On the Effectiveness of BGP Hijackers That Evade Public Route Collectors

Abstract

Routing hijack attacks have plagued the Internet for decades. After many failed mitigation attempts, recent Internet-wide BGP monitoring infrastructures relying on distributed route collection systems, called route collectors, give us hope that future monitor systems can quickly detect and ultimately mitigate hijacks. In this paper, we investigate the effectiveness of public route collectors with respect to future attackers deliberately engineering longer hijacks to avoid being recorded by route collectors. Our extensive simulations (and attacks we device) show that monitor-based systems may be unable to observe many carefully crafted hijacks diverting traffic from thousands of ASes. Hijackers could predict whether their attacks would propagate to some BGP feeders (i.e., monitors) of public route collectors. Then, manipulate BGP route propagation so that the attack never reaches those monitors. This observation remains true when considering plausible future Internet topologies, with more IXP links and up to 4 times more monitors peering with route collectors. We then evaluate the feasibility of performing hijacks not observed by route collectors in the real-world. We experiment with two classifiers to predict the monitors that are dangerous to report the attack to route collectors, one based on monitor proximities (i.e., shortest path lengths) and another based on Gao-Rexford routing policies. We show that a proximity-based classifier could be sufficient for the hijacker to identify all dangerous monitors for hijacks announced to peer-to-peer neighbors. For hijacks announced to transit networks, a Gao-Rexford classifier reduces wrong inferences by ≥ 91% without introducing new misclassifications for existing dangerous monitors.

Hidden-SAGE: For the Inference of Complex Autonomous System Business Relationships Involving Hidden Links

“…These hidden AS links not only introduce incompleteness to the Internet's AS-level topology but also pose significant risks to routing security. Milolidakis [8] discovered through research that attackers can exploit these hidden links by intricately designing route announcements to evade the observation of route collectors, thereby executing attacks such as path spoofing [9] and prefix hijacking [10]. Additionally, the business relationship between the two ends of these hidden links remains unclear since the links cannot be observed in BGP routing data.…”

Internet Science Moonshot

“…However, given the information-hiding character of BGP, the current collection strategies do not provide comprehensive visibility of the global routing system. Researchers have recently demonstrated how strategically-scoped attacks can evade visibility of current collection systems [12].…”