White House thinks it's time to fix the insecure glue of the internet: Yup, BGP

The White House on Tuesday indicated it hopes to shore up the weak security of internet routing, specifically the Border Gateway Protocol (BGP). BGP more or less glues the internet as we know it together. It's used to manage the routes your online traffic takes between the networks, known as autonomous systems or ASes, that …

[john.jones.name]

Australia and APAC is pretty bad

while yes the lumbering USA government depts are bad at this the main problem is APAC you know where most people actually live and have ISP's

https://isbgpsafeyet.com/

Optus need to get their network upgraded no IPv6 or RPKI

[Yorick Hunt]

Re: Australia and APAC is pretty bad

Optus needs to disappear in a puff of logic; they've been useless in every conceivable way since SingTel took over.

[Michael Hoffmann]

File size limits are a thing of the past!

Let's just go back to sharing /etc/hosts!

[jake]

Re: File size limits are a thing of the past!

You mean you don't?

That's not very friendly.

[David 132]

Re: File size limits are a thing of the past!

Well, in the spirit of sharing and friendliness, if anyone wants access to all my data, I am at IP address 127.0.0.1 and my main drive is designated “C:” - help yourselves!

[JavaJester]

Re: File size limits are a thing of the past!

Or if you use IPv6 my address is ::1. Because sharing is caring.

[jake]

Noibody with a clue ever said ...

... that the Internet was designed to be secure, was intended to be secure, was secure, or in fact could be made secure.

Being nothing more than a wide area network built to investigate/study wide area networking, this existing iteration of "The Internet" is not now, never has been, and never will be secure ... at least not without a complete tear-down, redesign and rebuild. From scratch. That's what happens when you build a network from the ground up to share data, not to suppress the sharing of that data.

Putting on bandaids by changing things like BGP will not change this.

[Arthur the cat]

Re: Noibody with a clue ever said ...

this existing iteration of "The Internet" is not now, never has been, and never will be secure ... at least not without a complete tear-down, redesign and rebuild

Considering that IPv6, which is an incremental change, still hasn't been fully adopted after a quarter of a century, the world is likely to switch to a completely different system sometime shortly after the last ocean boils dry.

[Anonymous Coward]

Re: Noibody with a clue ever said ...

Actually, this will be used to 'shape traffic' by governments into the bit-bucket when they don't approve of it. I'm sure it'll have benign uses too, but anytime you put a lock on the door, it can be abused.

[vtcodger]

Re: Noibody with a clue ever said ...

No, the internet isn't secure by design. Neither, in all likelyhood, is it securable in practice. But that's not really a reason not to slap a few bandaids on some of the places where it's bleeding badly and maybe apply a little antibiotic cream as well. Regrettably perhaps the modern internet isn't all cat videos and crypto scams. It's being used by critical infrastructure. Might be best if that stuff kept working.

[jake]

Re: Noibody with a clue ever said ...

"It's being used by critical infrastructure. Might be best if that stuff kept working."

Might be best if they ween themselves off the teat of the Internet before something goes 'orribly wrong.

One doesn't need the Internet to keep critical infrastructure running.

[ExpatZ]

Right.

So this is the US government, in specific the POLITICAL arm of it, saying they want the main routing protocol 'fixed'.

Alarm bells anyone? The country that runs surveilance on the entire planet including their own citizens that includes such hits as tracking your phone calls, collecting all your email, tracking all your connections, watching all your web traffic, tracking you via your cell phone (and intercepting the calls), runs connection and association software based on all that data and tries to weaken encryprtion protocols so they can snoop even harder.

The US, the worlds most prolific nation state hacker and pervasive invasive spy state wants changes made to the routing protocol that enhance tracking capability, does a red flag pop up for you now?

No?

Given the Dual_EC_DRBG fiasco what makes you think they haven't already backdoored this one too, particularly as it is used prolifically in APAC?

Still no red flags?

OK I see you don't remember Vault 7, Dual_EC_DRBG and know nothing about security.

Carry on.

[Anonymous Coward]

A BGP hijacking incident that I think indicates a larger problem.

In September 2022, someone BGP hijacked a cryptocurrency thing called Celer Network Bridge.

They got a valid TLS certificate for an imposter website by paying $18 and stole $235,000 in three hours

https://www.coinbase.com/blog/celer-bridge-incident-analysis

If a service is doing proper encryption and cryptographic authentication then a BGP hijack should just result in the service not working, but it seems that just seeing https in your browser is not a guarantee of that.

The operator of a website can, if they choose, do extra work to configure CAA to make it harder for an imposter website to show valid https but end users are never aware if that has been done. People putting together a website just think "showing ok in a browser and the free certificate is auto-renewing, great, it's all good".

Last year 'someone' put a man-in-the-middle proxy in front of the jabber.ru server in a Hetzner datacenter in Germany, it was noticed six months later when the certificate it was using expired.

[Michael Wojcik]

Yeah, that's one example. There's a 2017 paper in which the researchers monitored BGP traffic for six months to look for partitioning and other attacks against Bitcoin specifically. Let's see what they said: "Each month sees at least 100,000 hijacks". That's averaging a couple every minute.

And that was seven years ago.

[jake]

To be fair, that's bitcoin. The payout for hijacking just the right sequence of bytes at just the right time can be astronomical ... and the odds in your favo(u)r are probably quite a bit better than mining the crap currency in the first place.

_{Remind me ... how many billions in crap currency have become lost, stolen or strayed in the last ten years? "Fixing" BGP won't change this trend.}

[David 132]

>Remind me ... how many billions in crap currency have become lost, stolen or strayed in the last ten years?

I'm certain you already know about this one Jake, but:

https://www.web3isgoinggreat.com

$75.054 Billion as I write this, and ticking ever upwards.

[The Vociferous Time Waster]

So, er...

1) It'll never happen. Changing BGP is up there with moving off of IPv4 as a lovely pipe dream.

2) BGP isn't meant to be secure. Everyone is responsible for their own house and needs to decide who they trust to peer with and then share their own routing policies with those peers and thoroughly understand the routing policies that they receive. You should be validating your peers using the methods already available and you should be creating a policy that only receives the routes you are prefixes to receive.

3) Trust is about trusting who you trust and also trusting who they trust. See point 2.

4) If you are peering with hostile nations networks then you should expect them to be hostile.

5) Because of the trust model BGP, as with the rest of the internet, is designed to be decentralised. Any attempts to 'fix' it will almost certainly put more of an emphasis on centralised control. We all know that this central control will be in the US.

[Claptrap314]

Re: So, er...

Like Panama & the IANA contract?

Sure, might start out that way. But we are actually quite good at ignoring blatant strategic advantage.

[JavaJester]

Re: So, er...

But trust requires authentication. At a minimum I need to know who originated a request to make an informed decision on its trustworthiness. Without knowing that, at best I can make educated guesses on the legitimacy of the request but still have no way of knowing who actually made it.

[rndSheeple]

The white house indicated?

well let us hold our breath? Pls focus on actual things and not political parties ambitions that they don't understand a thing about....

[Tron]

The tribalisation of the internet.

Your internet will only cross borders that your government permits it to.

Say goodbye to the global internet.

Anything good gets invented, politicians take control of it and ruin it, or just kill it.

[Anonymous Coward]

Re: The tribalisation of the internet.

"Anything good gets invented, politicians take control of it and ruin it...

That's why we can't have personal nuclear weapons.

[DoctorNine]

Re: The tribalisation of the internet.

Speak for yourself. All my nuclei are trained in the latest martial arts.

[benderama]

Am I oversimplifying by thinking of this as internet3 (or would it be 4 if i3 was the ipv6 roll out)?

[jake]

Yes.

[MONK_DUCK]

It really just comes down to legislation, once a few of the bigger counties or blocks demand it, it will start to shift. If India or EU makes it a requirement then the revenue hit will force many companies hand. It really just comes down to how much they care about it and the time frame. Wouldn't surprise me to see them start with the ISPs, move to critical national infrastructure next and onwards from the large to small caps.