Subject: Re: BGP security in practice

From: [email-masked]
Date: Mon, 4 Nov 2002 10:28:14 -0500 (EST)

>Most ISPs wont react to something (note: react) until you demonstrate
>the vulnerability to them.  Its one thing to tell them there is a
>vulnerability.  You have to demonstrate an exploit before they will
>care.

The accidental errors that have caused numerous problems in the past
provide lots of evidence of vulnerability to me.  Anything that can
fail because of accidents and misconfigurations can be made to fail
on purpose.

>In the grand scheme of things, ISPs are more concerned about "bad"
>data getting leaked into the routing system rather than they are
>about session hijacking or DoS.

And those insider problems are even harder to deal with than the
outsider problems, which they aren't dealing with.  What's needed
- an equivalent to a public health media campaign?

--Sandy

---

From: Jeffrey Haas <[email-masked]>
Date: Mon, 4 Nov 2002 10:41:29 -0500

On Mon, Nov 04, 2002 at 10:28:14AM -0500, [email-masked] wrote:
> provide lots of evidence of vulnerability to me.

I was speaking more to the md5 issue than the generic 'bgp security issue',
but:

> Anything that can

Even in a "perfect" world, you are still vulnerable to the following
vulnerabilities:
o Route redistribution issues - either distributing them or not
  incorrectly.
  (Admittedly, an IRR policy check along every step could catch this.)
o Doing "bad things" to your own routes.

> - an equivalent to a public health media campaign?

Well, getting flamed publicly doesn't seem to help.

-- 
Jeff Haas 
NextHop Technologies

---

From: [email-masked]
Date: Mon, 4 Nov 2002 13:00:47 -0500 (EST)

> fail because of accidents and misconfigurations can be made to fail

Pray tell, how would MD5 secret solve configuration problems?

Alex