Stealth BGP Hijacks with uRPF Filtering
summary
Paper demonstrates a new attack called SBA-uRPF that uses prefix hijacks to flip uRPF filtering and stealthily blackhole legitimate traffic. A simulator built on CAIDA-style topology with ~77,000 ASes evaluates universal uRPF deployment and finds 99.3% of networks have at least one vulnerable AS and up to 76.3% (≈59,115 networks) could be affected. The exploit leverages routing loop prevention and customer-preference via a bridging network; code and datasets are published.
AI-written summary · about
chapters (13)
- 0:00Stealth BGP hijacks intro
- 1:15URPF basics and flaws
- 2:23IP spoofing background
- 4:56URPF filtering examples
- 6:25BGP routing policies
- 8:32Prefix hijack mechanics
- 10:01SBA URPF attack model
- 12:08SBA URPF attack scenario
- 14:00SBA URPF attack properties
- 15:50Internet-wide SBA URPF vulnerability
- 17:41Theoretical analysis limits
- 19:07Countermeasures for SBA URPF
- 19:50Conclusion
related talks
32mLet's talk about routing security
33mAdvanced rp_ filter
35mRoute to Bugs: Analyzing the Security of BGP Message Parsing
16mA System to Detect Forged-Origin BGP Hijacks
20mEPF: Evil Packet Filter
16mAres: Comprehensive Path Hijacking Detection via Routing Tree
22mBGP Vortex: Update Message Floods Can Create Internet Instabilities
23mBamboozling Certificate Authorities with BGP