The recent disruption in Internet traffic due to a Border Gateway Protocol (BGP) attack serves as a stark reminder of the vulnerabilities embedded in the very architecture of the Internet. Several hosting providers, including Hetzner Online, Softaculous, and Zet.net, failed to sufficiently monitor their systems, allowing a hijacking incident to persist for over 22 hours. Notably, Nexon Host also came under scrutiny, as its infrastructure played an inadvertent role in facilitating the malicious routing announcement.
Ben Cartwright-Cox, a recognized expert in BGP and creator of the BGP Tools suite, referred to these oversights as “silly, preventable mistakes.” Sadly, neither Softaculous, Hetzner, nor Zet.net provided immediate responses to inquiries concerning the incident, raising concerns about their commitment to transparency and user security.
A Brief History of BGP
The BGP protocol is crucial for maintaining the interconnectedness of the Internet, organizing it into a multitude of autonomous systems (ASes), also referred to as autonomous system networks (ASNs). These ASes function independently, each assigned a portion of the 3.7 billion publicly accessible addresses under the IPv4 protocol. BGP acts as the connective tissue, permitting these ASes to communicate, even across vast geographical distances, such as from Germany to North America.
In essence, for an AS to facilitate communication with IPs in another region, it must announce its existence and intention to other ASes. These announcements are recorded as entries in a global routing table that all ASes and their hosting providers rely on. Historically, BGP operated on a basis of trust, assuming that all routing announcements were made in good faith.
However, this implicit trust has been a double-edged sword. Over the years, various attackers—ranging from nation-states to financially motivated entities—have exploited these vulnerabilities. By making illegitimate routing announcements, they have sometimes managed to reroute vast amounts of sensitive data through their own networks, raising significant security concerns.
In response to these threats, experts in Internet architecture have developed measures to improve the integrity of BGP routing. One of the most notable is the implementation of RPKI (Resource Public Key Infrastructure) and ROV (Route Origin Validation). These technologies utilize cryptographic records known as Route Origin Authorizations (ROAs). RPKI ROV helps ASes validate the legitimacy of routing announcements, allowing them to reject any routes that deviate from the information contained within these ROAs. This form of validation is crucial for preventing malicious hijacks from spreading across the Internet.
As the landscape of cybersecurity continues to evolve, it’s imperative that hosting providers and AS operators remain vigilant. Ensuring robust monitoring and adopting validation frameworks like RPKI can significantly enhance the overall security posture of the Internet. The recent incident underscores the necessity of these practices in safeguarding data integrity and maintaining user trust.
For more on this topic, you can read the full article Here.
Image Credit: arstechnica.com
