BGP Hijacking

Description

The consequence can be loss of availability, interception of traffic, or its diversion through a network that should never have been on that path. Sometimes it is a provider's mistake, sometimes a deliberate attack. The user usually does not see that the path changed, only that the service does not work or that the traffic takes an illogical route.

BGP came out of an era of the internet when far more was assumed about the good intentions of its users. That is why RPKI, route validation, prefix filtering and monitoring of changes matter so much in the defense. Without them, routes are too fragile for the way the internet works today.

Examples

• A provider announces somebody else's IP prefix by mistake and part of the traffic for a well-known service goes the wrong way.
• An attacker diverts traffic towards a crypto service in an attempt to intercept or manipulate the communication.
• A regional routing incident temporarily makes part of a service unreachable for users on several networks.

Notes

• BGP hijacking is not a problem an ordinary user can solve on their own machine. It is a matter of internet infrastructure, providers and proper route validation.
• TLS helps against the content being read, but it does not solve availability or the diversion of the path.