Routing Incidents as a Gateway for Cyberattacks
29/06/2020
Augusto Mathurin – FORT Project Consultant
Today we are increasingly connected,
and our digital and analog lives converge more and more each day. This
phenomenon, which was already increasing at a considerable rate, was further
accelerated by the crisis caused by the COVID-19 pandemic. A natural
consequence of having more connected devices and people depending on them is
the increase in the number of people performing malicious actions on the
Internet, and with it the increase in cyberattack attempts.
News about Internet incidents and attacks have been part of traditional news portals for a long time, but these news typically focus on events that occur in the upper layers of the Internet and disregard the Internet’s “pipelines” – the routing layer – even when there is still a long way to go to ensure that there are no significant routing incidents.
While the general public is unaware of how vulnerable the network is at this level, the technical community has been tackling this challenge for some time by developing and deploying various solutions.
Along with NIC.MX, LACNIC has developed the FORT Project, which is implementing an RPKI deployment campaign in Latin America and the Caribbean in order to increase routing system security and resilience. Other organizations such as the Internet Society address this problem through MANRS, an initiative that provides solutions to reduce major routing threats. Their goal is to support both network operators (ISPs) and Internet exchange points (IXPs). This problem has even been part of the World Economic Forum’s agenda, which has addressed the topic and generated a report containing Cybercrime Prevention Principles for Internet Service Providers. The fourth of these principles, “Take action to shore up the security of routing and signaling to reinforce effective defense against attacks,” recommends the actions proposed by the MANRS initiative. Likewise, network operators such as Cloudflare, one of the largest global cloud infrastructure providers, has been promoting and deploying measures such as RPKI for years. Recently, they have said that “It’s time networks prevented leaks and hijacks from having any impact. It’s time to make BGP safe. No more excuses.”
But why are all these organizations so focused on securing the Internet routing layer? What are the consequences of not paying attention to this layer’s security?
First, it is essential to know which actors are involved and have an interest in causing these cyberattacks – which may not necessarily be direct attacks on the Internet routing system – to understand their main goals are and how routing layer vulnerabilities are a possible door to achieving them.
(Free access, no subscription required)
On the one hand, according to the report produced by the World Economic Forum, illegal online activities will have a cost of six trillion dollars by 2021. These activities are carried out by an enormous diversity of groups operating at a larger or a smaller scale and with various levels of sophistication. To get an idea of just how enormous their activity is as a whole, all we need to do is look in our personal email account’s spam folder to see the sheer number of malicious emails attempting to commit fraud on a mass scale.
On the other hand, many governments are trying to censor and control online activities. A large part of new Internet users, those who have recently started connecting or those who will connect for the first time in the near future, live in highly censored societies. Various studies have been able to prove the existence of institutional actions aimed at blocking certain types of content at different times. OONI (Open Observatory of Network Interference) is a project that aims to empower decentralized efforts in increasing transparency of Internet censorship around the world. Based on free software tools, they detect these blocks and generate a series of reports where they show when certain Internet users are being the victims of censorship.
In short, attacks include espionage, censorship and fraud, to name but a few. But how can an attacker exploit the routing layer to achieve their goals? Does this truly represent a risk?
