BGP Hijacking Continues, Despite the Ability To Prevent It 57
An anonymous reader writes: BGPMon reports on a recent route hijacking event by Syria. These events continue, despite the ability to detect and prevent improper route origination: Resource Public Key Infrastructure. RPKI is technology that allows an operator to validate the proper relationship between an IP prefix and an Autonomous System. That is, assuming you can collect the certificates. ARIN requires operators accept something called the Relying Party Agreement. But the provider community seems unhappy with the agreement, and is choosing not to implement it, just to avoid the RPA, leaving the the Internet as a whole less secure.
BGP? (Score:3, Informative)
What if we agree to spell out obscure acronyms the first time? Yes, I can google/bing it to find likely candidates, but what if you make life easier for all involved and actually use Border Gateway Protocol (BGP)? Mmmmkay?
Re: BGP? (Score:3, Funny)
this is a site for nerds...or at least used to be until your lazy ass showed up
Re: (Score:2)
This is a site for nerds, not IT types.
Do you know what a LASCR is, and how and why you might use it to slave a photoflash? If not, GTFO.
Re: (Score:3)
This is a site for nerds, not IT types.
Strange, I remember when it was a site for IT types, but that was back when CowboyNeal was still here, and the plebs hadn't really destroyed the internet.
Re: BGP? (Score:4, Funny)
An Indian sailor.
Slavery is wrong.
Re: (Score:2, Funny)
This is slashdot you insensitive clod, a site for nerds. I knew what BGP meant without looking it up.
Re: (Score:2, Funny)
Guess it's "News for Plebians".
Re: (Score:1)
Re: (Score:3)
I don't think BGP is simple enough for a non-nerd...
Since when did "nerd" only cover people who understand BGP? I don't remember that on the entrance exam...
Heaven forbid anyone should be allowed to come away from reading a story on Slashdot more informed. Can't be having that!
A simple, painless expansion of an acronym would at least give every reader a fighting chance at a rough guess of what it does, or at least what it relates to.
Re:BGP? (Score:5, Insightful)
I don't think BGP is simple enough for a non-nerd...
Since when did "nerd" only cover people who understand BGP? I don't remember that on the entrance exam...
Heaven forbid anyone should be allowed to come away from reading a story on Slashdot more informed. Can't be having that!
A simple, painless expansion of an acronym would at least give every reader a fighting chance at a rough guess of what it does, or at least what it relates to.
Um... given that BGP is THE core routing protocol for the Internet... Yeah... you should at least know what it is at a basic level. It fits into the same category as DNS, HTML, ISP, etc.
It's a lot like the programmers talking on here about the Waterfall model. It's expected that if you don't know something that you will take 5 seconds to look it up. Just maybe you'll learn something new... oh horrors... (grin)
For those who still don't know, BGP stands for Border Gateway Protocol. At a very basic level, it's a routing protocol used to advertise routes between ISPs and other Internet connected organizations. It's these routes that we use to get to Netflix, for example.
Re: (Score:1)
My point was you have to know the authentication algorithm, the path choosing algorithm, what a peer group or a router id is and which ones are relevant or irrelevant to a BGP hijacking to be able to actually understand what this is all about.
BGP is not your everyday routing protocol, it's not RIP, that was my point.
Re: (Score:2)
I see Fry narrowing his eyes.
Re: (Score:2)
I think both sides of the argument are pretty mute anyhow. I don't think much is gained or lost either way you go.
I know what BGP is but I never memorized what the letters stand for. Even if we spelled it out, that barely scratches the surface of what it is and doesn't make the article anymore informative for someone not versed in what BGP is.
Yes, it is usually standard practice in any formal writing. Slashdot is hardly formal though, when Bennet gets to spout his half formed ramblings every week.
Re: (Score:2)
I think both sides of the argument are pretty mute anyhow.
frysquint.jpg
Re: (Score:2)
Based on this thread, I doubt they're mute, given that people are expressing opinions on both sides...
On the other hand, both sides might be moot....
Re: (Score:2)
Concur. I happen to know what BGP is, but there's plenty of nerds for whom this site provides news that could have probably used a link [wikipedia.org] - especially if they wanted to understand it better before reading the article. [...but after first posting.]
Re: (Score:2)
or they could've spent two seconds typing 'bgp' into a search engine. I bet the wiki link would be on top.
Re:BGP? (Score:5, Insightful)
Re: (Score:1)
Re: (Score:2)
What if we agree to spell out obscure acronyms the first time?
I guess I disagree. I don't want to have to see "Transmission Control Protocol / Internet Protocol" the first time in every article that mentions TCP/IP
good news everyone! [youtube.com] using time travel, i have added a html tag specifically for abbreviations. go ahead and try it, it's the <abbr> tag.
Re: (Score:2)
Re: (Score:3)
I think most people on this website knows what BGP is, hence the acronym.
Re: (Score:2)
if you don't know what some acronym means, look it up or go whine about it on your tumblr.
Required -- Except When It Isn't (Score:2)
ARIN requires operators accept something called the Relying Party Agreement.
But the provider community . . . is choosing not to implement it
So ARIN apparently has no ability to enforce the 'requirement', making the 'requirement' meaningless.
Re:Required -- Except When It Isn't (Score:4, Informative)
It's required if you want to use ARIN's data. Those who choose not to agree are simply not using that data, with the consequence that they are less effective at validating route origin identity.
Re: (Score:1)
It's an ARIN requirement when using ARIN's RPKI services.
The base issue with all this "route hijacking" has fuck all to do with RPKI. It's a simple matter of ISPs being a bunch of lazy asses who cannot be bothered to filter what gets announced to them. Sure, that becomes more work the larger you are, but that's the price of doing this kind of business!
Re: (Score:2)
And how do you know what to filter?
RPKI is about providing a trustworthy database that can be used to decide what to filter and what to permit.
Re: (Score:2)
RADB for one. RPKI is pretty ugly and untill everybody uses it it's not that useful. RADB is here now and you can require that everybody registers as a condition of peering/transit.
More importantly (Score:4, Interesting)
Why do we continue to allow peers that have proven to be problematic in the BGP backbone? simply do not share routes with these ASs any more and fuck their shit hole countries until they stop dicking with the core of the internet.
its not like any old admin can be like "Ok i'm going to broadcast bad routes that will be observed and respected by all the core routers of the internet"
no these people have special agreements with the neighbours they route with, its not like BGP packets just fly around the internet from some random workstation belonging to a hacker magically find their way onto the private vlans the cores use for bgp traffic.
even if it wasnt technically preventable it should simply be resolved by refusing peering after an incident.
Shoplifting occurs despite the ability to prevent (Score:4, Informative)
These events continue, despite the ability to detect and prevent improper route origination
Locked cases with hardened glass are a technology that allow a store to protect products for sale from surreptitious pilfering. That is, assuming you can fit the products in the case. Lock manufacturers for the cases require stores to accept something called a "key security agreement", but the shop owner community seems unhappy with the inconvenience posed to customers, and is choosing not to implement it, just to avoid the KSA, leaving the goods on store shelves worldwide as a whole less secure.
Re: (Score:1)
Re: (Score:2)
So, we should never do anything to improve security because it isn't 100% effective.
Got it.
And 100% as convenient, too, don't forget. Wouldn't want to incur any costs or have to lift a finger for that security.
Re: (Score:1)
And signing a mass of unenforceable rent-seeker written security theater legalese is actually better than what we have now, which amounts infrequent and temporary disruption of marginal, poorly run systems? PKI systems get compromised as well, you know.
I'd rather risk the vulnerabilities than stop the rapid growth of the Internet, or have it bifurcate into the signatories and the non-signatories, which is the more likely outcome. The fact that a third-world civil war hellhole like Syria even has any Inter
Re: (Score:2)
That's not the message. The message is: that some security problems can be solved technically, but the solution is so problematic, that the solution can't reasonably be accepted.
The major problem with RPKI is the legalese, and the fact that operators have some reasons not to trust the RIRs to administer it.
We see some of the matters of policy as self-serving. We recognize that RIRs are not infallible, and we're concerned about giving a single organization too much power over the community-operate
Re: (Score:1)
Re: (Score:2)
Prefix This (Score:5, Funny)
Just flipped down the thread:
AAAAASSSS????ASSSA?FFbFbb??bBM
Key:
A = messages complaining about use of acronym, explaining it
S = messages questioning relevance of BGP to 'Nerd', answers
? = WTF responses (Fry, Bennet)
F = political views (fuck ARIN, fuck legalese, fuck de Man)
b = relevant but misinformed (filtering not quicky-solve, RPKI not Kill Switch)
B = relevant, thoughtful response to a 'b'
M = this, meta message about thread.
If the rest of the Internet was like this, no actual routes would ever be advertised.
My life is light, waiting for the death wind,
Like a feather on the back of my hand.
Dust in sunlight and memory in corners
Wait for the wind that chills towards the dead land.
~T.S. Eliot
Re: (Score:2)
(feeling karma-guilty now) Some of my previous BGP bookmarks,
The RFC6480 [ietf.org] I'm sure you'll want to read this first, every bit of it. Others may wish to skip on to the next chapter which is a good bit and has Marvin the Robot in it.
Introduction to BGP [youtube.com] and How BGP best path [youtube.com] (by default!)
[2014] spammers squatting on unassigned IP address ranges [krebsonsecurity.com]
[2014] Using BGP advertisements to gather Bitcoin mining traffic (doing digital money with unsecured protocols, kewl!) [secureworks.com]
[2012] Packet Pushers #93: Lies and Routing [packetpushers.net]
Or people could, you know, do their damn jobs... (Score:3)
As the article points out, the only reason this was able to work was because one of the upstreams didn't filter announcements correctly. So instead of one provider doing something simple, the "fix" is for the rest of the world to do something complex?
Back in the day if a provider dicked around with BGP enough (either through incompetence or malice) they would find that eventually no one would accept any prefixes originating from their network. Kind of hard to have customers when the rest of the internet won't accept your traffic, isn't it?
BGP4 was new and exciting in 1994, and people are still doing it incorrectly. Film at 11.
Re: (Score:2)
Teirs of providers screwed up, Telecom Italia should have never accepted the routes. Considering that the whole AS has 84 ipv4 prefixes that could/should be summarized it's a pretty static list. They have one "client" bgp session to their own second AS. Telecom Italia is big enough where it looks like bigger fish dropped the ball filtering it's nearly 40k routes (possibly also hardware issues 40k long prefix lists can make routers unhappy).
Re: (Score:2)
As the article points out, the only reason this was able to work was because one of the upstreams didn't filter announcements correctly. So instead of one provider doing something simple, the "fix" is for the rest of the world to do something complex?
Yes.
If the entire BGP system is reliant on any 1 participant to properly implement security, then you can be assured there will be at least 1 participant who does not properly implement security.
We should assume the entire network is hostile and full of bad actors, then "fix" accordingly.
That's how you build robust networks.
For example: assuming everyone will play nicely is why the NSA got to tap datacenter-to-datacenter x-fers for the major internet companies. Once this came to light, each and every compan
Re: (Score:2)
Agreed. It's like saying SSL is secure when it relies on every CA to operate in the same secure way. Oops.
Or email is reliant on one particular server not relaying out spam to others and faking return addresses, etc.
Lots of big tech relies on "honesty". The only way to fix it is to enforce a protocol that ensures compliance (or punsihes non-compliance with relegation).
If you don't play ball in DNSSEC, for example, then people know you're not playing ball. You either participate properly or not at all.
If