Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security IT Technology

You Can Now Check If Your ISP Uses Basic Security Measures (wired.com) 28

Posted by msmash from the better-security dept.
"Is BGP Safe Yet" is a new site that names and shames internet service providers that don't tend to their routing. From a report: For more than an hour at the beginning of April, major sites like Google and Facebook sputtered for large swaths of people. The culprit wasn't a hack or a bug. It was problems with the internet data routing standard known as the Border Gateway Protocol, which had allowed significant amounts of web traffic to take an unexpected detour through a Russian telecom. For Cloudflare CEO Matthew Prince, it was the last straw. BGP disruptions happen frequently, generally by accident. But BGP can also be hijacked for large-scale spying, data interception, or as a sort of denial of service attack.

[...] On Friday, the company launched Is BGP Safe Yetâ, a site that makes it easier for anyone to check whether their internet service provider has added the security protections and filters that can make BGP more stable. Those improvements are most effective with wide adoption from ISPs, content delivery networks like Cloudflare, and other cloud providers. Cloudflare estimates that so far about half of the internet is more protected thanks to heavy hitters like AT&T, the Swedish telecom Telia, and the Japanese telecom NTT adopting BGP improvements. And while Cloudflare says it doesn't seem like the Rostelecom incident was intentional or malicious, Russian telecoms do have a history of suspicious BGP meddling, and similar problems will keep cropping up until the whole industry is on board.
This discussion has been archived. No new comments can be posted.

You Can Now Check If Your ISP Uses Basic Security Measures More

You Can Now Check If Your ISP Uses Basic Security Measures

Comments Filter:

  • If ISPs could be shamed... (Score:5, Funny)

    by mlw4428 ( 1029576 ) on Monday April 20, 2020 @12:51PM (#59968890)
    Comcast wouldn't exist.
  • What ISP do you recommend?

    What company provides the best web site hosting?

    • What ISP do you recommend?

      Based on what? Because the article in question is talking about BGP security a topic that 99% of people reply with "huh", and the other 1% reply with "meh".

      • Re: (Score:1)

        by bn-7bc ( 909819 )
        Well my reaction was , poor Comcast costumers , and it seams like rpgi is slowly rolling out arround the worl , finally, what took isps so long?

  • Not all ISPs think this is a good thing.. (Score:5, Interesting)

    by blahblahwoofwoof ( 2287010 ) on Monday April 20, 2020 @12:56PM (#59968916)

    x-post from a comment on Ars Technica: https://www.aa.net.uk/etc/news... [aa.net.uk]

    I am not an expert on BGP, but the response from Arnold&Arnold, linked above, appears to make some good points.

    • Re:Not all ISPs think this is a good thing.. (Score:4, Interesting)

      by guruevi ( 827432 ) on Monday April 20, 2020 @01:14PM (#59968996)

      It is a response with some legitimate concerns, but it basically boils down to this: we don't trust SSL certificates because a court could still order xyz to shut down a route giving a false sense of security. While that is true, it is better than nothing. You also don't HAVE to trust blindly because certificates are in place, you could come up with a PKI for self-signed certificate systems where you explicitly trust a particular provider or even have levels of trust. If an order goes in place, it is possible that with obligatory certificates, you end up shutting out an entire country until the law or order gets revoked but that is kind of what you want - a MAD situation so nobody dares to order a legal redirect since you end up instantly revoking all your own Internet access.

      In short, many providers won't change because it costs money (a ton of money as a lot of high-end switches are custom programmed and hardwired) really hard to interfere with BGP, you almost need root or physical access to the routers, at which point it's game over, regardless of the system you use. Cloudflare wants you to use it because they're new and hip and they support it, so pay them to make sure your traffic won't be blackholed.

      • While that is true, it is better than nothing.

        But is it? I think if the past examples are anything to go by then BGP hijacks don't go unnoticed and don't stay in affect very long. At that point wouldn't a false sense of security be worse than no security?

        I mean we don't hear of this much. The internet is a sick place, and companies pull a lot of stops to prevent the spread of malware and fraud, hell daily we hear a topic about COVID-19 spam emails and fraud, even on the Slashdot front page. But the only cases we hear of something going wrong with BGP r

        • Re: (Score:3)

          by Cyberax ( 705495 )

          But is it? I think if the past examples are anything to go by then BGP hijacks don't go unnoticed and don't stay in affect very long. At that point wouldn't a false sense of security be worse than no security?

          ACCIDENTAL route leaks don't stay unnoticed long. Intentional hijacks can be quite sneaky and hard to detect.

        • Re: (Score:2)

          by guruevi ( 827432 )

          Better monitoring systems would help, it also does help to know if a particular BGP route is advertised but not signed or mutually trusted. You could also internally divide signing power between multiple employees, so if one makes a mistake, 2 or 3 have to sign off on it.

      • I think I'll set up my own alternative site, isbgpsafeyet.org or something. When you go there it'll be a single static page that displays a big "No" in a 72-point font. Conveys all the information you need on BGP without the effort of setting up a full site.

      • It's worse than that. Firstly, RPKI has been around for years but has never taken off because it's PKI. If it was going to work, it would have worked by now.

        Secondly, the blacklisting concerns are legitimate, and one of the reasons why many countries haven't signed up to RPKI, it's the ultimate cryptographically enforced censorship mechanism. If some government, or more likely some commercial interest like the MAFIAA or or IFPI or BVMI or whatever decide you shouldn't exist, RPKI will enforce that.

        So RP

  • "basic" security measures? (Score:3)

    by dills ( 102733 ) on Monday April 20, 2020 @01:21PM (#59969034) Homepage

    There's nothing "basic" about RPKI.

    Is it useful? Yes. Is it more secure than not using it? Yes.

    Is it easy to deploy? No.

    Is it basic? There's nothing about it that is basic.

    • "Basic" measures would be filtering using prefix-lists derived from IRR data. ...and far too many ASs don't even implement that.

    • Re: (Score:2)

      by bbn ( 172659 )

      Took me about an hour to deploy. It can in fact be very easy but does require that your router has support of course.

  • Failure!
  • I would rather shame my ISP about lack of IPv6, but eh, I'll take what I can.

  • Is BGP Safe YetÃ

  • Your ISP (Shaw Cablesystems, AS6327) does not implement BGP safely. It should be using RPKI to protect the Internet from BGP hijacks.

    fetch https://valid.rpki.cloudflare.... [cloudflare.com]
    correctly accepted valid prefixes

    fetch https://invalid.rpki.cloudflar... [cloudflare.com]
    incorrectly accepted invalid prefixes

    Now if someone else can post Telus from western Canada, that would be very interesting.

  • And what does RPKI implementation do to internet anonymity?

Slashdot Top Deals

Lots of folks confuse bad management with destiny. -- Frank Hubbard

Close