Origin Hijacking Attacks: Mechanics, Impact and Detection

Author

K19G

Updated

October 31, 2026

Origin Hijacking Attacks: Mechanics, Impact and Detection

Origin prefix hijacking is the archetypal interdomain routing attack. In an origin hijack, an attacker illegitimately announces an IP block from its own Autonomous System, corrupting the global mapping between prefixes and authoritative origin networks.

Attack Prerequisites and Execution Steps

Executing an origin prefix hijack requires minimal technical resources:

[Attacker with BGP Peering]
             |
             | 1. Configure prefix under local BGP daemon (e.g., FRR/BIRD)
             v
   "network 203.0.113.0/24"
             |
             | 2. Upstream transit provider lacks strict prefix filtering
             v
  [Upstream ISP Border Router]
             |
             | 3. ISP accepts and propagates UPDATE to peers and Tier-1s
             v
 [Global Internet DFZ (Default-Free Zone)]

Step 1: Upstream Peering Access

The attacker must operate or control an Autonomous System with an active eBGP peering session to at least one upstream transit provider or IXP.

Step 2: Identification of Unfiltered Upstream

The attacker identifies an upstream provider that fails to enforce strict prefix-list filtering (e.g., relying on loose customer filters or failing to validate against IRR databases).

Step 3: Prefix Injection

The attacker adds the victim’s prefix to its BGP configuration (e.g., in FRR: network 203.0.113.0/24) and applies an export policy.

Step 4: Upstream Propagation

The upstream provider accepts the announcement, prepends its own ASN, and propagates the UPDATE across its transit mesh. Within 30 to 60 seconds, routers globally evaluate the new path.

Complete vs. Partial Hijacking

The blast radius of an origin hijack depends entirely on prefix specificity:

1. Complete Hijacking (Subprefix / More-Specific)

If the victim announces /22 and the attacker announces /24, every BGP speaker in the world that receives the announcement will direct traffic to the attacker due to Longest Prefix Match (LPM). The victim experiences a complete global blackout for that /24 address space.

2. Partial Hijacking (Exact-Match)

If both the victim and the attacker announce the identical /24 prefix, the Internet bifurcates based on the BGP decision process (principally LOCAL_PREF and AS_PATH length): - Networks that have a direct peering or shorter AS path to the attacker route to the attacker. - Networks closer to the victim continue routing to the victim. - Upstream Tier-1 providers with high-degree mesh connectivity become battlegrounds where small differences in propagation time or path length decide the winner.

Confidentiality and Integrity Implications

Once an attacker intercepts traffic, severe security breaches become possible: - Traffic Sniffing and Decryption: Unencrypted traffic (DNS, HTTP, unauthenticated database replication) is captured in plaintext. If TLS is used, the attacker can log metadata (IP flows, SNI headers, packet timing) or attempt SSL stripping. - Data Modification: The attacker acts as an active proxy, altering DNS responses or inserting malicious payloads into unencrypted data streams.

How Hijacking Enables Phishing and MITM

Origin hijacking is frequently combined with automated Certificate Authority (CA) exploitation:

+----------+      1. BGP Hijack of /24      +----------+
| Attacker | -----------------------------> |  Victim  |
+----+-----+                                +----------+
     |
     | 2. Attacker now controls HTTP on victim's IP
     v
+----+------------------------------------------------+
| ACME Automated Certificate Authority (Let's Encrypt)|
+----+------------------------------------------------+
     |
     | 3. Attacker requests TLS cert for victim.com
     | 4. CA issues HTTP-01 challenge to http://victim.com/.well-known/acme-challenge/
     | 5. Challenge arrives at ATTACKER's server!
     v
+----+-----+
| Attacker | ---> Challenge Validated! CA issues signed, valid TLS Certificate!
+----------+
  1. The attacker hijacks the IP prefix hosting the victim’s web infrastructure.
  2. The attacker requests a new TLS certificate from an ACME-based Certificate Authority (such as Let’s Encrypt) for target-bank.com.
  3. The CA performs an HTTP-01 domain validation challenge, sending an HTTP GET request to target-bank.com/.well-known/acme-challenge/<TOKEN>.
  4. Because the attacker controls the IP in BGP, the CA’s probe routes directly to the attacker’s server, which responds with the token.
  5. The CA issues a cryptographically valid, trusted TLS certificate.
  6. The attacker can now terminate TLS connections from legitimate users with green browser padlocks, capturing credentials and session tokens without triggering browser certificate warnings.

Detection via Route Monitors, Looking Glasses and Real-Time Alerts

Detecting an origin hijack requires external vantage points:

  • Public Route Collectors: Projects like RouteViews (University of Oregon) and RIPE RIS (Routing Information Service) peer with hundreds of border routers globally, logging all BGP updates and periodic table dumps into public archives.
  • Looking Glasses: Public web interfaces provided by Tier-1 providers allowing operators to execute show ip bgp <prefix> from their internal core routers.
  • Real-Time Streaming Telemetry:
    • RIS-Live: Real-time WebSocket firehose of global BGP updates.
    • BGPStream: Open-source framework for processing real-time BGP telemetry.
    • Commercial Alerting: Tools like Cloudflare Radar, Cisco ThousandEyes, and Kentik monitor customer prefixes and trigger SMS/webhook alerts when an unexpected origin ASN appears in an AS_PATH.

The Role of RPKI and ROV in Origin Hijacking Prevention

The definitive cryptographic defense against origin hijacking is Resource Public Key Infrastructure (RPKI) combined with Route Origin Validation (ROV).

Under RPKI: 1. The prefix owner signs a cryptographic Route Origin Authorization (ROA) stating: Only AS100 is authorized to originate 198.51.100.0/24 up to maxLength /24. 2. Remote routers fetch these validated ROAs. 3. When the attacker (\(AS666\)) announces 198.51.100.0/24, routers evaluating ROV flag the announcement as Invalid. 4. The router automatically drops the Invalid announcement, completely neutralizing the hijack at the border.