In this webinar, we cover how to detect BGP route leaks and hijacks that can cause suboptimal routing and network performance issues. Starting from key concepts, you'll learn how to recognize route leaks and hijacks in the data, alert for these events and proactively mitigate their impact. See the webinar recording at https://www.thousandeyes.com/webinars/detecting-hijacks-and-leaks

1. 1© 2017 ThousandEyes Inc. All Rights Reserved.
Detecting Hijacks and Leaks
Young Xu, Product Marketing Manager

2. 2© 2017 ThousandEyes Inc. All Rights Reserved.
About ThousandEyes
Network Intelligence platform
that gives you a complete
picture from users to internal
and cloud-based applications
Routing!
User
App
End-to-End Performance Data
App
Performance!
User
Experience!
Network
Topology!
Routing
Topology!
Enterprise, Endpoint and Cloud Agents
Network
Connectivity!
And Route Monitors!
Surface insights from
a global data set
Lightweight, flexible
data collection
Unified view of diverse
performance data
Solve issues across
shared infrastructure
See any network like
it’s your own

3. 3© 2017 ThousandEyes Inc. All Rights Reserved.
• BGP wasn’t designed with security built into it
– Advertisements are generally trusted among ISPs
• The Internet is vulnerable to propagating incorrect routes
– Route leak: Propagation of illegitimate route advertisements,
usually by mistake, leading to incorrect or suboptimal routing
– Route hijack: Malicious equivalent to a route leak
• More prone to propagation when leaked path is preferred
– A more specific prefix is advertised
– Advertised path is shorter than current path
BGP: Built on Trust

4. 4© 2017 ThousandEyes Inc. All Rights Reserved.
AS 200759
Innofield
Route Propagation
AS 16509
Amazon
AS 30844
Econet
AS 6939
Hurricane
Electric
Border
Router
Amazon advertises routes
among BGP peers to
upstream ISPs
Amazon advertises prefix
54.239.16.0/20
Econet receives route
advertisements to
Amazon via Hurricane
Electric
Traffic Path
AS 65021
Private

5. 5© 2017 ThousandEyes Inc. All Rights Reserved.
AS 65021
Private
AS 200759
Innofield
AWS Route Leak, April 2016
AS 16509
Amazon
AS 30844
Econet
AS 6939
Hurricane
Electric
Traffic
Path
Innofield leaks routes for
more specific /21 prefixes,
directing traffic to private
AS 65021
Hurricane Electric accepts
routes and now directs Amazon-
destined traffic to Innofield

6. 6© 2017 ThousandEyes Inc. All Rights Reserved.
• Leaks result from human error or misconfigurations
– Improper route filtering, mismanaged routing policies
• Misuse of NO-EXPORT community
• Misconfigured route optimizers
• Route hijacks are intentional and malicious
– Deny service (e.g. targeted attack, censorship)
– Inspect traffic (see man-in-the-middle attacks)
• Traffic interception and impersonation
• Corporate or state espionage
• Steal cryptocurrency
– IP squatting and spamming
Why Leaks and Hijacks Happen

7. 7© 2017 ThousandEyes Inc. All Rights Reserved.
Alerting for Leaks and Hijacks
Alert Rule Parameter
Origin ASN not in:
Your own or hosting
provider’s ASN
Next Hop ASN not in:
Upstream ISPs’
ASNs
Covered Prefix Exists
Covered Prefix not in
Your expected sub-
prefixes

8. 8© 2017 ThousandEyes Inc. All Rights Reserved.
• Monitor BGP to quickly detect routing events
• Contact upstream ISPs to reject the illegitimate routes
• Announce routes preferable to the leaked route
– More specific prefix (when leaked prefix is bigger than /24)
– Shorter AS path (remove any path prepending)
• Last resort: Change destination prefixes using DNS
– Feasible if you can shift traffic to other data centers or a CDN
– Can take time depending on TTL of DNS records
• RPKI: Publish Route Origin Authorizations (ROAs) in RIR
Mitigating Route Leaks Affecting Your Prefixes

9. 9© 2017 ThousandEyes Inc. All Rights Reserved.
• Route filtering (based on prefix, AS path, community)
– Bogon filtering
– Enforce commercial relationships
• Block advertisements for peer paths from customers
• “Peerlocking”: Don’t allow intermediate networks between peers
– BGP Maximum-Prefix: Max number of prefixes from a peer
• Security standards: RPKI, RPSL, BGPSEC
• Prevent hijacks by blocking illegitimate advertisements
– TCP MD5: Uses secret key to compute hash over TCP header
– GTSM: Peer sets TTL to max of 255 (attacker >1 hop away can’t
impersonate)
Preventing Propagation of Bad Routes

10. 10© 2017 ThousandEyes Inc. All Rights Reserved.© 2017 ThousandEyes Inc. All Rights Reserved.
Demo

11. 11© 2017 ThousandEyes Inc. All Rights Reserved.
1. Covered Prefix to Spotify Leaked by Enzu
Visible for almost 3 hours
Leaked by Enzu
(AS18978)
Spotify (AS43650)
Propagated at LAIX
(AS40633)
Seen by 4
monitors
New, more specific /23 route leaked

12. 12© 2017 ThousandEyes Inc. All Rights Reserved.
Impacted Traffic on the Network Layer
Traces terminating in
edge of Vocus network
with LAIX
LAIX

13. 13© 2017 ThousandEyes Inc. All Rights Reserved.
2. AxcelX Leak: Normal Routes
Amazon.com
NTT
Level 3
Hurricane
Electric
ReTN.net

14. 14© 2017 ThousandEyes Inc. All Rights Reserved.
Amazon Routes Leaked by AxcelX
New routes through
Hibernia (AS 5580),
AxcelX (AS 33083)
New Amazon AS
No longer routed
through expected ISPs

15. 15© 2017 ThousandEyes Inc. All Rights Reserved.
Caused Performance Impacts
100% loss in
AxcelX
99% loss in
Hibernia

16. 16© 2017 ThousandEyes Inc. All Rights Reserved.
3. Tata Hijack of Societe Generale: Normal Routes
Societe
Generale AS
Bulgarian Telecom
(Upstream)Societe Generale
prefix
Neterra
(Upstream)

17. 17© 2017 ThousandEyes Inc. All Rights Reserved.
Multiple Origins: Tata Advertised Routes
Societe
Generale
(Correct AS)
Tata
(Hijacking AS)
Locations with
completely
hijacked routes

18. 18© 2017 ThousandEyes Inc. All Rights Reserved.
All ISPs Accepted Tata’s Bad Routes
Tata
(Hijacking AS)

19. 19© 2017 ThousandEyes Inc. All Rights Reserved.
Caused 100% Loss in Tata and Tata’s Peers
Traffic had no legitimate
routes to reach Societe
Generale
Tata
Cogent

20. 20© 2017 ThousandEyes Inc. All Rights Reserved.© 2017 ThousandEyes Inc. All Rights Reserved.
Watch the webinar:
www.thousandeyes.com/webinars/detecting-hijacks-and-leaks