said by wentlanc :

Perhaps monitoring routing tables for AS path changes would be key to picking up this kind of exploit?

cw

A handful of academic groups collect BGP routing information from cooperating ASes to monitor BGP updates that change traffic's path. But without context, it can be difficult to distinguish a legitimate change from a malicious hijacking. There are reasons traffic that ordinarily travels one path could suddenly switch to another -- say, if companies with separate ASes merged, or if a natural disaster put one network out of commission and another AS adopted its traffic. On good days, routing paths can remain fairly static. But "when the internet has a bad hair day," Kent said, "the rate of (BGP path) updates goes up by a factor of 200 to 400."

Kapela said eavesdropping could be thwarted if ISPs aggressively filtered to allow only authorized peers to draw traffic from their routers, and only for specific IP prefixes. But filtering is labor intensive, and if just one ISP declines to participate, it "breaks it for the rest of us," he said.

"Providers can prevent our attack absolutely 100 percent," Kapela said. "They simply don't because it takes work, and to do sufficient filtering to prevent these kinds of attacks on a global scale is cost prohibitive."

said by Ignite :

Perhaps nothing more interesting than ensuring all your BGP peers are using MD5 authentication would mitigate this.

Kent and BBN colleagues developed Secure BGP (SBGP), which would require BGP routers to digitally sign with a private key any prefix advertisement they propagated. An ISP would give peer routers certificates authorizing them to route its traffic; each peer on a route would sign a route advertisement and forward it to the next authorized hop.

"That means that nobody could put themselves into the chain, into the path, unless they had been authorized to do so by the preceding AS router in the path," Kent said.

The drawback to this solution is that current routers lack the memory and processing power to generate and validate signatures. And router vendors have resisted upgrading them because their clients, ISPs, haven't demanded it, due to the cost and man hours involved in swapping out routers.

said by asdfdfdfdfdfdf :

I think you are right. What annoys me though, is when I read things like:

quote:

---

who testified to Congress in 1998 that he could bring down the internet in 30 minutes using a similar BGP attack, and disclosed privately to government agents how BGP could also be exploited to eavesdrop. "I went around screaming my head about this about ten or twelve years ago.... We described this to intelligence agencies and to the National Security Council, in detail."

---

quote:

---

Stephen Kent, chief scientist for information security at BBN Technologies, who has been working on solutions to fix the issue, said he demonstrated a similar BGP interception privately for the Departments of Defense and Homeland Security a few years ago.

---

Our government insists that they need backdoors and broad powers to monitor anyone's communications without fussy things like warrants and they talk of dire scenarios like terrorists bringing down our communications infrastructure and plunging us into chaos and and yet this same government can't be bothered to light fires under some asses to make sure resources are devoted to getting this sort of thing fixed.
Should make us wonder whether they believe their own breathless rhetoric.

said by Morac :

... you don't want people to read your data, encrypt it.

said by Dryvlyne :

I think your missing an important point...

quote:

---

The tactic, which one hacker claims is bigger than the recent DNS exploit, lets an attacker monitor unencrypted internet traffic anywhere in the world, and even modify it before it reaches its destination.

---

said by Dryvlyne :
The real problem with the Internet, in general, is that it was built upon the presumed trust between 2 or more machines. I just don't understand how the "fathers" of the Internet couldn't have predicted that it would somehow be abused and that proper precautions should have been instituted in the first place!

said by espaeth :

To pull this off you need a lot of access

said by espaeth :

and you need a considerable investment in infrastructure

said by espaeth :

and to get a carrier circuit with BGP

said by espaeth :

to start you need to prove you own a netblock ($$ to ARIN)

said by espaeth :

you need to prove you own an ASN ($$ to ARIN)

said by espaeth :

and you're going to need to sign contracts for connectivity with a hefty up-front install fee

said by espaeth :

1) You need to be able to source a more specific route from a network you don't own through your upstream provider. Many backbone providers strictly enforce which routes you can originat, so you'd have to find one that will play ball.

said by espaeth :

2) Even if you get the taffic to successfully come to you, you need to overcome the blackhole effect that you create to forward the traffic on to the final destination. (ie, you can't just send it back upstream or the destination traffic will just come right back to you)