Slashdot Mirror
BGP Hijacking Continues, Despite the Ability To Prevent It
An anonymous reader writes: BGPMon reports on a recent route hijacking event by Syria. These events continue, despite the ability to detect and prevent improper route origination: Resource Public Key Infrastructure. RPKI is technology that allows an operator to validate the proper relationship between an IP prefix and an Autonomous System. That is, assuming you can collect the certificates. ARIN requires operators accept something called the Relying Party Agreement. But the provider community seems unhappy with the agreement, and is choosing not to implement it, just to avoid the RPA, leaving the the Internet as a whole less secure.
What if we agree to spell out obscure acronyms the first time? Yes, I can google/bing it to find likely candidates, but what if you make life easier for all involved and actually use Border Gateway Protocol (BGP)? Mmmmkay?
more grey area....? https://www.youtube.com/result...
ARIN requires operators accept something called the Relying Party Agreement.
But the provider community . . . is choosing not to implement it
So ARIN apparently has no ability to enforce the 'requirement', making the 'requirement' meaningless.
Why do we continue to allow peers that have proven to be problematic in the BGP backbone? simply do not share routes with these ASs any more and fuck their shit hole countries until they stop dicking with the core of the internet.
its not like any old admin can be like "Ok i'm going to broadcast bad routes that will be observed and respected by all the core routers of the internet"
no these people have special agreements with the neighbours they route with, its not like BGP packets just fly around the internet from some random workstation belonging to a hacker magically find their way onto the private vlans the cores use for bgp traffic.
even if it wasnt technically preventable it should simply be resolved by refusing peering after an incident.
These events continue, despite the ability to detect and prevent improper route origination
Locked cases with hardened glass are a technology that allow a store to protect products for sale from surreptitious pilfering. That is, assuming you can fit the products in the case. Lock manufacturers for the cases require stores to accept something called a "key security agreement", but the shop owner community seems unhappy with the inconvenience posed to customers, and is choosing not to implement it, just to avoid the KSA, leaving the goods on store shelves worldwide as a whole less secure.
"Internet as a whole less secure" ?
Really? The flip side of RPKI is related to who owns the keys, because who owns the keys controls the Internet.
Think "Internet Off Switch".
So, we should never do anything to improve security because it isn't 100% effective. Got it.
That's a bit dramatic. It's a data set with statements about routing, it doesnt affect BGP directly, that's up to the operator who uses the data. The signatures are there so the user of the data can validate intergrity. If it turns out the system is being abused, operators will simply stop using RPKI data and fall back on whatever they use now (e.g. route objects in the IRR).
So, we should never do anything to improve security because it isn't 100% effective.
Got it.
And 100% as convenient, too, don't forget. Wouldn't want to incur any costs or have to lift a finger for that security.
Just flipped down the thread:
AAAAASSSS????ASSSA?FFbFbb??bBM
Key:
A = messages complaining about use of acronym, explaining it
S = messages questioning relevance of BGP to 'Nerd', answers
? = WTF responses (Fry, Bennet)
F = political views (fuck ARIN, fuck legalese, fuck de Man)
b = relevant but misinformed (filtering not quicky-solve, RPKI not Kill Switch)
B = relevant, thoughtful response to a 'b'
M = this, meta message about thread.
If the rest of the Internet was like this, no actual routes would ever be advertised.
My life is light, waiting for the death wind,
Like a feather on the back of my hand.
Dust in sunlight and memory in corners
Wait for the wind that chills towards the dead land.
~T.S. Eliot
<blink>down the rabbit hole</blink>
And signing a mass of unenforceable rent-seeker written security theater legalese is actually better than what we have now, which amounts infrequent and temporary disruption of marginal, poorly run systems? PKI systems get compromised as well, you know.
I'd rather risk the vulnerabilities than stop the rapid growth of the Internet, or have it bifurcate into the signatories and the non-signatories, which is the more likely outcome. The fact that a third-world civil war hellhole like Syria even has any Internet to be compromised is a f-ing miracle and a direct result of this libertine nature. Locking out operators in such places because the rest of the world can't get a legally enforceable signature out of someone is a bad idea.
Operators don't want this. I don't know what your prerogatives are, but for me that trumps ARINs lawyers. The Internet is supposed to have an end-to-end model where one authenticates peers when necessary, so at worst a compromised router should amount to a DOS; quickly noticed and remedied.
Yes, probably BGP will be the reason the day the internet "goes down" one day. However its like saying the power gird will go down because there was no power. BGP has to exist. But all the outages caused by BGP so far have been mistakes, even when we sent all internet traffic in the world to China.
That's not the message. The message is: that some security problems can be solved technically, but the solution is so problematic, that the solution can't reasonably be accepted.
The major problem with RPKI is the legalese, and the fact that operators have some reasons not to trust the RIRs to administer it.
We see some of the matters of policy as self-serving. We recognize that RIRs are not infallible, and we're concerned about giving a single organization too much power over the community-operated internet.
Yes, ARIN and other RIRs are in control of WHOIS and the official record, which are only of value due to the consensus recognizing them, but us operators remain effective control of the operational internet.
If ARIN craziness results in an IP address allocation being revoked for insane reasons, such as registrant forgot to pay a bill, well, their network just keeps working --- since the RIR has no power to stop a working network.
RPKI changes this.
Also, since IPv6 makes RIRs such as ARIN a lot less relevant, we are concerned about their "rent seeking" behavior from operators, not just today, but in the future, and possible exorbitant price increases to discourage IPv4 usage and promote "outreach programs" and conferences and parties and other excess spending of questionable relevance to resource holders.
No ARIN-administered RPKI keeps the power more in balance --- today the network operators have a "check" on ARIN's power, by simply ignoring resource revokations and refusing to disrupt network(s) ARIN says to disrupt.
As the article points out, the only reason this was able to work was because one of the upstreams didn't filter announcements correctly. So instead of one provider doing something simple, the "fix" is for the rest of the world to do something complex?
Back in the day if a provider dicked around with BGP enough (either through incompetence or malice) they would find that eventually no one would accept any prefixes originating from their network. Kind of hard to have customers when the rest of the internet won't accept your traffic, isn't it?
BGP4 was new and exciting in 1994, and people are still doing it incorrectly. Film at 11.
Teirs of providers screwed up, Telecom Italia should have never accepted the routes. Considering that the whole AS has 84 ipv4 prefixes that could/should be summarized it's a pretty static list. They have one "client" bgp session to their own second AS. Telecom Italia is big enough where it looks like bigger fish dropped the ball filtering it's nearly 40k routes (possibly also hardware issues 40k long prefix lists can make routers unhappy).
No sir I dont like it.
As the article points out, the only reason this was able to work was because one of the upstreams didn't filter announcements correctly. So instead of one provider doing something simple, the "fix" is for the rest of the world to do something complex?
Yes.
If the entire BGP system is reliant on any 1 participant to properly implement security, then you can be assured there will be at least 1 participant who does not properly implement security.
We should assume the entire network is hostile and full of bad actors, then "fix" accordingly.
That's how you build robust networks.
For example: assuming everyone will play nicely is why the NSA got to tap datacenter-to-datacenter x-fers for the major internet companies. Once this came to light, each and every company did something complex, instead of the "simple" solution of the NSA not spying on them.
[Fuck Beta]
o0t!
A revoked certificate or a mess up by the RIR will *not* result in an unreachable network. It's possibly the biggest misconception about RPKI. http://mailman.nanog.org/piper...
Agreed. It's like saying SSL is secure when it relies on every CA to operate in the same secure way. Oops.
Or email is reliant on one particular server not relaying out spam to others and faking return addresses, etc.
Lots of big tech relies on "honesty". The only way to fix it is to enforce a protocol that ensures compliance (or punsihes non-compliance with relegation).
If you don't play ball in DNSSEC, for example, then people know you're not playing ball. You either participate properly or not at all.
If we made all the protocols like this, and revoke trust / power / reputation from those who mess up, people might start to manage these system for the benefit of others instead of just themselves.
Just to clarify - We sign route in the RIPE region with RPKI. Its all covered in the fees we're paying anyway and just need to click the "Validate Route" button if you let them manage the PKI portion.
This isnt the SSL monopoloy you're used to selling large primes. Little bit of understanding might be worth while before you go off ranting next time.
These events continue, despite the ability to detect and prevent improper route origination
Locked cases with hardened glass are a technology that allow a store to protect products for sale from surreptitious pilfering.
That is, assuming you can fit the products in the case. Lock manufacturers for the cases require stores to accept something called a "key security agreement", but the shop owner community seems unhappy with the inconvenience posed to customers, and is choosing not to implement it, just to avoid the KSA, leaving the goods on store shelves worldwide as a whole less secure.
It's like, slippy sloppy through analogy?