A study of prefix hijacking and interception in the internet

Abstract

There have been many incidents of prefix hijacking in the Internet. The hijacking AS can blackhole the hijacked traffic. Alternatively, it can transparently intercept the hijacked traffic by forwarding it onto the owner. This paper presents a study of such prefix hijacking and interception with the following contributions: (1). We present a methodology for prefix interception, (2). We estimate the fraction of traffic to any prefix that can be hijacked and intercepted in the Internet today, (3). The interception methodology is implemented and used to intercept real traffic to our prefix, (4). We conduct a detailed study to detect ongoing prefix interception. We find that: Our hijacking estimates are in line with the impact of past hijacking incidents and show that ASes higher up in the routing hierarchy can hijack a significant amount of traffic to any prefix, including popular prefixes. A less apparent result is that the same holds for prefix interception too. Further, our implementation shows that intercepting traffic to a prefix in the Internet is almost as simple as hijacking it. Finally, while we fail to detect ongoing prefix interception, the detection exercise highlights some of the challenges posed by the prefix interception problem.

An accurate distributed scheme for detection of prefix interception

“…Prefix interception generally refers to the Internet traffic interception based on prefix hijacking [17]. However, some other features in BGP protocol, such as valley-free rule [18,19] and AS-Path prepending, can also be exploited to launch a prefix interception attack [11,20].…”

“…Thus, prefix interception does not result in black holes. Second, prefix interception is often based on prefix hijacking [17], and hence they share the same anomaly in control plane. As a result, monitoring anomalous BGP routes is not enough to identify a prefix interception, as the actual forwarding path is needed to distinguish prefix interception from prefix hijacking.…”

DNSSEC for cyber forensics

“…( , has a long history of route hijacking attacks [14], but it still does not employ cryptographic defences to guarantee routing correctness. Trivially, redirecting traffic via a different route or network can provide the attacker with MitM capabilities.…”

“…Since BGP does not employ authentication mechanisms, originators of BGP routing announcements may claim prefixes belonging to other networks or may change routing path (by adding or removing links), e.g., due to benign failures or malicious attacks. Attackers can hijack prefixes by advertising invalid origin or invalid next hop [14]. There is a large body of research studying attacks on BGP routing, e.g., route hijacking and route injection that damage network operation or connectivity.…”

Architectural Framework for Secure Composite Web Services

“…Such a situation has motivated us greatly to develop a framework [9] for academic-related web services. While providing several benefits, web services technology has been facing serious threats like prefix hijacking and interception [10] in the Internet due to a man-in-the-middle attack [11]. Therefore, security has become the key issue in the field of web services technology.…”