Is BGP Safe Yet?

SS7 networks are basically wide open, with no auth and anyone can get an SS7 hub for cheap and start sending nefarious commands to peoples handsets. They can forward or record calls and read SMS. They can track you or they could just be a jerk and keep rebooting your phone. Worse still it can be used to intercept 2FA codes over SMS, which is the approach a lot of banks are taking for personal account security. intelligence agencies are without a doubt using it for intercepting and tracking.

The Telcos are lost with how to address the issues combined with cost considerations, so most are taking the approach of hoping it stays out of the news and waiting for it to eventually be deprecated from the network.

I (other account) once submitted their work to HN to see what real smart people thought about it, but it got 0 traction.

Edit: It's true. RPKI works, it's just harder to use than not using it, and network engineers have been doing bgp without rpki since forever. Managing PKI is outside the scope of a Cisco flat file and so it's not getting done. Route maps are easier to write than managing PKI. In the same vein IPv4 networks work and have been done since forever and as long as it's easier to shim over your v4 core and do carrier NAT and memorize dotted quads v6 will not get done with haste.

https://github.com/cloudflare/gortr

And the fact that major ISPs with complex networks like AT&T, NTT, and Telia have implemented it proves it’s possible.

[1] - https://www.arin.net/resources/manage/rpki/rpa.pdf

This isn't as damaging as being able to advertise a smaller prefix because it won't send all traffic to you. It will just send from routers where your path is shorter than the original.

To actually prevent hijacking via path shortening attacks like this, you need a full BGPSEC implementation https://en.wikipedia.org/wiki/BGPsec which is a much higher barrier than RPKI because the crypto operations jump 1 or 2 orders of magnitude (signing every re-advertised route rather than just originated routes).

So RPKI gets the cert infra in place, but it doesn't really fully solve the problem.

Remember, there are two parts here: -Signing your IP address space (generating ROAs to reference your Origin ASN and Max Prefix Length). -Implementing Origin Validation in your network (getting an RPKI validator, grabbing ROAs, talking RTR to routers).

There's also another aspect here worth calling out. Which is that RPKI at the moment doesn't address path validation. Basically, stopping routing leaks or addressing as-path spoofing. AS Path Authorization is still in the early days at the IETF, but the idea is people can piggyback off the existing RPKI infrastructure to implement it without making any major changes. Some folks will say because there is no ASPA - that Origin Validation isn't worth the effort, but I disagree with that - any bit helps to stop hijacks.

Going back to ROA generation, there are two ways to sign announcements. You can go to your RIR and use their APIs or website to do it. Some of the RIRs have okay APIs, some are not so great (which is a pain if you are into automation). You can run in delegated RPKI mode and do your own CA, but that is a fair amount of work and only a few people on the planet do it (but props to those people who have open sourced the s/w and making this easier). The other two challenges with ROA generation are that if you screw it up, it's real painful to unwind. Revoking the ROA can take hours to take effect, or publishing a new/corrected ROA can take hours. If you screw up and specify the wrong ASNs (or lets say you migrate ASNs over), or screw up the max prefix length, you can invalidate your address space on the Internet and blackhole yourself. The other issue is with ARIN - specifically the fact that people running RPKI validators have to deliberately accept the ARIN Trust Anchor for legal reasons (ARIN indemnification). There is evidence that some people are installing the validators and not adding ARINs trust anchor, resulting in not accepting any ROAs that went through ARIN - which is a big chunk of the Internet.

As for Origin Validation, there have been some great open source efforts in the last few years to make this easier to adopt (and big thanks to those whove lowered the bar here). That said, it still means building/deploying this in a robust way, enabling RTR on all your routers and writing policy to reject invalids. It's just a bunch of work and for some networks, it takes time to roll that out globally. Then there is the question of which routes do you apply validation on? What if your have customers who screwed up ROAs? Now you have to coordinate and get them to clean up their game before you turn on the switch or poke holes (nasty). Finally, you have to agree that you are going to essentially drop invalid prefixes for destinations on the Internet. That means if someone on the other side of the world screws up a ROA, you're not routing to them. You've got to be prepared to tell a customer why they can't reach their destination on your network, but another network without origin validation can (like a competitor).

that said, there is no reason to not sign your address space today and start rolling origin validation. there are a number of network operators in the right spots (irc, mailing lists) who are there to help you and give you guidance if you need it.

ps - hi tom. i still have your enteract card from years ago and recall meeting you a few times at the third coast cafe.

Providers won't implement RPKI for the same reason they haven't implemented IRR filtering or BCP38 for the last 10 years. It adds operational overhead, adds another thing that might go wrong, and there is no financial incentive.

There are like 70,000 ASNs out there, so a lot of orgs need to implement. But you’re right, if all the Tier 1’s do it we’ll be in a good place.

The “problem” with it is it doesn’t solve the path validation problem, so while it helps it doesn’t fix BGP completely.

My ISP had one of these boxes and was quite proud of it. It worked really well against BGP idiocy. It might not have worked against a concerted attack, but it did stop several of the "Ooops. All the routes are belong to us." problems that seem to be the "normal" BGP "attacks".

I am surprised that these big players don't already have something that does something similar.

you can also work with https://github.com/rpki-client/rpki-client-portable currently runs on a bunch of systems! coming to packages in the popular formats close to you soon!

They deserve to be called out for this. It’s not hard to implement RPKI. Only valid excuse is if your routers don’t support it.

Signing ROAs is trivially easy in the RIPE region. Why haven’t they done so before the pandemic???

Wasting time with this response instead isn’t maybe the best use of their time.

What, to me, would have provided a little more value would have been to diagram how BGP hijack happens (visualize a router announcing the wrong route), and how RPKI solves the issue. Of course, those 2 things are probably much harder to diagram.

edit: re-phrased a sentence.

If you don't agree that this is news.ycombinator.com and believe instead it's 4chan or Reddit, then the Web PKI can't help you, and "improving" the Web PKI to some people decide this is Apple and others that it's PornHub is pointless. If you want other names, go build your own network.

In RPKI the identities aren't DNS names like in the Web PKI they're number resources - IP addresses and Autonomous System numbers. Again though, if you can't agree with everybody else about global identity you can't participate in the network.

If you believe maybe 1.1.1.1 is the IP address of your PC and everybody else thinks it's a distributed DNS service run by Cloudflare, there's no purpose to trying to allow us to "agree to disagree". We're right, and you're wrong, go away.

Having global agreement about identity doesn't magically mean we all agree on who to trust, just because I agree with you that Reddit is Reddit, doesn't mean I agree about how much faith to put in a post you saw there.

I remember the first time i setup a rack of servers in a cage in a datacenter for a company i founded. We bought a block of IPs in bulk and then we bought an interconnect from a provider within the datacenter. To get those IPs pointing to our server we had our severs announce ownership over BGP. It's that easy.

Usually BGP messages are filtered out by routers. Otherwise home users would announce ownership of the Google addresses and have all those messages come to them for example. But if you have access to an interconnect in a datacenter you can state you own whatever IP addresses you want. There's really nothing at all stopping it right now.

I really appreciate this kind of meta-commentary on the recent trend of single purpose sites. It would be easy to dismiss them, but they’re as much a part of the web as any other content a browser can render. It’s a sign of a mature platform when you have trends and norms while also admitting outliers and oddities.

Which is to say: Please don't advocate for behaviors that harass line employees at corps you don't like.

As for whats stopping the announcement of bad routes? Mostly just the ISPs, the big transit providers, and the IX's.

The problem isn't the small users. You, as a nefarious individual, are unlikely to be able to cause much real damage. In datacenters where you don't bring your own dedicated transit (expensive), you have to tell them your ASN and IP information so it gets whitelisted.

The problem is large players. If China Telecom wants to claim Google's IPs... well the entire world's transit providers may not acknowledge that - but enough will to cause a real problem. More examples: https://en.wikipedia.org/wiki/BGP_hijacking#Public_incidents