Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
Security IT Technology

You Can Now Check If Your ISP Uses Basic Security Measures (wired.com) 28

Posted by msmash from the better-security dept.
"Is BGP Safe Yet" is a new site that names and shames internet service providers that don't tend to their routing. From a report: For more than an hour at the beginning of April, major sites like Google and Facebook sputtered for large swaths of people. The culprit wasn't a hack or a bug. It was problems with the internet data routing standard known as the Border Gateway Protocol, which had allowed significant amounts of web traffic to take an unexpected detour through a Russian telecom. For Cloudflare CEO Matthew Prince, it was the last straw. BGP disruptions happen frequently, generally by accident. But BGP can also be hijacked for large-scale spying, data interception, or as a sort of denial of service attack.

[...] On Friday, the company launched Is BGP Safe Yetâ, a site that makes it easier for anyone to check whether their internet service provider has added the security protections and filters that can make BGP more stable. Those improvements are most effective with wide adoption from ISPs, content delivery networks like Cloudflare, and other cloud providers. Cloudflare estimates that so far about half of the internet is more protected thanks to heavy hitters like AT&T, the Swedish telecom Telia, and the Japanese telecom NTT adopting BGP improvements. And while Cloudflare says it doesn't seem like the Rostelecom incident was intentional or malicious, Russian telecoms do have a history of suspicious BGP meddling, and similar problems will keep cropping up until the whole industry is on board.
This discussion has been archived. No new comments can be posted.

You Can Now Check If Your ISP Uses Basic Security Measures More

You Can Now Check If Your ISP Uses Basic Security Measures

Comments Filter:

  • If ISPs could be shamed... (Score:5, Funny)

    by mlw4428 ( 1029576 ) on Monday April 20, 2020 @12:51PM (#59968890)
    Comcast wouldn't exist.
  • What ISP do you recommend?

    What company provides the best web site hosting?

    • What ISP do you recommend?

      Based on what? Because the article in question is talking about BGP security a topic that 99% of people reply with "huh", and the other 1% reply with "meh".

      • Re: (Score:1)

        by bn-7bc ( 909819 )
        Well my reaction was , poor Comcast costumers , and it seams like rpgi is slowly rolling out arround the worl , finally, what took isps so long?

  • Not all ISPs think this is a good thing.. (Score:5, Interesting)

    by blahblahwoofwoof ( 2287010 ) on Monday April 20, 2020 @12:56PM (#59968916)

    x-post from a comment on Ars Technica: https://www.aa.net.uk/etc/news... [aa.net.uk]

    I am not an expert on BGP, but the response from Arnold&Arnold, linked above, appears to make some good points.

    • Comment removed (Score:4, Interesting)

      by account_deleted ( 4530225 ) on Monday April 20, 2020 @01:14PM (#59968996)
      Comment removed based on user account deletion

      • While that is true, it is better than nothing.

        But is it? I think if the past examples are anything to go by then BGP hijacks don't go unnoticed and don't stay in affect very long. At that point wouldn't a false sense of security be worse than no security?

        I mean we don't hear of this much. The internet is a sick place, and companies pull a lot of stops to prevent the spread of malware and fraud, hell daily we hear a topic about COVID-19 spam emails and fraud, even on the Slashdot front page. But the only cases we hear of something going wrong with BGP r

        • Re: (Score:3)

          by Cyberax ( 705495 )

          But is it? I think if the past examples are anything to go by then BGP hijacks don't go unnoticed and don't stay in affect very long. At that point wouldn't a false sense of security be worse than no security?

          ACCIDENTAL route leaks don't stay unnoticed long. Intentional hijacks can be quite sneaky and hard to detect.

        • Comment removed based on user account deletion
      • I think I'll set up my own alternative site, isbgpsafeyet.org or something. When you go there it'll be a single static page that displays a big "No" in a 72-point font. Conveys all the information you need on BGP without the effort of setting up a full site.

      • It's worse than that. Firstly, RPKI has been around for years but has never taken off because it's PKI. If it was going to work, it would have worked by now.

        Secondly, the blacklisting concerns are legitimate, and one of the reasons why many countries haven't signed up to RPKI, it's the ultimate cryptographically enforced censorship mechanism. If some government, or more likely some commercial interest like the MAFIAA or or IFPI or BVMI or whatever decide you shouldn't exist, RPKI will enforce that.

        So RP

  • "basic" security measures? (Score:3)

    by dills ( 102733 ) on Monday April 20, 2020 @01:21PM (#59969034) Homepage

    There's nothing "basic" about RPKI.

    Is it useful? Yes. Is it more secure than not using it? Yes.

    Is it easy to deploy? No.

    Is it basic? There's nothing about it that is basic.

    • "Basic" measures would be filtering using prefix-lists derived from IRR data. ...and far too many ASs don't even implement that.

    • Re: (Score:2)

      by bbn ( 172659 )

      Took me about an hour to deploy. It can in fact be very easy but does require that your router has support of course.

  • Failure!
  • I would rather shame my ISP about lack of IPv6, but eh, I'll take what I can.

  • Is BGP Safe YetÃ

  • Your ISP (Shaw Cablesystems, AS6327) does not implement BGP safely. It should be using RPKI to protect the Internet from BGP hijacks.

    fetch https://valid.rpki.cloudflare.... [cloudflare.com]
    correctly accepted valid prefixes

    fetch https://invalid.rpki.cloudflar... [cloudflare.com]
    incorrectly accepted invalid prefixes

    Now if someone else can post Telus from western Canada, that would be very interesting.

  • And what does RPKI implementation do to internet anonymity?

Slashdot Top Deals

"I have just one word for you, my boy...plastics." - from "The Graduate"

Close