Subject: BGP security in practice

From: [email-masked]
Date: Mon, 4 Nov 2002 08:40:19 -0500 (EST)

Lots of you folk probably read the rpsec list as well, but for those who
don't, there's a discussion going on of how many ISP's use the MD5 shared
secret form of authentication.  The response are, uh, disheartenting.
I've attached one message that says that some ISP's are ignorant of the
existence of security problems.  That beggars the imagination.

In the judgement of those on this list, is the general ISP as clueless
as this?  Mind you, I'm not asking if the common ISP uses the MD5, just
if they know that there's a security vulnerability if they don't.

And then the second question is how many ISP's do use the MD5 authentication
and whether it varies by distance from the backbone.  (Please tell me that
the major backbone carriers use this!)

--Sandy

---

From: Jeffrey Haas <[email-masked]>
Date: Mon, 4 Nov 2002 10:10:39 -0500

Sandy,

> if they know that there's a security vulnerability if they don't.

Most ISPs wont react to something (note: react) until you demonstrate
the vulnerability to them.  Its one thing to tell them there is a
vulnerability.  You have to demonstrate an exploit before they will
care.

And honestly, people are more worried about their routers getting
hacked into rather than attacks on the BGP Protocol.

> the major backbone carriers use this!)

Major backbones *may* do this internally.  Chatting with people at
various NANOGs seem to indicate that many of the "tier-1's" don't
bother to authenticate their customer sessions.

In the grand scheme of things, ISPs are more concerned about "bad"
data getting leaked into the routing system rather than they are
about session hijacking or DoS.

-- 
Jeff Haas 
NextHop Technologies

---

From: Vincent Gillet <[email-masked]>
Date: Mon, 4 Nov 2002 16:28:07 +0100

Hi Jeffrey,

> vulnerability.  You have to demonstrate an exploit before they will

That is exactly the point i wanted to raise.
I would push to implement MD5 (it's weak, i know) only if somebody
demonstrate that vulnerability does exist.

> hacked into rather than attacks on the BGP Protocol.

This is true today, but i am rather confident that BGP authentication/
authorization would be a hot issue in coming years.

> about session hijacking or DoS.

Do agree. This is what i call "prefix authentication/authorization".

Vincent.

---

From: Jeffrey Haas <[email-masked]>
Date: Mon, 4 Nov 2002 10:37:54 -0500

Vincent,

> demonstrate that vulnerability does exist.

TCP session resets are the most likely attack that I think we'll
see in the near future.  Its easier to hack enable privileges
on a box than it is to hijack the session and screw with routing
that way.

And an active hijack is far more likely to be noticed by a provider.

> authorization would be a hot issue in coming years.

Lets plug the big holes first, shall we? :-)

-- 
Jeff Haas 
NextHop Technologies