BGP hijacking is a serious network security threat where an attacker injects false BGP routes into the global routing system, diverting traffic to malicious destinations, blackholing it, or enabling man-in-the-middle (MITM) attacks.
🚨 How BGP Hijacking Occurs
BGP (Border Gateway Protocol) works on trust — any Autonomous System (AS) can announce prefixes without built-in validation. BGP hijacking exploits this:
🔧 Common Types of BGP Hijacks:
-
Prefix Hijack
-
An AS announces a prefix it doesn’t own (e.g., AS64500 advertises 192.0.2.0/24).
-
If upstream providers accept and propagate this, traffic destined to the real owner is rerouted to the hijacker.
-
-
Subprefix Hijack
-
Hijacker announces a more specific prefix (e.g., 192.0.2.0/25 instead of 192.0.2.0/24).
-
Since BGP prefers longer matches, this overrides the legitimate route.
-
-
AS Path Manipulation
-
Hijacker spoofs an AS path to appear as a legitimate route.
-
Can be used to hide the origin or manipulate routing decisions.
-
-
Man-in-the-Middle (MITM)
-
Traffic is rerouted through the attacker, observed or modified, then forwarded to the correct destination.
-
🛡️ How to Prevent BGP Hijacking
✅ 1. Use RPKI (Resource Public Key Infrastructure)
-
Validates that an AS is authorized to originate specific prefixes.
-
Uses ROAs (Route Origin Authorizations) to cryptographically bind IP prefixes to AS numbers.
-
Routers can be configured to drop "invalid" routes.
RPKI is the most effective tool to prevent prefix hijacking today.
✅ 2. Prefix Filtering (by ISPs and peers)
-
Only allow customers to announce prefixes they own.
-
Maintain prefix-lists or use IRR databases (e.g., RADb) to validate announcements.
ISPs must implement filtering for their customers to avoid propagating hijacks.
✅ 3. Max Prefix Limits
-
Prevents a peer or customer from announcing an unexpected number of routes (helps detect hijacks or leaks).
✅ 4. BGP Session Security
-
Use MD5 authentication to secure BGP sessions (prevents session hijacking).
-
Deploy TTL Security Hack (GTSM) to protect against spoofed BGP packets.
✅ 5. BGP Monitoring and Detection
-
Use tools and services like:
-
BGPMon
-
RIPE RIS
-
ARIN's Route Origin Validation
-
Cloudflare's BGPStream
-
-
Set up alerting for unexpected changes in your prefix announcements.
✅ 6. Route Dampening and Filtering
-
Apply route dampening to suppress unstable prefixes.
-
Filter bogon IP space and suspicious AS paths.
🌐 Global Coordination
-
Work with Regional Internet Registries (RIRs) and participate in MANRS (Mutually Agreed Norms for Routing Security).
-
Join RPKI validator communities and route collector projects.
✅ Summary Table
| Prevention Method | Benefit |
|---|---|
| RPKI | Validates prefix origins |
| Prefix Filtering | Stops invalid announcements |
| Max Prefix Limits | Limits large leaks or attacks |
| BGP MD5/TTL Security | Protects session integrity |
| Monitoring Tools | Detects and alerts on hijacks |
| Routing Policies | Enforce route control |