How can one network's mistake, or lie, steal another's traffic?
For about 30 seconds at a time, a hacker made the internet's own directions point crypto miners' traffic to the wrong place.
▶ Start the storyOne network can steal another's traffic simply by announcing a route it shouldn't, because the internet's routing system trusts what it is told. BGP hijacking is the illegitimate takeover of groups of IP addresses by corrupting the routing tables kept using the Border Gateway Protocol. Each uses BGP to advertise the prefixes it can deliver traffic to, and by default BGP is designed to trust all route announcements sent by its peers.
There are three classic tricks. A network can announce that it originates a it does not actually own. It can announce a more specific prefix than the true owner does. Or it can claim a shorter route to the victim than already exists, whether or not that route is real. In every case, packets end up forwarded towards the wrong part of the network, where they either loop and are discarded or are at the mercy of the offending network.
Step 1: A network announces a route
A it does not own, or a shorter path
Step 2: Neighbours believe it
BGP trusts announcements by default
Step 3: Traffic turns towards it
Packets go to the wrong part of the network
Step 4: Dropped or at its mercy
Packets loop and are discarded, or the offender handles them
It does not take a villain. A customer connected to two big carriers, with no filtering, can accidentally become a path between them. In early 2008, at least eight US universities had their traffic rerouted to Indonesia for about 90 minutes. And in 2014, in 22 incidents of roughly 30 seconds each, a hacker redirected traffic and stole cryptocurrency from mining operations.
The cure, called RPKI, is designed to authenticate who owns an address block, but it is not widely deployed yet. Until it is, the internet's roads rely on the honesty of everyone drawing the map.
Quiz me
0/3
Recap
BGP believes what neighbours announce, so false or mistaken announcements can steal traffic, and RPKI is meant to verify who owns an address block.
💡 A trick to remember it · BGP is a town crier nobody checks: whatever he shouts about the roads, everyone believes.
Surprising fact · The 2014 cryptocurrency thefts used redirections of only about 30 seconds each.
Sources (1)
No source, no claim. Every fact in this lesson (20 claims) cites at least one of these.