How to Avoid Another Major IP Hijacking

The YouTube IP hijacking yesterday is not the first time that errant Internet routing assignments have caused outages. Martin Brown at Renesys notes a 2004 incident involving Turkish ISP TTNet and a 2006 event involving Con Edison. In the 2004 event TTNet "pretended to be the entire Internet" on Christmas Eve, while Con Ed assumed routes belonging to New York ISP Panix.

YouTube said it was "working with others in the Internet community to prevent this from happening again." But Renesys noted that "this story is almost as old as BGP" (the Border Gateway Protocol), which relies on trust between providers. "Our trusting routers are the BIGGEST security hole," writes Richard Stiennon at Threat Chaos. "Malicious attackers can easily disrupt the entire Internet by betraying that trust."

There was similar discussion on the North American Network Operators Group (NANOG). "Whether accidental or not, the black-holing of Youtube by Pakistan Telecom demonstrates a serious weakness in the 'longest prefix wins' rule: there is no concept of trust contained in it," Tomas Byrnes wrote on the NANOG list. "Trust, whether implicit or explicit, is inherent in all human interactions, yet expressing it in cyberspace has continued to be troublesome. In routing decisions, once you are beyond a connected (either directly or multi-hop) peer, it becomes much more difficult."

Trusted routing appears to be here to stay. "BGP is fundamental to provider relationships and will not be going away anytime soon," writes Renesys' Brown. "Cryptographic extensions to BGP have been suggested (but) these may be too taxing for router CPUs."

So what practical steps are available to reduce the likelihood of future hijackings? Both Renesys and NANOG members highlighted services that monitor changes in IP assignments and provide alerts. These services include the Internet Alert Registry, the Prefix Hijack Alert System and RIPE's MyASN service, as well as paid services like Renesys Routing Intelligence.

Ars Technica offered another possible response: