BGP route monitoring

Mar, 25, 2008
Matsuzaki ‘maz’ Yoshinobu<maz@telecom-isac.jp>, <maz@iij.ad.jp>

1

Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

abstract• BGP prefix hijack is a serious security issue inthe internet, and these events have been widelyreported.
• There are several proposals of securing BGP,
but it needs time to deploy.
• This paper presents a route monitoring system Keiro-Bugyo (route-magistrate), and this systemallow us to detect prefix hijacking events andtake prompt action to address the problem.

2
Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

IP routing• An IP packet travel from its source to its
destination across a series of routers.
• When an IP packet is forwarded, a routeruses its routing information to determine
which path should be used to reach thedestination.

3Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

Routing information• A router shares reachability information withother routers via dynamic routing protocols.
– A routing information is automatically managed bydynamic routing protocols reflecting a networkchange.

• Multiple routes to a given destination can exist.
– A router selects the best route by tie-breaking rules.
– A router selects the new best, if the best route to a
destination becomes unusual or the router learns amore preferable route.

• A route announce is referred to as a ‘prefix’.
4Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

The internet routing• Each network has unique IP blocks.
– assigned by its internet registry (IR)• An autonomous system (AS) exchanges
routing information with its neighboring AS.
– using the Border Gateway Protocol (BGP)– An ‘AS’ is networks under a common
administration and with common routing
policies, and each ‘AS’ has a uniquenumerical ID assigned by its IR.

5Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

The internet architecture

ASAS

ISP
BGP
BGP

BGP
IX

ISP

BGP
ISP

BGP
AS

BGP

ISP
AS

ISP: internet service provider, IX: internet exchangeAS
6
Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

Prefix hijacking• Announcing a prefix that belongs tosomeone else without their permission– These events have been widely reported, but
it is difficult to detect a hijack event that isoccurred outside of the ‘AS’.
– It seems most events are explainable bymisconfigurations.
• So, the wording of ‘Hijack’ seems too strong.

7Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

possible effects of prefix hijack
black holing
victim AS

discardhijacking AS
impersonation

tapping
victim AS

fake site

victim AS

tappinghijacking AS

hijacking AS
8Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

YouTube Incident• YouTube was announcing 208.65.152.0/22.
• 24 Feb 2008, 18:47(UTC)– AS17557(Pakistan Telecom) starts announcing
208.65.153.0/24, and AS3491(PCCW Global)
propagates the prefix.
– YouTube traffic is redirected to Pakistan
Telecom, and people can not access theYouTube.

.9Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

timeline• 24 Feb 2008, 20:07(UTC) (+80mins)– YouTube(AS36561) starts announcing
208.65.153.0/24 to get back the traffic.
Routers that prefer this route (shorter AS
Path, and so on) send traffic to YouTube.

• 24 Feb 2008, 21:01(UTC) (+134mins)– AS3491 (PCCW Global) withdraws all prefixes
originated by AS17557 (Pakistan Telecom).

• YouTube react in about 80mins, and ittakes about 2 hours to recover.
10Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

Why are these happened?

• Somebody on somewhere is accepting
these unauthorized announcements.
– They lack of a route-filter knowledge, or
never check the authoritative correctness ofa prefix.

• I hope we can use more secure protocol inthe future.
– soBGP, sBGP, pgBGP, and so on.
– But it needs time to reach a consensus, andneeds more time to deploy.
11Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

Detection• I wanted to know what's going on around
our ASs.
– Are there incidents?
– How often are they occurred?

• So we developed a route monitoring
system to detect a prefix hijack.
– This is easy to start. ☺

12Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

Keiro-Bugyo(route-magistrate)
Internet Routing Registry (IRR)
ISP

ISP

rules are automaticallygenerated from IRR db

operations

ISP

BGP feeds

check!!

check rules

we can add some rulesby hand as well

BGP UPDATE

Alert!
by email• Monitoring BGP UPDATE– Receiving full BGP feeds from multiple ASs(ISPs)– Comparing a prefix and its BGP path attributes to the check rules• When there is a difference between rules and BGP UPDATE,
the system rapidly alerts operators by email.
13
Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

Check rules• BGP UPDATE is composed of Path
attributes and NLRI.
• We are checking origin AS and prefix.
– like - 2497 { 210.130.0.0/16 }– This method is reasonable against a hijackcaused by a misconfiguration.

14
Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

maintaining the check rules• We have to keep the strict check rules aspossible, otherwise the alert becomes useless.
– receive lots of false alerts, or– miss a hijack event• We maintain our JPIRR objects to be up-todate.
– We automatically generates the check rules from theJPIRR DB, and this saves our time. ☺

15
Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

detection summary
2007 2008

bogon
false alertothers

AugSepOct

Nov

Dev

Jan4
142

6126
1024
53
144
346
53

• Currently the system is receiving BGP
feeds from 11 major Japanese ISPs, andmonitoring hijacks aimed to these 11 ASs.
16
Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

detection case #1• 2008/01• Originated from Asian ISP• longer prefix and invalid origin AS– /24 x 1

• Detected 10/11 ASs on Keiro-Bugyo• Action– No action was taken, because the prefix waswithdrawn soon.

• Duration : about 26 mins

17
Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

detection case #2• 2006/11• Originated from Asian ISP• longer prefix and invalid origin AS– /27 x 1

• Detected 1/7 AS on Keiro-Bugyo• Action– We could not contact the hijacking AS directly, soasked for help to a upstream of the AS. They appliedroute filter to reject the invalid prefix and also
notified the AS. After that, the hijacking AS stopped
the announcement.

• Duration : about 16 hours

18
Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

Assumptions• The bgp monitoring system detects ahijack only if– the hijack prefix reaches the system, and– the system discriminates between a correct
prefix and hijacked one.

• So this monitoring system has a limitation.

19
Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

The system can not detect:• A hijack prefix that does not advertise tothe system– a local hijack in specific region/ISPs– a hijack prefix is filtered somewhere• A hijack prefix that can not be
discriminated from the correct one by thesystem– The define of correctness - same origin AS– IR/IRR DB hijacking
20
Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

Is this useful?

• YES!
• The system does not solve every issues,
but it is still useful for people who needs a‘fast-food’ detection. ☺

21
Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

expanding the activity• CJK (China, Japan and Korea)
collaboration– Based on a government-to-government
meeting about ICT Network and Information
Security– On going project, still discussing…
– Expert groups on each country will cooperate
to deal with BGP prefix Hijacking.

22
Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.

Conclusion• BGP prefix hijack is a serious security issue inthe internet.
• To address this issue at this moment, wedeveloped a route monitoring system, KeiroBugyo(route-magistrate).
• A well-maintained IRR database can be used forthe route verification.
– We recommend that AS-operators register andmaintain its objects to be up-to-date.

23
Copyright©2008 Telecom-ISAC Japan. All Rights Reserved.