{"id":31621,"date":"2025-11-03T13:09:16","date_gmt":"2025-11-03T13:09:16","guid":{"rendered":"https:\/\/blog.lacnic.net\/?p=31621"},"modified":"2025-11-05T12:23:34","modified_gmt":"2025-11-05T12:23:34","slug":"bgp-hijacking-risk","status":"publish","type":"post","link":"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/","title":{"rendered":"Understanding stealthy BGP hijacking risk in the ROV era"},"content":{"rendered":"\n<p>By Yihao Chen, 16 de octubre de 2025<\/p>\n\n\n\n<p><em>Co-authors:&nbsp;<\/em><a href=\"https:\/\/sites.google.com\/site\/qili2012\/\" target=\"_blank\" rel=\"noreferrer noopener\">Qi Li<\/a><em>,&nbsp;<\/em><a href=\"https:\/\/www.cs.tsinghua.edu.cn\/csen\/info\/1309\/4352.htm\" target=\"_blank\" rel=\"noreferrer noopener\">Ke Xu<\/a><em>,&nbsp;<\/em><a href=\"https:\/\/inspiringgroup.github.io\/team\/\" target=\"_blank\" rel=\"noreferrer noopener\">Zhuotao Liu<\/a><em>,&nbsp;<\/em><a href=\"https:\/\/www.internethalloffame.org\/inductee\/jianping-wu\/\" target=\"_blank\" rel=\"noreferrer noopener\">Jianping Wu<\/a><em><\/em><\/p>\n\n\n\n<p><em>This article was originally published on the <\/em><a href=\"https:\/\/blog.apnic.net\/2025\/10\/16\/understanding-stealthy-bgp-hijacking-risk-in-the-rov-era\/\"><em>APNIC blog.<\/em><\/a><\/p>\n\n\n\n<p>Border Gateway Protocol (BGP) hijacking has long been one of the protocol\u2019s most persistent security threats. RPKI and ROV were standardized to provide origin authentication and mitigate the threat, but Route Origin Validation (ROV) deployment is likely to remain partial for the next decade. Partial deployment not only leaves obvious gaps in protection but also creates a subtle threat, which we refer to as ROV-related stealthy BGP hijacking (or simply&nbsp;<em>stealthy hijacking<\/em>).<\/p>\n\n\n\n<p>In a stealthy hijack, the affected Autonomous System (AS) never sees the malicious origin on the control plane because ROV-enabled neighbors drop the invalid announcement. Yet, traffic can still be silently diverted to an attacker via legacy (non-ROV) ASes along the data plane path. This makes the attack effectively evade detection that relies on control-plane visibility. In other words, BGP hijacking becomes stealthier \u2014 the victim\u2019s routing tables and RPKI checks look perfectly normal, even as its traffic is being diverted.<\/p>\n\n\n\n<p>Below, we present a real-world case that illustrates how a stealthy hijack occurs.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"223\" src=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig1-riesgo-secuestro-bgp-1024x223.png\" alt=\"\" class=\"wp-image-31608\" srcset=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig1-riesgo-secuestro-bgp-1024x223.png 1024w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig1-riesgo-secuestro-bgp-300x65.png 300w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig1-riesgo-secuestro-bgp-680x148.png 680w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig1-riesgo-secuestro-bgp-768x167.png 768w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig1-riesgo-secuestro-bgp-1536x334.png 1536w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig1-riesgo-secuestro-bgp.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Figure 1 \u2014 Hijacking incident on&nbsp;203.127.225.0\/24&nbsp;(last seen on 24 April 2025). This incident was most likely the result of a benign misconfiguration.<\/p>\n\n\n\n<p>In this case, AS17894, the supposed hijacker, mis-announced a \/24 prefix, which is part of a \/16 that is legitimately owned and originated by AS3758. Technically, this is a classic sub-prefix hijack.<\/p>\n\n\n\n<p>What makes this case subtle is how ROV comes into play. In Figure 1, only AS37100 applies ROV filtering. Because AS37100 dropped the invalid \/24 route, it kept only the valid \/16 route in its routing table. As a result, AS37100 and its customers had no visibility of the invalid route on the control plane. In other words, AS37100 and its customers had no reason to suspect anything wrong. Yet their traffic to the \/24 was still diverted to AS17894 via legacy AS6762, which does not perform ROV and accepted the invalid \/24 route. Unless notified or actively probing the \/24 for some reason, they would remain unaware of the ongoing hijack.<\/p>\n\n\n\n<p>Evidence from AS37100\u2019s looking glass confirms the incident. We manually inspected AS37100\u2019s control-plane view and data-plane reachability using its public looking glass \u2018<a href=\"https:\/\/lg.seacomnet.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">g-01-ams.nl<\/a>\u2018. All observations were captured on 10 February 2025.<\/p>\n\n\n\n<p>As shown in Figure 2, running&nbsp;show ip bgp&nbsp;for the \/16 returned two valid routes, both originated by the legitimate owner AS3758:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"593\" src=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig2-riesgo-secuestro-bgp-1024x593.png\" alt=\"\" class=\"wp-image-31611\" srcset=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig2-riesgo-secuestro-bgp-1024x593.png 1024w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig2-riesgo-secuestro-bgp-300x174.png 300w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig2-riesgo-secuestro-bgp-570x330.png 570w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig2-riesgo-secuestro-bgp-768x444.png 768w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig2-riesgo-secuestro-bgp-1536x889.png 1536w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig2-riesgo-secuestro-bgp.png 1600w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Figure 2 \u2014 AS37100\u2019s routes to&nbsp;203.127.0.0\/16.<\/p>\n\n\n\n<p>For the \/24 sub-prefix, however,&nbsp;show ip bgp&nbsp;returned nothing (see Figure 3), meaning that the hijack was effectively invisible to AS37100 at the control plane:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"593\" src=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig3-riesgo-secuestro-bgp-1024x593.png\" alt=\"\" class=\"wp-image-31614\" srcset=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig3-riesgo-secuestro-bgp-1024x593.png 1024w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig3-riesgo-secuestro-bgp-300x174.png 300w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig3-riesgo-secuestro-bgp-570x330.png 570w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig3-riesgo-secuestro-bgp-768x444.png 768w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig3-riesgo-secuestro-bgp-1536x889.png 1536w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig3-riesgo-secuestro-bgp.png 1600w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Figure 3 \u2014 AS37100\u2019s routes to&nbsp;203.127.225.0\/24.<\/p>\n\n\n\n<p>The data plane told a different story. As shown in Figure 4,&nbsp; a traceroute from AS37100 to&nbsp;203.127.225.1&nbsp;was diverted and ended up in AS17894, confirming that the \/24 traffic was indeed being hijacked (Figure 4).<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"971\" src=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig4-riesgo-secuestro-bgp-1024x971.png\" alt=\"\" class=\"wp-image-31617\" srcset=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig4-riesgo-secuestro-bgp-1024x971.png 1024w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig4-riesgo-secuestro-bgp-300x284.png 300w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig4-riesgo-secuestro-bgp-348x330.png 348w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig4-riesgo-secuestro-bgp-768x728.png 768w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig4-riesgo-secuestro-bgp-1536x1456.png 1536w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/10\/fig4-riesgo-secuestro-bgp.png 1600w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Figure 4 \u2014 Traceroute from AS37100 to&nbsp;203.127.225.1.<\/p>\n\n\n\n<p>The key takeaway from this incident is that if any intermediate AS on your path has a different view of origins than you do, traffic diversion could still happen, even if your own routing table looks good. And most importantly, partial ROV deployment is making such inconsistencies more common, making BGP hijacking potentially harder to detect.<\/p>\n\n\n\n<p>Beyond this case, we conducted a large-scale empirical and analytical study of stealthy BGP hijacking risk across today\u2019s Internet. The full results are presented in&nbsp;<a href=\"https:\/\/drive.google.com\/file\/d\/1894aGcP3e_ZUu5APzj4R7dIft7bjs5Op\/view?usp=drive_link\" target=\"_blank\" rel=\"noreferrer noopener\">our upcoming paper at NDSS 2026<\/a>. We have also launched a&nbsp;<a href=\"https:\/\/yhchen.cn\/stealthy-bgp-hijacking\" target=\"_blank\" rel=\"noreferrer noopener\">website<\/a>&nbsp;that publishes daily reports of stealthy hijacks we capture in the wild.<\/p>\n\n\n\n<p>Based on what we learned, here are some operational insights and recommendations for network operators:<\/p>\n\n\n\n<p>First, keep pushing RPKI and ROV deployment forward. One key finding from our study is that the risk of stealthy hijacking follows a rise-then-decline curve as ROV deployment increases. The good news is that current data suggests we may now be entering the declining phase, so further adoption can reduce the risk.<\/p>\n\n\n\n<p>Second, pay attention to what you drop. Invalid routes that you filter out may still carry valuable information. Monitoring and correlating them can help flag possible traffic diversion events. A more proactive (though aggressive) mitigation strategy could be for ROV-enabled ASes to not only drop invalid routes but also re-run route selection and prefer routes that avoid ASes seen in the dropped announcements (a similar policy is described in a&nbsp;<a href=\"https:\/\/patents.justia.com\/patent\/10015081\" target=\"_blank\" rel=\"noreferrer noopener\">Cisco patent<\/a>).<\/p>\n\n\n\n<p>Finally, collaborate and share visibility. Community resources, such as RouteViews, RIPE RIS, and RIPE Atlas, are powerful tools for improving collective visibility into routing events. ROV-enabled ASes could further help by sharing \u2018dropped route\u2019 digests (for example, via mailing lists), giving others early warning of stealthy hijacks. We encourage operators to join the discussions, share operational experiences, and help shape practical defences. As an initial step, we have opened an&nbsp;<a href=\"https:\/\/datatracker.ietf.org\/doc\/draft-li-sidrops-stealthy-hijacking\/\" target=\"_blank\" rel=\"noreferrer noopener\">Internet Draft<\/a>&nbsp;to formally document this threat and invite feedback.<\/p>\n\n\n\n<p>Stealthy BGP hijacking is a subtle but real risk in today\u2019s partially secured Internet. The good news is that with wider RPKI adoption, better monitoring, and further collaboration, we can make it far harder for such attacks to succeed, and easier to detect when they do.<\/p>\n\n\n\n<p>Yihao presented this topic during&nbsp;<a href=\"https:\/\/conference.apnic.net\/60\/program\/program\/#\/day\/6\/64\" target=\"_blank\" rel=\"noreferrer noopener\">Technical Session 2<\/a>&nbsp;at APNIC 60. Watch the recording, including the audience discussion, now.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>By Yihao Chen, 16 de octubre de 2025 Co-authors:&nbsp;Qi Li,&nbsp;Ke Xu,&nbsp;Zhuotao Liu,&nbsp;Jianping Wu This article was originally published on the APNIC blog. Border Gateway Protocol (BGP) hijacking has long been one of the protocol\u2019s most persistent security threats. RPKI and ROV were standardized to provide origin authentication and mitigate the threat, but Route Origin Validation [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":23023,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[919],"tags":[1280],"archivo":[1345,1451],"taxonomy-authors":[1586],"tipo_autor":[],"class_list":["post-31621","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-routing","tag-routing","archivo-editions","archivo-highlights-2023","taxonomy-authors-yihao-chen"],"acf":{"author":"","related_notes":""},"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>LACNIC Blog | Understanding stealthy BGP hijacking risk in the ROV era<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"LACNIC Blog | Understanding stealthy BGP hijacking risk in the ROV era\" \/>\n<meta property=\"og:description\" content=\"By Yihao Chen, 16 de octubre de 2025 Co-authors:&nbsp;Qi Li,&nbsp;Ke Xu,&nbsp;Zhuotao Liu,&nbsp;Jianping Wu This article was originally published on the APNIC blog. Border Gateway Protocol (BGP) hijacking has long been one of the protocol\u2019s most persistent security threats. RPKI and ROV were standardized to provide origin authentication and mitigate the threat, but Route Origin Validation [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/\" \/>\n<meta property=\"og:site_name\" content=\"LACNIC Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/facebook.com\/lacnic\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-03T13:09:16+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-11-05T12:23:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/09\/bgp-blog-lacnic.png\" \/>\n\t<meta property=\"og:image:width\" content=\"680\" \/>\n\t<meta property=\"og:image:height\" content=\"330\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Gianni\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@lacnic\" \/>\n<meta name=\"twitter:site\" content=\"@lacnic\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/\"},\"author\":{\"name\":\"Gianni\",\"@id\":\"https:\/\/blog.lacnic.net\/#\/schema\/person\/1338d9cfdb0137e8bc5581f3771f39ab\"},\"headline\":\"Understanding stealthy BGP hijacking risk in the ROV era\",\"datePublished\":\"2025-11-03T13:09:16+00:00\",\"dateModified\":\"2025-11-05T12:23:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/\"},\"wordCount\":893,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/blog.lacnic.net\/#organization\"},\"image\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/09\/bgp-blog-lacnic.png\",\"keywords\":[\"Routing\"],\"articleSection\":[\"Routing\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/\",\"url\":\"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/\",\"name\":\"LACNIC Blog | Understanding stealthy BGP hijacking risk in the ROV era\",\"isPartOf\":{\"@id\":\"https:\/\/blog.lacnic.net\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/09\/bgp-blog-lacnic.png\",\"datePublished\":\"2025-11-03T13:09:16+00:00\",\"dateModified\":\"2025-11-05T12:23:34+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#primaryimage\",\"url\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/09\/bgp-blog-lacnic.png\",\"contentUrl\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/09\/bgp-blog-lacnic.png\",\"width\":680,\"height\":330},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\/\/blog.lacnic.net\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Understanding stealthy BGP hijacking risk in the ROV era\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.lacnic.net\/#website\",\"url\":\"https:\/\/blog.lacnic.net\/\",\"name\":\"LACNIC Blog\",\"description\":\"En el Blog de LACNIC encontrar\u00e1s art\u00edculos t\u00e9cnicos vinculados al desarrollo de Internet en la regi\u00f3n de Am\u00e9rica Latina y el Caribe.\",\"publisher\":{\"@id\":\"https:\/\/blog.lacnic.net\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.lacnic.net\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/blog.lacnic.net\/#organization\",\"name\":\"LACNIC Blog\",\"url\":\"https:\/\/blog.lacnic.net\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.lacnic.net\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/03\/lacnic-blog.svg\",\"contentUrl\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/03\/lacnic-blog.svg\",\"caption\":\"LACNIC Blog\"},\"image\":{\"@id\":\"https:\/\/blog.lacnic.net\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/facebook.com\/lacnic\",\"https:\/\/x.com\/lacnic\",\"https:\/\/www.instagram.com\/lacnic\/?hl=es-la\",\"https:\/\/uy.linkedin.com\/company\/lacnic\",\"https:\/\/www.youtube.com\/user\/lacnicstaff\",\"https:\/\/www.lacnic.net\/podcast\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.lacnic.net\/#\/schema\/person\/1338d9cfdb0137e8bc5581f3771f39ab\",\"name\":\"Gianni\",\"url\":\"https:\/\/blog.lacnic.net\/en\/author\/gianni\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"LACNIC Blog | Understanding stealthy BGP hijacking risk in the ROV era","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/","og_locale":"en_US","og_type":"article","og_title":"LACNIC Blog | Understanding stealthy BGP hijacking risk in the ROV era","og_description":"By Yihao Chen, 16 de octubre de 2025 Co-authors:&nbsp;Qi Li,&nbsp;Ke Xu,&nbsp;Zhuotao Liu,&nbsp;Jianping Wu This article was originally published on the APNIC blog. Border Gateway Protocol (BGP) hijacking has long been one of the protocol\u2019s most persistent security threats. RPKI and ROV were standardized to provide origin authentication and mitigate the threat, but Route Origin Validation [&hellip;]","og_url":"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/","og_site_name":"LACNIC Blog","article_publisher":"https:\/\/facebook.com\/lacnic","article_published_time":"2025-11-03T13:09:16+00:00","article_modified_time":"2025-11-05T12:23:34+00:00","og_image":[{"width":680,"height":330,"url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/09\/bgp-blog-lacnic.png","type":"image\/png"}],"author":"Gianni","twitter_card":"summary_large_image","twitter_creator":"@lacnic","twitter_site":"@lacnic","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#article","isPartOf":{"@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/"},"author":{"name":"Gianni","@id":"https:\/\/blog.lacnic.net\/#\/schema\/person\/1338d9cfdb0137e8bc5581f3771f39ab"},"headline":"Understanding stealthy BGP hijacking risk in the ROV era","datePublished":"2025-11-03T13:09:16+00:00","dateModified":"2025-11-05T12:23:34+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/"},"wordCount":893,"commentCount":0,"publisher":{"@id":"https:\/\/blog.lacnic.net\/#organization"},"image":{"@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/09\/bgp-blog-lacnic.png","keywords":["Routing"],"articleSection":["Routing"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/","url":"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/","name":"LACNIC Blog | Understanding stealthy BGP hijacking risk in the ROV era","isPartOf":{"@id":"https:\/\/blog.lacnic.net\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#primaryimage"},"image":{"@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/09\/bgp-blog-lacnic.png","datePublished":"2025-11-03T13:09:16+00:00","dateModified":"2025-11-05T12:23:34+00:00","breadcrumb":{"@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#primaryimage","url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/09\/bgp-blog-lacnic.png","contentUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/09\/bgp-blog-lacnic.png","width":680,"height":330},{"@type":"BreadcrumbList","@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijacking-risk\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/blog.lacnic.net\/en\/"},{"@type":"ListItem","position":2,"name":"Understanding stealthy BGP hijacking risk in the ROV era"}]},{"@type":"WebSite","@id":"https:\/\/blog.lacnic.net\/#website","url":"https:\/\/blog.lacnic.net\/","name":"LACNIC Blog","description":"En el Blog de LACNIC encontrar\u00e1s art\u00edculos t\u00e9cnicos vinculados al desarrollo de Internet en la regi\u00f3n de Am\u00e9rica Latina y el Caribe.","publisher":{"@id":"https:\/\/blog.lacnic.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.lacnic.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/blog.lacnic.net\/#organization","name":"LACNIC Blog","url":"https:\/\/blog.lacnic.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.lacnic.net\/#\/schema\/logo\/image\/","url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/03\/lacnic-blog.svg","contentUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/03\/lacnic-blog.svg","caption":"LACNIC Blog"},"image":{"@id":"https:\/\/blog.lacnic.net\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/facebook.com\/lacnic","https:\/\/x.com\/lacnic","https:\/\/www.instagram.com\/lacnic\/?hl=es-la","https:\/\/uy.linkedin.com\/company\/lacnic","https:\/\/www.youtube.com\/user\/lacnicstaff","https:\/\/www.lacnic.net\/podcast"]},{"@type":"Person","@id":"https:\/\/blog.lacnic.net\/#\/schema\/person\/1338d9cfdb0137e8bc5581f3771f39ab","name":"Gianni","url":"https:\/\/blog.lacnic.net\/en\/author\/gianni\/"}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/09\/bgp-blog-lacnic.png","jetpack_sharing_enabled":true,"wpml_current_locale":"en_US","wpml_translations":[{"locale":"es_ES","id":31599,"post_title":"El riesgo del secuestro furtivo de BGP en la era de la validaci\u00f3n de origen de rutas","slug":"riesgo-secuestro-bgp","href":"https:\/\/blog.lacnic.net\/riesgo-secuestro-bgp\/"},{"locale":"pt_BR","id":31624,"post_title":"Compreendendo o risco de sequestro furtivo de BGP na era da valida\u00e7\u00e3o de origem de rota (ROV)","slug":"risco-sequestro-bgp","href":"https:\/\/blog.lacnic.net\/pt-br\/risco-sequestro-bgp\/"}],"_links":{"self":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts\/31621","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/comments?post=31621"}],"version-history":[{"count":1,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts\/31621\/revisions"}],"predecessor-version":[{"id":31623,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts\/31621\/revisions\/31623"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/media\/23023"}],"wp:attachment":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/media?parent=31621"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/categories?post=31621"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/tags?post=31621"},{"taxonomy":"archivo","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/archivo?post=31621"},{"taxonomy":"taxonomy-authors","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/taxonomy-authors?post=31621"},{"taxonomy":"tipo_autor","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/tipo_autor?post=31621"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}