Reducing the impact of border gateway protocol (BGP) hijacks
Systems, methods, and devices of the various embodiments may enable the reduction of the impact of Border Gateway Protocol (BGP) hijacks by automatically announcing more-specific route prefixes when a netblock is hijacked. In various embodiments, the more-specific route prefixes may be automatically withdrawn when the netblock hijacking stops.
1. A method of mitigating a Border Gateway Protocol (BGP) hijack, comprising:
determining, by a computing device, an attribute of a hijacked netblock in response to receiving a BGP netblock hijack indication;
determining, by the computing device, whether more-specific routing prefixes are available for the hijacked netblock based at least in part on the determined attribute of the hijacked netblock;
generating, by the computing device, more-specific replacement routing prefixes for the hijacked netblock in response to determining that more-specific routing prefixes are available for the hijacked netblock; and
sending, from the computing device, a BGP update including the more-specific replacement routing prefixes for the hijacked netblock to a router.
2. The method of claim 1 , wherein the more-specific replacement routing prefixes for the hijacked netblock have a prefix length of 24 bits.
3. The method of claim 1 , wherein the more-specific replacement routing prefixes for the hijacked netblock have a prefix length of 48 bits.
4. The method of claim 1 , further comprising receiving, at the computing device, the BGP netblock hijack indication.
5. The method of claim 1 , further comprising
sending, from the computing device, a BGP withdraw removing the more-specific replacement routing prefixes for the hijacked netblock to the router to return the hijacked netblock to a routing prefix setting at a time the BGP hijack occurred in response to determining the BGP hijack is complete.
6. The method of claim 1 , further comprising:
generating, by the computing device, a less-specific routing prefix for the hijacked netblock in response to determining the BGP hijack is complete; and
sending, from the computing device, a BGP update including the less-specific routing prefix for the hijacked netblock to the router.
7. The method of claim 6 , wherein determining the BGP hijack is complete is based at least in part on a BGP netblock reclamation time period expiring or receiving a BGP netblock hijack all clear indication.
8. The method of claim 6 , wherein the less-specific routing prefix for the hijacked netblock has a prefix length of 47 bits or lower.
9. A device, comprising:
a memory; and
a processor, coupled to the memory, wherein the processor is configured with processor-executable instructions to perform operations comprising:
determining an attribute of a hijacked netblock in response to receiving a Border Gateway Protocol (BGP) netblock hijack indication;
determining whether more-specific routing prefixes are available for the hijacked netblock based at least in part on the determined attribute of the hijacked netblock;
generating more-specific replacement routing prefixes for the hijacked netblock in response to determining that more-specific routing prefixes are available for the hijacked netblock; and
sending a BGP update including the more-specific replacement routing prefixes for the hijacked netblock to a router.
10. The device of claim 9 , wherein the processor is configured with processor-executable instructions to perform operations such that the more-specific replacement routing prefixes for the hijacked netblock have a prefix length of 24 bits.
11. The device of claim 9 , wherein the processor is configured with processor-executable instructions to perform operations such that the more-specific replacement routing prefixes for the hijacked netblock have a prefix length of 48 bits.
12. The device of claim 9 , wherein the processor is configured with processor-executable instructions to perform operations further comprising receiving, at the computing device, the BGP netblock hijack indication.
13. The device of claim 9 , wherein the processor is configured with processor-executable instructions to perform operations further comprising:
sending a BGP withdraw removing the more-specific replacement routing prefixes for the hijacked netblock to the router to return the hijacked netblock to a routing prefix setting at a time the BGP hijack occurred in response to determining the BGP hijack is complete.
14. The device of claim 9 , wherein the processor is configured with processor-executable instructions to perform operations further comprising:
generating a less-specific routing prefix for the hijacked netblock in response to determining the BGP hijack is complete; and
sending a BGP update including the less-specific routing prefix for the hijacked netblock to the router.
15. The device of claim 14 , wherein the processor is configured with processor-executable instructions to perform operations such that determining the BGP hijack is complete is based at least in part on a BGP netblock reclamation time period expiring or receiving a BGP netblock hijack all clear indication.
16. The device of claim 14 , wherein the processor is configured with processor-executable instructions to perform operations such that the less-specific routing prefix for the hijacked netblock has a prefix length of 47 bits or lower.
17. A non-transitory processor-readable storage medium having stored thereon processor-executable instructions configured to cause a processor to perform operations, comprising:
determining an attribute of a hijacked netblock in response to receiving a Border Gateway Protocol (BGP) netblock hijack indication;
determining whether more-specific routing prefixes are available for the hijacked netblock based at least in part on the determined attribute of the hijacked netblock;
generating more-specific replacement routing prefixes for the hijacked netblock in response to determining that more-specific routing prefixes are available for the hijacked netblock; and
sending a BGP update including the more-specific replacement routing prefixes for the hijacked netblock to a router.
18. The non-transitory processor-readable storage medium of claim 17 , wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that the more-specific replacement routing prefixes for the hijacked netblock have a prefix length of 24 bits.
19. The non-transitory processor-readable storage medium of claim 17 , wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that the more-specific replacement routing prefixes for the hijacked netblock have a prefix length of 48 bits.
20. The non-transitory processor-readable storage medium of claim 17 , wherein the stored processor-executable instructions are configured to cause a processor to perform operations further comprising receiving, at the computing device, the BGP netblock hijack indication.
21. The non-transitory processor-readable storage medium of claim 17 , wherein the stored processor-executable instructions are configured to cause a processor to perform operations further comprising:
sending a BGP withdraw removing the more-specific replacement routing prefixes for the hijacked netblock to the router to return the hijacked netblock to a routing prefix setting at a time the BGP hijack occurred in response to determining the BGP hijack is complete.
22. The non-transitory processor-readable storage medium of claim 17 , wherein the stored processor-executable instructions are configured to cause a processor to perform operations further comprising:
generating a less-specific routing prefix for the hijacked netblock in response to determining the BGP hijack is complete; and
sending a BGP update including the less-specific routing prefix for the hijacked netblock to the router.
23. The non-transitory processor-readable storage medium of claim 22 , wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that determining the BGP hijack is complete is based at least in part on a BGP netblock reclamation time period expiring or receiving a BGP netblock hijack all clear indication.
24. The non-transitory processor-readable storage medium of claim 22 , wherein the stored processor-executable instructions are configured to cause a processor to perform operations such that the less-specific routing prefix for the hijacked netblock has a prefix length of 47 bits or lower.