Stealthy IP Prefix Hijacking: Don't Bite Off More Than You Can Chew

Stealthy IP Prefix Hijacking: Don't Bite Off More Than You Can Chew,10.1109/GLOCOM.2009.5425977,Christian McArthur,Mina Guirguis

Stealthy IP Prefix Hijacking: Don't Bite Off More Than You Can Chew   (Citations: 2)
BibTex | RIS | RefWorks Download
In prefix hijacking, an Autonomous System (AS) advertises routes for prefixes that are owned by another AS, and ends up hijacking traffic that is intended to the owner. While misconfigurations and/or misunderstandings of policies are the likely reasons behind the majority of those incidents, malicious incidents have also been reported. Recent works have focused on malicious scenarios that aim to maximize the amount of hijacked traffic from all ASes, without considering scenarios where the attacker is aiming to avoid detection. In this paper, we expose a new class of prefix hijacking that is stealthy in nature. The idea is to craft path(s) - of tunable lengths - that deceive only a small subset of ASes. By finely tuning the degree to which ASes are effected, the attacker can handle the hijacked traffic while the victimized AS would not observe a major reduction in its incoming traffic that would raise an alarm. We give upper bounds on the impact of those attacks via simulations on real BGP Internet announcements obtained from Route-Views. We discuss shortcomings in current proposed defense mechanisms against attackers which can falsify traceroute replies. We also present a defense mechanism against stealthy prefix hijacking attacks.
Cumulative Annual
View Publication
The following links allow you to view full publications. These links are maintained by other sources not affiliated with Microsoft Academic Search.
    • ...McArthur and Guirguis [6] explore stealthy forms of prefix hijacking that attract small amounts of traffic and thereby avoid detection...

    Pradeep Bangeraet al. Impact of prefix hijacking on payments of providers

    • ...blackout. In addition, an AS might generate malicious BGP prefix advertisements in order to hijack some IP addresses and use them as not-yet-blacklisted sources of spam, as reported by Ramachandran and Feamster [18] and analyzed by McArthur and Guirguis [14]...
    • ...Further analysis on prefix hijacking has been carried by McArthur and Guirguis [14]...

    Ludovico Cavedonet al. Are BGP Routers Open To Attack? An Experiment

Sort by: