BGP Hijack

How Hijacking Happens

BGPBorder Gateway Protocol. The routing protocol that exchanges reachability information between autonomous systems, effectively determining how data traverses the internet. Often called the "postal service of the internet." operates on trust: when an Autonomous System (AS)A large network or group of networks under a single administrative policy, identified by a unique Autonomous System Number (ASN). The internet is composed of tens of thousands of interconnected autonomous systems. announces that it is the best path to a set of IP prefixes, neighbouring routers accept that announcement and propagate it. A BGP hijack occurs when an AS announces prefixes it does not legitimately own, either accidentally through misconfiguration or deliberately for malicious interception. Because BGP prefers more-specific routes (longer prefixes), a hijacker can attract traffic intended for a /16 block by announcing a /24 within that range — the more-specific announcement wins in every router Routing TableA data structure stored in a router that lists known network destinations and the next hop or interface for reaching each one. Routing tables are populated by static configuration or dynamic routing protocols like BGP and OSPF. that receives both.

Real-World Impact

Traffic redirected by a hijack may be silently inspected, dropped as a denial of service, or delivered normally after copying — making some hijacks invisible to victims. The 2010 China Telecom incident briefly redirected a significant fraction of global internet traffic. The 2018 Amazon Route 53 hijack rerouted DNS queries for cryptocurrency wallets, enabling theft. Even accidental hijacks — such as the 2019 Verizon incident where a small ISP leak propagated through Cloudflare — can cause widespread Packet LossThe percentage of data packets that fail to reach their destination, typically caused by network congestion, faulty hardware, or wireless interference. Even 1-2% packet loss can noticeably degrade voice and video quality. affecting thousands of services.

Mitigations

Resource Public Key Infrastructure (RPKI) cryptographically signs route origin authorizations (ROAs), allowing routers to reject announcements from unauthorized ASNs. Route Origin Validation (ROV) enforces ROA checking. BGP communities and prefix filters add additional controls at PeeringA mutual arrangement between two networks to exchange traffic directly and freely (settlement-free peering) at an interconnection point, bypassing third-party transit providers. Peering reduces costs and latency for both parties. and TransitA paid arrangement where one network (the customer) pays another (the transit provider) for access to the rest of the internet. Unlike peering, transit provides full routing table access and is the primary way smaller networks connect to the global internet. boundaries. Monitoring services like BGPmon and RIPE Stat alert operators when their prefixes appear from unexpected ASNAutonomous System Number. A unique identifier (e.g., AS13335 for Cloudflare) assigned by a Regional Internet Registry to an autonomous system. ASNs are used in BGP routing to identify networks on the internet. origins.