<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-AU link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>Hi,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>And how you can detect if an AS is hijacking a prefix? RPKI does not check if entire path is correct and the attacker can bypass it by adding the origin AS at the end of AS-PATH.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>BGPsec is there to address the BGP hijacking, but creating a black-list and some policies to list/delist ASNs just making things more complex (starting with who is going to manage the list)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>Regards,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>Arash<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri",sans-serif'> members-discuss <members-discuss-bounces@ripe.net> <b>On Behalf Of </b>Dominic Schallert<br><b>Sent:</b> Wednesday, 1 August 2018 7:59 PM<br><b>To:</b> members-discuss@ripe.net<br><b>Subject:</b> [members-discuss] Effective countermeasures against BGP hijacking<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Dear colleagues,<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I’m sure some of you have read about this recent incident; <a href="https://bgpstream.com/event/144058">https://bgpstream.com/event/144058</a> . Nowadays we’re talking about transport security, https-per-default, etc. but the most fundamental parts of the internet such as BGP, are basically broken from a security perspective. While RPKI/ROA/ROV could fix most of the current security-related struggles, their deployment currently competes somewhat with IPv6 - or even worse - and therefore won’t be a practical solution in the forseeable future. Strict IRRDB and route object filtering is complicated (or almost impossible) as well.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>So I’m wondering, why can't we just have an automated blacklist like RBL's for mailservers, where all AS'es detected for hijacking prefixes are automatically blacklisted, similiar to Team Cymru's fullbogons feed? The list combined with some scripting could then be used for realtime AS-path filtering at border routers. Delisting of blacklisted ASNs should happen only after a pre-defined amount of time (eg. 14 days) or after paying a fee to a charity/non-profit and providing a statement on the issue which is publicy released. The idea is to hurt those who can’t get their stuff - especially prefix filtering - together.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I still remember the days where everyone complained about RBLs, nowadays almost every mailserver setup relies on them. Sometimes extreme problems require extrem solutions.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black'>Mit besten Grüßen<br>Kind Regards<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black'>Dominic Schallert, BA<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black'><br><img border=0 width=150 height=50 style='width:1.5625in;height:.5208in' id="_x0031_2833806-32B1-428E-AF6C-ABEC43E89F8B" src="cid:image001.png@01D429EA.7D57A910"><o:p></o:p></span></p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='border-collapse:collapse;-webkit-text-stroke-width: 0px;word-spacing:0px'><tr style='height:3.75pt'><td style='padding:0cm 0cm 0cm 0cm;height:3.75pt'></td></tr><tr><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal style='line-height:7.5pt'><b><span style='font-size:7.5pt;font-family:"Arial",sans-serif;color:#B0B0B0;border:none windowtext 1.0pt;padding:0cm'>schallert.com e.U.</span></b><span style='font-size:7.5pt;font-family:"Arial",sans-serif;color:#B0B0B0'> | Hauptstraße 35b, 6800 Feldkirch, Austria<o:p></o:p></span></p></td></tr><tr style='height:3.75pt'><td style='padding:0cm 0cm 0cm 0cm;height:3.75pt'><p class=MsoNormal style='mso-line-height-alt:3.75pt'><span style='font-size:4.0pt;font-family:"Arial",sans-serif;color:#B0B0B0'> <o:p></o:p></span></p></td></tr><tr><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal style='line-height:7.5pt'><span style='font-size:7.5pt;font-family:"Arial",sans-serif;color:#B0B0B0'>FN: 440372g<span class=apple-converted-space> </span> | UID: ATU66209211 | Gerichtsstand: Feldkirch<o:p></o:p></span></p></td></tr><tr style='height:3.75pt'><td style='padding:0cm 0cm 0cm 0cm;height:3.75pt'><p class=MsoNormal style='mso-line-height-alt:3.75pt'><span style='font-size:4.0pt;font-family:"Arial",sans-serif;color:#B0B0B0'> <o:p></o:p></span></p></td></tr><tr><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal style='line-height:7.5pt'><span style='font-size:7.5pt;font-family:"Arial",sans-serif;color:#B0B0B0'>Tel.: +43 680 146 1947 | Fax: +43 134 242 642 616<o:p></o:p></span></p></td></tr><tr style='height:7.5pt'><td style='padding:0cm 0cm 0cm 0cm;height:7.5pt'></td></tr><tr><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal style='line-height:7.5pt'><span style='font-size:7.5pt;font-family:"Arial",sans-serif;color:#B0B0B0'><a href="http://www.schallert.com"><span style='color:#B0B0B0;border:none windowtext 1.0pt;padding:0cm;text-decoration:none'>www.schallert.com</span></a><span class=apple-converted-space> </span> | <a href="mailto:office@schallert.com"><span style='color:#B0B0B0;border:none windowtext 1.0pt;padding:0cm;text-decoration:none'>office@schallert.com</span></a><o:p></o:p></span></p></td></tr></table><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black'><br><br><o:p></o:p></span></p><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black'><br><br><o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black'><br><br style='caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><br></span><o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p></div></div><div id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br />
<table style="border-top: 1px solid #D3D4DE;">
<tr>
<td style="width: 55px; padding-top: 13px;"><a href="http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient" target="_blank"><img src="https://ipmcdn.avast.com/images/icons/icon-envelope-tick-green-avg-v1.png" alt="" width="46" height="29" style="width: 46px; height: 29px;" /></a></td>
<td style="width: 470px; padding-top: 12px; color: #41424e; font-size: 13px; font-family: Arial, Helvetica, sans-serif; line-height: 18px;">Virus-free. <a href="http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient" target="_blank" style="color: #4453ea;">www.avg.com</a>
</td>
</tr>
</table><a href="#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"> </a></div></body></html>