BGP hijacking: hijacking whole prefixes

The Internet routes between Autonomous Systems via BGP, which by design trusts received announcements. Whoever announces a more specific prefix, or a better path, attracts the traffic.

The attack

An AS announces an IP prefix it does not own (or a /24 more specific than a legitimate /16). Routers prefer the more specific route and redirect traffic to the attacker, who can intercept, drop or relay (interception). It has happened at global scale (hijacks of large providers' prefixes).

Defence

RPKI with Route Origin Validation: signs which AS may originate a prefix, and routers drop invalid announcements. Prefix filters with peers, IRR, and monitoring (BGPStream, RIPE) to detect anomalous announcements quickly.