Securing BGP: Protecting the Internet's Routing Infrastructure
The Border Gateway Protocol (BGP) is often described as the duct tape that holds the internet together. It is the postal service of the digital world, responsible for determining the most efficient paths for data packets to travel across the thousands of interconnected networks—known as Autonomous Systems (AS)—that make up the global internet.
However, there is a fundamental flaw in this critical infrastructure: BGP was designed in the late 1980s, a time of implicit trust. Security was an afterthought. Today, this lack of inherent security makes BGP a prime target for malicious actors and prone to catastrophic human errors. In this post, we will explore the vulnerabilities of BGP and the modern mechanisms used to secure it.
The Inherent Vulnerabilities of BGP
At its core, BGP operates on a "trust by default" model. When an Autonomous System—such as an Internet Service Provider (ISP) or a large enterprise—announces to the rest of the internet that it is the best path to reach a specific block of IP addresses, other routers generally believe it without verification.
This opens the door to two primary types of routing incidents:
- BGP Hijacking: A malicious actor intentionally announces that they own an IP prefix that actually belongs to someone else. Traffic intended for the legitimate owner is rerouted to the attacker, who can intercept, drop, or analyze the traffic.
- Route Leaks: Often the result of misconfigurations rather than malicious intent, route leaks occur when a network accidentally advertises paths it shouldn't, causing traffic to take suboptimal routes. This can lead to massive congestion and denial-of-service conditions.
One of the most famous examples of a BGP incident occurred in 2008 when Pakistan Telecom attempted to block YouTube domestically by advertising a highly specific BGP route. Because of how BGP propagates, this route leaked to the global internet, effectively redirecting all global YouTube traffic to a black hole in Pakistan and taking the site offline worldwide for several hours. More recently, we've seen BGP hijacks used to steal millions in cryptocurrency by redirecting DNS traffic.
Defending the Routing Table: RPKI and ROA
To fix the trust issue, the internet engineering community developed Resource Public Key Infrastructure (RPKI). RPKI acts as a cryptographic framework to verify the association between specific IP address blocks and the Autonomous Systems authorized to announce them.
Within the RPKI framework, network operators create Route Origin Authorizations (ROAs). A ROA is a digitally signed certificate that explicitly states which AS number is permitted to originate a given IP prefix.
When routers receive a BGP update, they can check it against the global RPKI repository—a process called Route Origin Validation (ROV). If the announcement doesn't match the ROA, the router flags it as "Invalid" and drops the route entirely. By dropping invalid routes, ISPs and network operators can automatically stop BGP hijacks in their tracks before they propagate globally.
Best Practices for Enterprise and ISP Routing Security
Securing BGP is a collaborative effort. An individual network can only do so much; true security requires widespread adoption across the internet ecosystem. If you manage a network that runs BGP, here are the critical steps you should be taking:
1. Implement Route Origin Validation (ROV)
As mentioned above, rely on RPKI to filter incoming routes. Major cloud providers and Tier-1 ISPs are increasingly enforcing ROV and dropping invalid routes, making the internet safer for everyone. Ensure your edge routers are configured to perform validation checks on all incoming BGP announcements.
2. Sign Your Own Prefixes (Create ROAs)
It's not enough to validate others; you must protect your own IP space. By creating ROAs for your organization's assigned IP prefixes, you ensure that other networks participating in RPKI will reject any malicious attempts to hijack your traffic.
3. Strict Prefix Filtering
Never blindly accept routes from your peers or customers. Maintain strict ingress and egress prefix filters. If a customer is only assigned a specific /24 subnet, your routers should be configured to strictly reject any announcements outside of that block.
4. Join MANRS
The Mutually Agreed Norms for Routing Security (MANRS) is a global initiative aimed at reducing the most common routing threats. MANRS outlines specific actions for network operators, cloud providers, and IXPs, such as filtering, anti-spoofing, coordination, and global validation. Joining MANRS demonstrates a commitment to a secure and resilient internet infrastructure.
What About BGPsec?
While RPKI validates the origin of a route, it doesn't protect the entire path the route takes. Enter BGPsec (BGP Security), an extension to BGP designed to provide cryptographic path validation. In a BGPsec environment, every router along the path signs the update, ensuring that the route hasn't been tampered with in transit.
Unfortunately, BGPsec suffers from severe adoption challenges. The cryptographic overhead required for every router to sign and verify every update in the global routing table (which contains roughly one million routes) requires significant hardware upgrades. For now, the industry is largely focused on ubiquitous RPKI adoption as a more practical and immediate solution.
Conclusion
The internet is an intricate web of trust, and BGP is the protocol that manages that trust. For decades, it has operated on a handshake and a promise. As cyber threats become more sophisticated and state-sponsored actors recognize the power of controlling global traffic flows, securing BGP is no longer optional.
By implementing RPKI, creating ROAs, and adhering to strict filtering policies like those outlined by MANRS, network operators can actively participate in hardening the internet's core infrastructure.
In our next post, we will step back from global routing and dive into local network analysis with "A Beginner's Guide to Network Traffic Analysis with Wireshark."