BGP Hijack: 4 Steps That Enabled The April 2018 Route 53 Attack

The internet’s backbone relies on protocols like BGP and DNS to direct traffic reliably. In April 2018, a sophisticated attack exposed vulnerabilities in this system when malicious actors hijacked Amazon’s Route 53 DNS service. This incident rerouted user queries to a fake server, leading to significant financial losses for cryptocurrency users. This article delves into the mechanics of the attack, its impact, and ongoing efforts to fortify internet routing.

Understanding BGP and Its Role in Internet Routing

Border Gateway Protocol (BGP) is the core routing protocol of the internet, enabling autonomous systems (ASes) to exchange reachability information. ASes, operated by ISPs, cloud providers, and enterprises, use BGP to advertise IP prefixes they manage. The longest prefix match rule determines the preferred path, making BGP susceptible to manipulation through more specific announcements.

Amazon’s Route 53, a scalable DNS service, uses specific IP prefixes like 205.251.192.0/23. Attackers exploited BGP by announcing more specific subnets, such as /24 prefixes, tricking routers into directing traffic away from legitimate servers.

• BGP announcements propagate globally via peering sessions at internet exchange points (IXPs).
• Without authentication, any AS can claim ownership of any prefix.
• Route leaks or hijacks occur when invalid announcements are accepted.

The Timeline of the Route 53 Hijack Incident

On April 24, 2018, around 11:00 UTC, anomalous BGP updates appeared. Legitimate announcements from Amazon AS16509 for 205.251.192.0/23 were overshadowed by more specific /24 prefixes from AS10297 (eNET), propagated via Hurricane Electric (AS6939) and others at Equinix Chicago IX.

Monitoring tools like RIPE Atlas and BGPStream detected the shift. By 11:05 UTC, eNET announced malicious prefixes, affecting about 15% of global DNS resolvers per Dyn reports. Traffic destined for Route 53 servers flowed to a rogue DNS in Chicago, hosted on a compromised Equinix server.

The hijack lasted nearly two hours, enough time for targeted exploitation.

Attack Mechanics: From BGP Manipulation to Phishing

Attackers compromised AS10297, reconfiguring its Cisco ASR 9000 router to advertise Amazon’s prefixes. These announcements, more specific than Amazon’s, won routing preference. Hurricane Electric’s extensive peering amplified propagation.

The rogue DNS server selectively responded to queries for myetherwallet.com, resolving to a phishing site in Russia with a self-signed certificate. Legitimate Route 53 queries were dropped or forwarded, minimizing detection. Users ignoring HTTPS warnings fell victim, losing over $150,000 in Ethereum.

1. Compromise ISP router (AS10297).
2. Announce more-specific prefixes (e.g., 205.251.192.0/24).
3. Host rogue DNS responding only to high-value domains.
4. Harvest credentials via phishing replica.

Collateral impact hit sites like Instagram and CNN hosted on Route 53, causing intermittent resolution failures.

Impact on Users and the Broader Ecosystem

The primary target was MyEtherWallet, a popular Ethereum wallet. Users visiting the site were redirected, enabling wallet drainage. AWS confirmed no breach of their infrastructure; an upstream ISP was compromised.

Global DNS resolvers varied in exposure: NLNOG RING saw 15 new paths via AS10297. Only a fraction of traffic was hijacked, but precise targeting maximized damage. Financial losses underscored crypto sector vulnerabilities.

• Direct Losses: $150K+ Ethereum stolen.
• Service Disruptions: Temporary DNS failures for Route 53 customers.
• Trust Erosion: Highlighted reliance on trust-based routing.

Lessons Learned and Industry Response

The incident spurred calls for BGP security. Amazon mitigated by withdrawing prefixes and notifying peers. Monitoring by Cloudflare, ThousandEyes, and Kentik provided real-time visibility.

Key takeaways include implementing RPKI for prefix validation and filtering more-specific routes. Initiatives like MANRS (Mutually Agreed Norms for Routing Security) gained traction.

Technical Mitigations for BGP Vulnerabilities

Resource Public Key Infrastructure (RPKI)

RPKI uses cryptographic signatures to validate BGP announcements against authorized holders. ROAs (Route Origin Authorizations) prevent unauthorized origin AS claims. By 2026, adoption has grown, with major providers like Amazon deploying RPKI.

Filtering and Monitoring

ISPs should filter customer prefixes and monitor for anomalies. Tools like BGPmon and RIPE Atlas offer early detection.

• Max-prefix limits per peer.
• IRRP for prefix registry checks.
• BMP for BGP session telemetry.

Future-Proofing DNS and Routing

DNSSEC adds integrity but doesn’t prevent hijacks. Combining with BGPsec (planned authentication) could secure paths end-to-end.

Case Studies of Similar BGP Incidents

This wasn’t isolated. Past hijacks include Russia’s 2017 QUANTUM insertion and Pakistan’s 2008 YouTube block. Each reinforces the need for global standards.

FAQs

What is a BGP hijack?

A BGP hijack occurs when an attacker announces false routes, redirecting traffic from legitimate destinations.

Was Amazon’s infrastructure breached?

No, the compromise was at an upstream ISP (AS10297), not AWS.

How much was stolen in the attack?

Over $150,000 in Ethereum from MyEtherWallet users.

Can RPKI prevent such attacks?

RPKI validates origins but requires widespread adoption; it would have blocked AS10297’s claims.

Are BGP hijacks still a threat in 2026?

Yes, though mitigations like RPKI have reduced incidents, full security needs global implementation.