A forensic case study on as hijacking

Abstract

The Border Gateway Protocol (BGP) was designed without security in mind. Until today, this fact makes the Internet vulnerable to hijacking attacks that intercept or blackhole Internet traffic. So far, significant effort has been put into the detection of IP prefix hijacking, while AS hijacking has received little attention. AS hijacking is more sophisticated than IP prefix hijacking, and is aimed at a long-term benefit such as over a duration of months. In this paper, we study a malicious case of AS hijacking, carried out in order to send spam from the victim's network. We thoroughly investigate this AS hijacking incident using live data from both the control and the data plane. Our analysis yields insights into how an attacker proceeded in order to covertly hijack a whole autonomous system, how he misled an upstream provider, and how he used an unallocated address space. We further show that state of the art techniques to prevent hijacking are not fully capable of dealing with this kind of attack. We also derive guidelines on how to conduct future forensic studies of AS hijacking. Our findings show that there is a need for preventive measures that would allow to anticipate AS hijacking and we outline the design of an early warning system.

It Bends But Would It Break? Topological Analysis of BGP Infrastructures in Europe

“…In either case, the result of a prefix hijack is having rogue entries in the routing tables which may in turn cause disruptions or denial of service. Furthermore, the attacker (if any) could exploit the redirected traffic to carry out other attacks such as spamming [27], phishing [28], or Man In The Middle (MITM) operations [25], [26], [36]. In many cases, the recipient of the misdirected traffic collapses under the unexpected load.…”

“…However simple at such a small scale, the model becomes relevant when applied to the thousands of routes handled by core transit providers. Model discussion: Counting the number of affected ASs and paths is the usual model for BGP disruptions in the literature [7], [8], [25], [27], [29], [30], [32]. This method is sometimes refined by counting affected prefixes [27], [29], [30] which allows to measure their length [30] or count affected IPs [29].…”

Collaborative Network Security: Targeting Wide-area Routing and Edge-network Attacks

“…Unfortunately, miscreants are becoming increasingly sophisticated and security attacks are no longer isolated events. Instead, attacks often cover multiple domains and behaviors [13,16,17]. For example, Ramchandran et al [13] found that routing anomalies and botnets are exploited by spammers to avoid detection while sending spam, making it difficult for a single network acting on its own to detect the attack.…”

Malicious BGP hijacks: Appearances can be deceiving

“…In theory, spammers using this technique are able to circumvent backtracking and traditional IP-based blacklisting due to the short-lived nature of the attack. More recently, a validated case of a BGP hijack specifically carried out to send spam from the stolen prefixes was reported in [12], [13]. Unlike the first observations of fly-by spammers, this incident involved a long-term hijack attack of several months and was confirmed by the owner of the victim network.…”

“…Some works [13], [16], [17] have carried out forensic analyses of well known hijacks. Others have attempted to validate observed suspicious routing events [2], [11], [18] usually in the context of the evaluation of a hijack detection technique.…”