Investigating the Nature of Routing Anomalies: Closing in on Subprefix Hijacking Attacks

Abstract

The detection of BGP hijacking attacks has been at the focus of research for more than a decade. However, state-of-the-art techniques fall short of detecting subprefix hijacking, where smaller parts of a victim's networks are targeted by an attacker. The analysis of corresponding routing anomalies, so-called subMOAS events, is tedious since these anomalies are numerous and mostly have legitimate reasons. In this paper, we propose, implement and test a new approach to investigate subMOAS events. Our method combines input from several data sources that can reliably disprove malicious intent. First, we make use of the database of a Internet Routing Registry (IRR) to derive business relations between the parties involved in a subMOAS event. Second, we use a topology-based reasoning algorithm to rule out subMOAS events caused by legitimate network setups. Finally, we use Internet-wide network scans to identify SSL-enabled hosts in a large number of subnets. Where we observe that public/private key pairs do not change during an event, we can eliminate the possibility of an attack. We can show that subprefix announcements with multiple origins are harmless for the largest part. This significantly reduces the search space in which we need to look for hijacking attacks.

TLS in the Wild: An Internet-wide Analysis of TLS-based Protocols for Electronic Communication

“…We used a blacklist of IP ranges generated during past scans [14,42]. At the time of writing, it contains 177 entries covering 2.6 million addresses (about 0.08% of the routable space).…”

HEAP: Reliable Assessment of BGP Hijacking Attacks

“…If we succeed with b), the suspected attacker holds ownership rights for the prefix and is thus authorized to originate the prefix from his AS. Compared to our previous work [11], we extended this filter to support the IRR databases provided by all five RIRs. Note that we transform all IRR databases into the RIPE data model as presented in Figure 3, since it is most consistent and represents a superset of all available information.…”

“…We propose a novel Hijacking Event Analysis Program (HEAP) to reliably assess hijacking alarms. We combine techniques from prior work [11], [12] to identify incidents with legitimate cause. Our goal is not to develop a new alarm system.…”

“…This Hijacking Event Analysis Program (HEAP) is introduced as an automated system to reason about elaborate routing attacks. We leverage a carefully selected set of filters proposed in previous work [11], [12]. With HEAP, we strive to reliably identify legitimate events, i.e.…”

The state of affairs in BGP security: A survey of attacks and defenses

“…To prevent a large quantity of false positives, Schlamp et al [178,179] tried to detect subprefix hijack attacks by using update messages to retrieve candidates of hijacked prefixes and conducting active scans of SSL/TLS-enabled hosts within these networks. If the hosts use different public keys before and during the potential subprefix hijack event, this event is considered as a real attack.…”