A prefix hijack attack involves an attacker announcing victim networks' IP prefixes into the global routing system. As a result, data traffic from portions of the Internet can be diverted to attacker networks. Prefix hijack attacks are a serious security threat in the Internet and it is important to understand the factors that affect the resiliency of victim networks against these attacks. In this paper, we conducted a systematic study to gauge the effectiveness of prefix hijacks launched at different locations in the Internet topology. Our study shows that direct customers of multiple tier-1 networks are the most resilient, even more than the tier-1 networks themselves. Conversely, if these customer networks are used to launch prefix hijacks, they would also be the most effective launching pads for attacks. We verified our results through case studies using real prefix hijack incidents that had occurred in the Internet.
Our work is also motivated by a recent study REF analyzing the resilience of Internet topology against prefix hijacks.
Understanding Resiliency of Internet Topology against Prefix Hijack Attacks
37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN'07)
37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN'07)
Computer Science