs to be much higher than the cost.
- genuineDSD 7mo agoYou are right. And it'd be absolutely irresponsible to expect _everybody_ to drop things on the floor and adopt a new protocol (implementation) over night. However, it'd be equally irresponsible to ask for an innovation budget of 0 percent. The reason one bothers with new approaches is, of course, that fixing things on a conceptual level prevents many of the debugging sessions that you had to go through with the old approach. Why QUIC if there is TCP/TLS/HTTP? IPv4 and NAT are literally _everywhere_. It's tested and well-understood (one would think). But—and that's just my opinion—I sure hope that, one day, we will not have to deal with that mess no more ...
- olivier5199 7mo agoAn ISP is marked as unsafe in the table, yet running the test says it is. (same ASN)
- john_strinlai 7mo agothe last update on the table was feb 3. presumably rpki was implemented between then and now
- arnorhs 7mo agoISP's often have different infrastructure for different sets of customers (regional, mobile/landline differences etc) - often due to legacy M&As etc..
- deleted 7mo ago[deleted]
- NewsaHackO 7mo ago> A BGP hijack occurs when a malicious node deceives another node, lying about what the routes are for its neighbors. Without any security protocols, this misinformation can propagate from node to node, until a large number of nodes now know about, and attempt to use these incorrect, nonexistent, or malicious routes. But with HTTPS, they wouldn't be able to actually pose as another website, just delay/black hole the request so it doesn't reach its goal target, right? From the figure, it makes it seem like a person can use BGP to spoof a website and make a user visit a phished website, but that's not right, correct?
- dsr_ 7mo agoIf you can inject arbitrary malicious routes, you can make ACME requests for a new cert.
- ThomasGlanzmann 7mo agoYou can mitigate this with DNSSEC, CAA records and account pinning. See: https://www.devever.net/~hl/xmpp-incident https://www.devever.net/~hl/xmpp-incident
- infogulch 7mo agoWell if they can deceive certificate authorities that implement the ACME protocol like LetsEncrypt, then they could get a certificate for your site with the HTTP-01 challenge, see the paper Using BGP to Acquire Bogus TLS Certificates (2017) [1]. That paper suggested a mitigation they call Multiple Vantage Point Verification, which has already been implemented [2]. [1]: https://petsymposium.org/2017/papers/hotpets/bgp-bogus-tls.pdf https://petsymposium.org/2017/papers/hotpets/bgp-bogus-tls.p... [2]: https://community.letsencrypt.org/t/validating-challenges-from-multiple-network-vantage-points/40955 https://community.letsencrypt.org/t/validating-challenges-fr...
- tialaramex 7mo agoThey don't need ACME to do that, ACME is just an automation standard - the same rules apply for getting a certificate via ACME such as 3.2.2.4.19 "Agreed upon change to website - ACME" as for the manual process 3.2.2.4.18 "Agreed upon change to website v2". The ACME version is just designed for machines to automate easily (and as a result wildly more common in use today) And Multi-perspective only helps against an attacker who is merely able to influence a local route, if they can ensure all your perspectives see the same thing the attacker wins.
- maltalex 7mo agoRPKI doesn't make BGP safe, it makes it safer. BGP hijacks can still happen. RPKI only secures the ownership information of a given prefix, not the path to that prefix. Under RPKI, an attacker can still claim to be on the path to a victim AS, and get the victim's traffic sent to it. The solution to this was supposed to be BGPSec, but it's widely seen as un-deployable.
- impl 7mo agoI believe the current attempt at mitigation for this is ASPA[0]. It still has a long way to go, but there are some big names behind it. [0]: https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-aspa-verification https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-asp...
- greyface- 7mo agoIt has a long way to go, in the same sense that ROA had a long way to go when Cloudflare first launched this site in 2020. ASPA records are fully supported by both RIPE and ARIN these days.
- Retr0id 7mo ago> and get the victim's traffic sent to it This sounds "obviously bad" but the intricacies of routing aren't really my field, could you expand on why this is bad? (i.e. what specific bad things does it enable)
- maltalex 7mo agoHere are some examples: The attacker can impersonate the victim, get a valid x509 certificate issued to it, and create a perfect replica of their website/api/whatever. The attacker can perform a man-in-the-middle attack on the victim - record traffic, inject traffic, manipulate traffic, etc. The attacker can just deny access to the victim - just drop packets meant for the victim.
- rot256 7mo agoI think that way to solve BGPs security problems might be to use a new cryptographic hammer, "Proof-Carraying Data", where messages come with cryptographic proofs that they were produced correctly. This allows you to basically just run BGP, but every AS proves that it ran it correctly. The proofs take constant time to verify, regardless of how large the network is, or how many hops the routing message has taken. Feasibility is helped by latency not being super critical in BGP and BGP being a pretty simple protocol; which makes computing these proofs plausible. https://rot256.dev/post/bgp-pcd/ https://rot256.dev/post/bgp-pcd/ Proof-carrying data has come a long way in the last 10 years. EDIT: you would still need RPKI, but not BGPSec
- collabs 7mo agoLooks like Verizon does it correctly. > Your ISP (Verizon, AS701) implements BGP safely. It correctly drops invalid prefixes.
- elashri 7mo agoAny reasons on why an ISP would not implement it other than effort/cost? Just for someone like me whose networks knowledge is very naive.
- dec0dedab0de 7mo agoThey may be worried that their larger clients don't have things configured correctly, and they don't want to break things for them. They may have older hardware that needs to be upgraded before they can use this feature. They might even have their own way of filtering that they think is good enough. Though, all of those really boil down to effort/cost.
- _slih 7mo agorpki adoption is the new ipv6 adoption. it looks great until you realize it only validates who owns the prefix, not the path to get there lol
- betaby 7mo agoPath validation is handled by ASPA https://www.ripe.net/manage-ips-and-asns/resource-management/rpki/aspa/ https://www.ripe.net/manage-ips-and-asns/resource-management...
- deleted 7mo ago[deleted]
- lucasay 7mo agoRPKI makes BGP safer, not safe. It helps prevent some hijacks, but attackers can still mess with routing paths. Feels like we’re patching a trust-based system rather than fixing it.
- greyface- 7mo agoRPKI isn't just ROAs anymore, and BGP hijacks can happen at other places than just the first/last hop. Why hasn't this site been updated to test ASPA-invalid prefixes in addition to ROA-invalid ones?
- volemo 7mo agoWikimedia is an ISP?
- dec0dedab0de 7mo agoWhen they say ISP they mean anything with an ASN
- NetOpWibby 7mo agoWhen was the last time this site was updated? It mentions Sprint, which hasn't existed for years.
- dec0dedab0de 7mo agoI think it just goes by ASN. Looks like Comcast owns the Sprint ASN now.
- dorianmariecom 7mo agoi'm getting: Free SAS ISP signed unsafe but when testing i'm getting a success Your ISP (Free SAS, AS12322) implements BGP safely. It correctly drops invalid prefixes. Tweet this → Details fetch https://valid.rpki.isbgpsafeyet.com https://valid.rpki.isbgpsafeyet.com correctly accepted valid prefixes fetch https://invalid.rpki.isbgpsafeyet.com https://invalid.rpki.isbgpsafeyet.com correctly rejected invalid prefixes
- Levitating 7mo agoDoes not take BGPSec[1] into account, just RPKI. [1]: https://en.wikipedia.org/wiki/BGPsec https://en.wikipedia.org/wiki/BGPsec
- surround 7mo agoThe graphic that shows that a hijacker can route traffic to their malicious website is a little misleading. Since the SSL certificate would be invalid, browsers would block the connection and show a warning. I guess the attack could still be used for denial of service.
- icedchai 7mo agoOnce you have control of the destination, you could get a valid SSL certificate with Letsencrypt or whatever.
- surround 7mo agoWow I'm surprised, you're right, and it has happened before: > the attacker issued and registered a free temporary 3-month certificate for the developers[.]kakao.com domain through SSL certificate issuer called ZeroSSL. Because the routing policy was already manipulated by the BGP Hijacking, the attacker was able to register the certificate. https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7e33de600#d138:~:text=the%20attack%2C-,the,certificate,-%2E https://medium.com/s2wblog/post-mortem-of-klayswap-incident-...
- sureglymop 7mo agoYou could mitigate this by monitoring certificate transparency logs for unwanted certificates issued for your domain. Currently there are no good monitors though aka the system is a bit broken.
- pocksuppet 7mo agoAnd another one: https://notes.valdikss.org.ru/jabber.ru-mitm/ https://notes.valdikss.org.ru/jabber.ru-mitm/
- icedchai 7mo agoIt sounds like that one may have been the result of a "lawful intercept", so perhaps not necessarily BGP hijacking. If you have legitimate control of the ASN/network, it's not a hijack.
- ifwinterco 7mo agoIronic this is from Cloudfare, probably the single entity most likely to be responsible for breaking the internet in 2026
- pocksuppet 7mo agoThat's just how entrepreneurship is done these days. You aim to mislead the public in ways that benefit you, and somehow it actually works. If RPKI benefits you, you roll out a campaign that RPKI is great and necessary for internet safety. If you want to know all your users' real names, you roll out a campaign that age verification via identity document is needed to keep children safe on the internet. If your company sells separate measles, mumps and rubella vaccines, you roll out a campaign that the combined MMR vaccine makes children autistic. If your company sells weapons, you roll out a campaign to subsidize movies and video games that portray war as awesome and manly. If your company sells cigarettes but only men are buying them, you roll out a campaign that sells the freedom to smoke as a benefit of feminism. All of these things actually happened.
- pocksuppet 7mo agoRPKI and ASPA keeps you safer from other networks, but less safe from the registries. Consider what happens if your registry's country sanctions your country and you are unable to update any records held at the registry.
- greyface- 7mo agoRegistries have always had the ability to revoke number assignments; RPKI just makes this revocation slightly more forceful. You're going to have a bad time announcing prefixes that don't belong to you, even in the absence of RPKI. We're all internetworking at the pleasure of IANA. Getting them out of the picture, and removing their ability to deplatform Internet participants, is a much larger task than just moving away from RPKI. We'd need to completely rethink how ASN and IP assignments are done.
- pocksuppet 7mo agoRegistries have tended to leave existing registration data alone in case of a situation like sanctions. They won't let you register more numbers, nor will they deregister them. If you just need the numbers, that's fine. If you also depend on the registry regularly taking data updates from you, that's a problem.