Novel BGP Hijacking Technique Exploits Route Aggregation to Bypass RPKI Validation
Researchers have demonstrated a new Border Gateway Protocol attack method that leverages legitimate route aggregation practices to redirect traffic while appearing compliant with Resource Public Key Infrastructure security controls.
Novel BGP Hijacking Technique Exploits Route Aggregation to Bypass RPKI Validation
A newly disclosed attack methodology targeting the internet's core routing infrastructure demonstrates how threat actors can hijack network traffic while maintaining apparent compliance with Resource Public Key Infrastructure (RPKI) validation mechanisms, undermining one of the primary defenses against BGP hijacking.
The technique, demonstrated in a controlled research environment and disclosed August 29th, exploits the common practice of route aggregation—where networks announce larger address blocks rather than individual subnets to reduce routing table size. By carefully crafting announcements for legitimately-owned address space that encompasses target networks, attackers can create routing paths that pass RPKI validation checks while still intercepting traffic destined for victim networks.
The attack succeeds because RPKI validation focuses on verifying that the announcing autonomous system is authorized to originate routes for specific address blocks. However, when an attacker announces a properly-signed route for a larger aggregate block that legitimately includes smaller victim prefixes, the announcement appears valid to RPKI-enabled routers. Traffic destined for the more-specific victim routes can then be attracted to the attacker's network through careful manipulation of BGP path attributes.
What makes this attack particularly dangerous is its subtlety. Unlike traditional BGP hijacking that triggers immediate alarms through RPKI validation failures, this technique appears as legitimate route optimization. Network operators monitoring for anomalous routing behavior may overlook these announcements as routine traffic engineering adjustments.
The research team demonstrated successful traffic interception across multiple major internet exchange points, showing that approximately 23% of tested networks exhibited routing behaviors that would enable this attack. The technique is most effective against organizations that haven't deployed both RPKI validation and rigorous route filtering based on Internet Routing Registry data.
Mitigation requires a multi-layered approach. Network operators must implement strict route filtering based on maximum prefix lengths documented in routing registries, ensuring they don't accept unexpected aggregate announcements. Organizations should also deploy more-specific route announcements for critical infrastructure, making it harder for attackers to leverage aggregation attacks without triggering suspicion.
The disclosure has prompted urgent discussions within the Internet Engineering Task Force about potential protocol enhancements to RPKI validation logic. However, any protocol-level fixes will require years of development and deployment across the global routing infrastructure.
Security teams are advised to implement enhanced monitoring for unexpected changes in routing paths to critical services, particularly when those changes involve new aggregate announcements from unfamiliar autonomous systems.