Researchers exploit web protocol to hijack traffic

Security researchers have warned of an underlying security issue concerning the Border Gateway Protocol, the core internet routing protocol.

In a presentation at the Defcon security conference earlier this month, researchers Alex Pilosov and Tony Kapela demonstrated an attack which exploited the Border Gateway Protocol (BGP).

The protocol allows for the exchange of information between networks of autonomous systems. To do this, BGP maintains a table of available IP networks, and finds the most efficient routes for internet traffic. In their presentation, Pilosov and Kapela demonstrated how a user's BGP traffic could be hijacked and redirected, allowing supposedly secure communications to be intercepted.

The researchers showed a man-in-the-middle attack where 'Time to Live' (TTL) information in data packets is spoofed on the fly, fooling routers into redirecting information to the attackers' network. The attack is surreptitious, as the altered TTL of the packets effectively hides the IP devices handling the hijacked inbound and outbound traffic.

Andy Buss, a senior analyst at Canalys, told ZDNet.co.uk on Wednesday that this issue with BGP has been known about for at least 10 years. Peiter 'Mudge' Zatko, an information security expert, warned a hearing of the US Senate Committee on Governmental Affairs in 1998 that hackers could exploit BGP, said Buss, who added that the problem was essentially to do with trust.

"The whole internet infrastructure is based on the assumption of trust, with security overlaid on top," said Buss. "This is an inherent problem — that internet infrastructure is insecure."

Buss said that BGP was an issue that only internet service providers (ISPs) could remedy.

"Generally it's carriers that [use] BGP, and the issue is really about strictly managing the BGP set," said Buss. "Ideally ISPs should only allow authenticated servers to propagate changes, but that means everyone in the trust chain would have to participate. The easiest mitigation is that ISPs monitor their address space, and monitor who is peering with BGP through blacklists and whitelists."

The only action available to businesses would be to put more pressure on ISPs to make sure their networks are hardened and that they are moving towards encrypting internet traffic, said Buss. However, the analyst said he does not expect change to come quickly.

"Open relays [which forwarded all traffic, including spam] took years to close. Botnets are a problem which has been around for years, yet ISPs aren't filtering traffic," said Buss. "Things move slowly. It will take a long time to get service providers to act."