[anti-abuse-wg] 2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)

Hi Furio,

If we can find a non-contentious way to word it, I will be in favor of this.

Note that in order to speed-up the conversation, the co-authors are not coordinating responses, so I mean we don't necessarily agree, but this is part of the fun of this discussion!

Regards,
Jordi
 
 

El 20/3/19 12:00, "anti-abuse-wg en nombre de furio ercolessi" <anti-abuse-wg-bounces at ripe.net en nombre de furio+as at spin.it> escribió:

    On Wed, Mar 20, 2019 at 11:01:30AM +0300, Andrey Korolyov wrote:
    > >
    > >
    > > And when everything is made clear, if a report is filed against AS1, AS1's
    > > holder might have a problem, so i see a strong reason for not even trying
    > > :-)
    > >
    > >
    > Out of interest, take an AS1 with single malicious upstream AS2, what stops
    > AS2 to pretend that AS1 has made bogus announcements and make them for its
    > own purposes? This situation looks pretty real without RPKI or other
    > advertisement strengthening methods, as I could see. How experts are
    > supposed to behave in this situation?
    
    This has been seen many times, even chain situations like
    
    <upstreams and peers> - AS X
                                 \
                                   AS 3 - AS 2 - AS 1
                                 /
    <upstreams and peers> - AS Y
    
    where X and Y are legitimate ISPs, while {1,2,3} is basically a single rogue
    entity - or a set of rogue entities closely working together with a common
    criminal goal.
    
    In such a setup, AS 1 should be considered as the most "throw-away" resource,
    while AS 3 would play the "customer of customer, not my business" role,
    and AS 2 would play the  "i notified my customer and will disconnect them
    if they continue" role.  When AS 1 is burnt, a new one is made - with 
    new people as contacts, new IP addresses, etc, so that no obvious correlation
    can be made.  Most of the bad guys infrastructure is in AS 3 and that remains
    pretty stable because their bad nature can not be easily demonstrated.
    
    Whatever set of rules is made against hijacking, it should be assumed that
    these groups will do everything to get around those rules, and many AS's
    can be used to this end.  Since there is no shortage of AS numbers, I 
    assume that anybody can get one easily so they can change them as if they
    were underwear.
    
    And yes, unallocated AS's in the AS 1 position, announcing unallocated IPs,
    have also been seen.  Those are even easier to get :-)
    
    So the ideal scheme to counteract BGP hijacking should be able to climb up
    the BGP tree in some way, until "real" ISPs are reached.
    
    Nice discussion!
    
    furio ercolessi
    
    
    



**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.theipv6company.com
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.