The Threat Landscape: Accidents and Intentional Attacks
The Threat Landscape: Accidents and Intentional Attacks
Securing an interdomain network requires an adversarial threat model. Disruption in global routing falls along a continuum: from benign clerical typos committed by tired engineers during maintenance windows, to sophisticated, state-sponsored cyber operations designed to covertly intercept encrypted communications.
Accidental Misconfiguration: The Most Common Disruption
Historically, over 90% of global routing anomalies are caused not by malicious attackers, but by accidental human misconfigurations. The most common root causes include: - Fat-finger errors: Entering 10.0.0.0/8 or a public IP block instead of a private internal block in an IGP redistribution statement. - Leaked IGP into BGP: Redistributing an entire interior routing table (containing hundreds of subnets) into external BGP without an attached route-map or prefix filter. - Omission of export filters: Bringing up a new eBGP transit session with an upstream provider while forgetting to apply an outbound route filter, inadvertently advertising full-table routes learned from other upstreams.
Because BGP treats every received UPDATE with equal validity, a single typo in a remote edge router in Melbourne can disrupt connectivity for millions of users in North America within 60 seconds.
Origin Prefix Hijacking and Impersonation
In an Origin Prefix Hijack, an unauthorized Autonomous System (\(AS_{\text{bad}}\)) announces an IP prefix \(P\) that belongs to another network (\(AS_{\text{victim}}\)), falsely claiming that it is the legitimate origin:
\[\text{Legitimate Announcement:} \quad P \longleftarrow [AS_{\text{transit}}, AS_{\text{victim}}]\] \[\text{Hijack Announcement:} \quad P \longleftarrow [AS_{\text{bad}}]\]
+------------------------------------+
| Remote Internet Observer (AS400) |
+-----------------+------------------+
|
+------------+------------+
| |
v v
AS_PATH: [AS200, AS100] AS_PATH: [AS300, AS666]
(Length: 2 AS hops) (Length: 2 AS hops)
| |
v v
+---------+ +---------+
| AS200 | | AS300 |
+----+----+ +----+----+
| |
v v
+----+----+ +----+----+
| AS100 | | AS666 |
| Legitimate Origin | Adversary Origin
| Prefix: 198.51.100.0/24 | Prefix: 198.51.100.0/24 (Exact-Match Hijack)
+---------+ +---------+When an exact-match hijack occurs, the Internet splits: routers topologically closer to \(AS_{\text{bad}}\) route traffic to the attacker, while routers closer to \(AS_{\text{victim}}\) continue routing to the legitimate owner.
Subprefix Hijacking and Splitting
A Subprefix Hijack exploits the fundamental rule of IP packet forwarding: Longest Prefix Match (LPM). Forwarding hardware in every router always prefers a more specific route over a covering aggregate.
If the legitimate owner announces an aggregate block: \[\text{Legitimate:} \quad 198.51.100.0/22 \quad (\text{Addresses: } 198.51.100.0 - 198.51.103.255)\]
The attacker announces two constituent subprefixes: \[\text{Attacker:} \quad 198.51.100.0/24 \quad\text{and}\quad 198.51.101.0/24\]
Because /24 is a longer mask than /22, every router on Earth will prefer the attacker’s route, regardless of LOCAL_PREF, AS_PATH length, or topological distance. The hijack is 100% effective globally.
Route Leaks: Transit Rules Violated
Formally defined in RFC 7908, a Route Leak occurs when a multihomed Autonomous System receives a route from one transit provider or peer, and re-advertises it to another transit provider or peer in violation of standard commercial transit agreements.
+--------------------+ +--------------------+
| Transit Provider A | | Transit Provider B |
+---------+----------+ +---------+----------+
| ^
| (Sends Google /24) | (Illegitimate Leak)
v |
+----+-------------------------------+----+
| Small Customer / Enterprise |
| (Leaking AS) |
+-----------------------------------------+When Customer AS advertises routes learned from Provider A to Provider B, Provider B sees Customer as the lowest-cost path. Provider B diverts massive traffic streams destined for major content networks (Google, AWS, Cloudflare) through Customer’s modest 1 Gbps uplink. The customer router’s interfaces instantly saturate, inducing massive global packet loss.
Blackholing and Traffic Interception
Depending on how the attacker configures its data plane, a hijack manifests in one of two ways: - Blackholing (Denial of Service): The attacker advertises the prefix but discards all incoming packets (null0 / drop). Legitimate services become completely unreachable. - Traffic Interception (Man-in-the-Middle): The attacker captures, inspects, or modifies incoming traffic, and then forwards the packets onward to the true destination via a clean, secondary tunnel (e.g., GRE or WireGuard) to avoid detection.
AS_PATH Manipulation and Policy Exploitation
Because BGP lacks cryptographic path integrity, an attacker can modify the AS_PATH attribute before transmitting an UPDATE: - AS_PATH Prepending Abuse: An attacker injects victim ASNs into the path to trigger loop-detection defenses in targeted networks, effectively cutting off their visibility. - Fake 1-Hop Paths: An attacker announces a stolen route while forging a direct connection to a Tier-1 provider (AS_PATH: [Tier1_ASN]), tricking downstream networks into preferring the forged path over legitimate multi-hop routes.
Control-Plane Exhaustion and Volumetric Attacks
Routers maintain routing tables in expensive Ternary Content-Addressable Memory (TCAM) and process updates using onboard CPUs. Attackers can exploit this through: - Table Bloat: Inundating an edge router with hundreds of thousands of disaggregated /24 prefixes, exhausting router RAM or exceeding hardware TCAM limits, causing line cards to crash. - Update Churn: Generating rapid bursts of advertisements and withdrawals designed to drive control-plane CPU utilization to 100%, causing BGP keepalive timeouts and triggering cascading session resets across the network.
Compromised Routers and Network Operators
The threat model must account for insider threats: - Rogue / Hostile ISPs: Commercial or state-owned telcos that intentionally weaponize their transit sessions to hijack financial services or suppress dissidents. - Compromised Edge Devices: Internet-exposed router management interfaces (SSH, RESTCONF, SNMP) compromised via credential stuffing or zero-day vulnerabilities, allowing adversaries to directly alter BGP configurations.