HEAP: Reliable Assessment of BGP Hijacking Attacks

Abstract

The detection of BGP prefix hijacking attacks has been the focus of research for more than a decade. However, stateof-the-art techniques fall short of detecting more elaborate types of attack. To study such attacks, we devise a novel formalization of Internet routing, and apply this model to routing anomalies in order to establish a comprehensive attacker model. We use this model to precisely classify attacks and to evaluate their impact and detectability. We analyze the eligibility of attack tactics that suit an attacker's goals and demonstrate that related work mostly focuses on less impactful kinds of attacks.We further propose, implement and test the Hijacking Event Analysis Program (HEAP), a new approach to investigate hijacking alarms. Our approach is designed to seamlessly integrate with previous work in order to reduce the high rates of false alarms inherent to these techniques. We leverage several unique data sources that can reliably disprove malicious intent. First, we make use of an Internet Routing Registry to derive business or organisational relationships between the parties involved in an event. Second, we use a topology-based reasoning algorithm to rule out events caused by legitimate operational practice. Finally, we use Internet-wide network scans to identify SSL/TLS-enabled hosts, which helps to identify non-malicious events by comparing public keys prior to and during an event. In our evaluation, we prove the effectiveness of our approach, and show that day-today routing anomalies are harmless for the most part. More importantly, we use HEAP to assess the validity of publicly reported alarms. We invite researchers to interface with HEAP in order to cross-check and narrow down their hijacking alerts.

Sico

“…Though hijack attacks can be effective for many adversarial objectives (e.g., setting up phishing websites and spoofing DNS responses [49]), they disrupt connectivity for hosts in the victim's network. In contrast, interception attacks preserve connectivity in the data plane, making them much harder to detect than hijack attacks (as seen in [77,86], data-plane connectivity is a common method for detecting hijack attacks).…”

ARTEMIS: Neutralizing BGP Hijacking Within a Minute

“…The effect of a hijack is to redirect traffic for the affected prefix to/through the network of the hijacker AS. This attracted traffic can be (i) dropped (blackholing, BH), (ii) manipulated or eavesdropped and then sent on to the victim AS1 (manin-the-middle, MM), or (iii) used in an impersonation of the [25] (2006) [40] (2008) [68] (2007) [69] (2016) [59] (2012) [63] (2007) [36]…”

“…Reactive defenses comprise two steps: detection and mitigation. Several systems have been proposed for prefix hijacking detection [25], [36], [40], [59], [63], [68], [69], with most of them being designed to operate as third-party services; they monitor the Internet control/data plane and upon the detection of a suspicious event or anomaly, notify the involved ASes. Our survey reveals a similar trend in practice: more than 60% rely on third-parties (e.g., [8]) to get notified about suspicious events involving their prefixes.…”

“…Hybrid approaches [36], [59], [63], [55], [58] combine control and data plane information, and sometimes query external databases (e.g., Internet Routing Registries, IRR) [59], [63], to detect multiple classes of hijacking events. HEAP [59] can detect any type of AS-PATH manipulation on the control plane, but is limited to sub-prefix hijacking events which result in blackholing or imposture on the data plane. Thus, it misses MM attacks both for exact prefix and sub-prefix hijacks.…”

Profiling BGP Serial Hijackers

“…As a result, BGP hijacks are a prevalent threat and concern for network operators [48]. There have been many efforts in the research community to characterize BGP hijacking events [28,56] and to develop hijack detection systems using different approaches, metrics, and vantage points [22,27,42,43,46,49,50,57]. While most systems focus on detecting individual BGP hijacking events, some attempt to identify the source of the cause and a few even tackle mitigation and remediation [7].…”