Undefined: BGP Hijacking, MANRS, RPKI, And Practical Fixes Now

The Internet’s backbone relies on Border Gateway Protocol (BGP) to direct data across vast networks. Yet, this essential system faces persistent threats from hijacking events that can reroute traffic maliciously, leading to financial losses, service disruptions, and privacy breaches. Recent incidents underscore the vulnerability of BGP and highlight the growing importance of collaborative security measures like the Mutually Agreed Norms for Routing Security (MANRS).

Understanding BGP Fundamentals

BGP serves as the routing protocol connecting autonomous systems (ASes), which are collections of IP networks under single administrative control. Each AS announces routes to its prefixes—blocks of IP addresses—to peers, enabling global reachability. Trust is implicit: BGP accepts announcements without inherent validation of origin or legitimacy.

This design, rooted in the Internet’s early cooperative ethos, assumes good faith among operators. However, misconfigurations or deliberate actions can inject false routes, diverting traffic through unintended paths. Such events expose users to interception, denial-of-service, or data theft.

Real-World BGP Hijacking Incidents

High-profile cases illustrate BGP’s risks. In one notable 2018 event, attackers hijacked routes to Amazon’s Route 53 DNS infrastructure (AS16509). The perpetrator, using AS10297 (eNet Inc.), announced these prefixes via Hurricane Electric (AS6939). For two hours, queries to affected DNS servers were redirected to a malicious server in a Chicago Equinix data center.

This man-in-the-middle setup targeted MyEtherWallet.com users, tricking them into authorizing Ethereum transfers. Approximately $150,000 in cryptocurrency was stolen as victims interacted with a fake interface mimicking the legitimate site. Even Cloudflare’s 1.1.1.1 resolver in multiple regions returned poisoned responses, amplifying the attack’s reach.

Similar incidents persist. Analysis from BGPStream data shows prefix hijacks averaging 14 per day in mid-2020, with 2021 featuring major leaks despite some mitigation progress. These events slow connectivity, blackhole traffic, or enable surveillance.

• Route Leaks: Unintended propagation of customer routes to the global table, causing instability.
• Prefix Hijacks: Malicious origination of another network’s prefixes.
• IP Spoofing: Forged source addresses exploiting weak ingress filtering.

Consequences of Unsecured Routing

BGP vulnerabilities ripple across the ecosystem. Financial services suffer direct theft, as seen in cryptocurrency drains. E-commerce and cloud providers face outages when routes are withdrawn or blackholed. Nation-state actors have historically hijacked traffic for espionage, underscoring geopolitical stakes.

Economically, disruptions compound: a single hijack can cascade, affecting millions. In 2021, BGP incidents declined in propagation due to better peer filtering, but absolute events remained high. Without intervention, reliance on BGP’s trust model invites escalating threats.

MANRS: A Blueprint for Routing Resilience

Developed by the Internet Society, MANRS unites network operators and Internet Exchange Points (IXPs) around actionable norms. Participation signals commitment to baseline protections, fostering collective defense.

Core actions include:

• Filtering: Block propagation of invalid routes using prefix lists, AS-sets, and IRR data.
• Anti-Spoofing: Prevent source IP forgery with ingress/egress filtering (BCP38/84).
• Global Validation: Publish accurate routing policies in IRRs and support RPKI.
• Coordination: Report incidents rapidly via channels like NANOG or local forums.

IXP-specific measures add peering safeguards. By 2021, MANRS membership surged, correlating with reduced hijack propagation.

RPKI and Cryptographic Defenses

Resource Public Key Infrastructure (RPKI) addresses BGP’s validation gap. Regional Internet Registries (RIRs) issue Route Origin Authorizations (ROAs)—cryptographic proofs of prefix ownership. Operators deploy Route Origin Validation (ROV) to discard invalid announcements.

While RPKI mitigates origin fraud, forged-origin hijacks evade it if ROAs exist but filters fail. Complementary IRR-based filtering remains vital.

Implementing Robust Filtering Strategies

Effective filtering demands accuracy. Operators maintain AS-sets in IRRs, defining aggregate prefixes. Peers apply customer-import policies rejecting non-matching announcements. Tools like rpki-client or router vendor ROV simplify deployment.

Challenges persist: stale IRR data or hijacker control over registries. Regular audits and automation are essential. MANRS encourages monitoring via BGPStream for anomaly detection.

Operator Responsibilities in a Shared Ecosystem

No network operates in isolation. A single unfiltered peer can amplify global incidents. MANRS promotes shared accountability: implement norms, promote adoption, and assist peers.

Large transit providers wield outsized influence; their filtering thwarts propagation. Incentives include reputational gains, SLA improvements, and incident coordination networks.

Future Directions in Routing Security

Progress is evident—2021 saw RPKI uptake and MANRS growth—but gaps remain. Emerging standards like BGPsec promise end-to-end path validation, though deployment lags. AI-driven monitoring could preempt anomalies.

Policy efforts urge RIRs and governments to prioritize routing security. Full MANRS implementation across operators would drastically curb threats.

Frequently Asked Questions

What causes BGP hijacking?

Hijacks stem from configuration errors or malice, exploiting BGP’s lack of origin checks. Attackers announce foreign prefixes, diverting traffic.

How does MANRS prevent incidents?

MANRS enforces filtering, anti-spoofing, validation, and coordination, creating a security baseline for participants.

Is RPKI a complete solution?

No; it validates origins but not paths. Combine with filtering for comprehensive protection.

Who should implement these measures?

All network operators, especially transit providers and IXPs, to safeguard the shared routing table.

Can individuals protect against BGP issues?

Users benefit indirectly via secure providers. Choose MANRS-compliant services and use DNSSEC.