BGP Prefix Hijack and RPKI Route Origin Validation: Safeguarding Internet Routing

What is a BGP Prefix Hijack?

A BGP (Border Gateway Protocol) prefix hijack occurs when an attacker inserts their own route into the global routing table, claiming to be the legitimate origin of a network prefix. This can lead to unauthorized traffic rerouting and potential security breaches.

The impact of such an attack can range from merely disrupting services to more severe consequences like data theft or denial-of-service attacks.

How Does RPKI Route Origin Validation Work?

RPKI (Resource Public Key Infrastructure) is a system designed to validate the origin of BGP announcements. It uses digital certificates and cryptographic signatures to ensure that only authorized entities can announce specific IP prefixes.

When RPKI validation is enabled, routers check if the AS-path in incoming BGP updates matches the expected origin as defined by the RPKI database. If there's a mismatch, the route is rejected.

Why Does It Matter?

BGP prefix hijacks can have significant implications for internet security and stability. They pose risks to network integrity and user privacy by allowing malicious actors to redirect traffic or inject false data.

RPKI helps mitigate these risks, ensuring that only legitimate entities can announce specific IP addresses, thereby enhancing the overall security of the internet.

Real-World Examples

Historically, BGP prefix hijacks have led to various incidents where attackers redirected traffic through their networks, often for financial gain or to spread malware.

RPKI has been instrumental in preventing such attacks by providing a robust mechanism for validating the authenticity of routing announcements.

Frequently asked questions

Try it live

Everything above runs in your browser — open BGP Prefix Hijack & RPKI Route Origin Validation and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.