What is BGP Route Hijacking and how does RPKI (Resource Public Key Infrastructure) validate BGP routes?
❓ Interview Prompt: Explain BGP (Border Gateway Protocol) Hijacking, Autonomous Systems (AS), route leaks, and RPKI (Resource Public Key Infrastructure) Route Origin Authorizations (ROAs).
BGP Route Hijacking occurs when a rogue Autonomous System (AS) maliciously or accidentally advertises IP address prefixes it does not own over the Border Gateway Protocol:
Exploit Impact:
Traffic intended for legitimate IP addresses (e.g. DNS servers or financial APIs) is rerouted through the attacker's network, enabling Man-in-the-Middle decryption and traffic interception!
RPKI Mitigation:
Resource Public Key Infrastructure (RPKI) uses X.509 cryptographic certificates to publish Route Origin Authorizations (ROAs), allowing ISP routers to drop invalid BGP route hijack announcements automatically.
Code Implementation Example
# Verify RPKI ROA validation status for IP prefix using Routinator CLI:
routinator validate --prefix 203.0.113.0/24 --asn 64512Deploy RPKI ROA validation on BGP routers to prevent BGP route hijacking and traffic redirection.