Like Hetzner Online, both Softaculous and Zet.net, the transit peer downstream from Hetzner Online, failed to properly monitor their systems and, as a result, didn’t catch the hijacking until it had been ongoing on and off for 22 hours. There are also questions about another host provider, Nexon Host, whose infrastructure somehow facilitated the malicious announcement.
Ben Cartwright-Cox, a BGP expert and creator of the BGP Tools suite, called the lapses “silly, preventable mistakes.” Softaculous, Hetzner, and Zet.net didn’t immediately respond to emailed questions.
A brief history of BGP
BGP attacks target the underpinnings that make the Internet a unified, worldwide network. The Internet is splintered into many ASes (autonomous systems), also known as ASNs (autonomous system networks). Each AS is an independent network assigned a portion of the 3.7 billion publicly available addresses under the IPv4 protocol. BGP is the glue that binds all these ASes together and allows each one to connect to any other.
To allow an address assigned to an AS in, say, Germany to reach IPs in North America, an AS must “announce” the other ASes that should transit the traffic. These routing announcements are declarations made as entries on a global routing table used by all ASes and the hosting providers serving them. In the Internet’s early days, BGP ran on trust. Providers simply assumed announcements were valid and made in good faith.
Over the years, attackers repeatedly abused this trust by making announcements for IPs they had no valid right to control. Attackers—with ties to both nation-states and financially motivated groups—capitalized on the lax system to, in some cases, route petabytes’ worth of sensitive data through networks they controlled.
Eventually, Internet architects developed a series of measures to prevent such hijacking. The most prominent of these is RPKI (Resource Public Key Infrastructure) ROV (Route Origin Validation). RPKI ROV uses cryptographic records called Route Origin Authorizations (ROAs) to assert the proper origin and prefix mask length of routes in BGP. ASes that deploy RPKI ROV will reject routes that don’t match the information contained in ROAs, preventing hijacks from spreading throughout the Internet.
