Prefix Hijacking. Prefix hijacking (also known as IP hijacking [IPhij]) involves the illegitimate takeover of certain IP addresses via false Border Gateway Protocol (BGP) announcements to the global routing table. The Internet is based on the BGP routing protocol, which allows any organisation with an Autonomous System Number (ASN) to announce their IP prefixes to the Internet. IP prefixes are an aggregate announcement of all IP addresses that belong to an organisation. Typical IP address prefixes might be a /24 (255 IP addresses) or a /16 (65025 IP addresses). There are many other prefix lengths. Prefix announcements are via BGP to an upstream ASN – typically an Internet Service Provider (ISP) or NREN. These announcements are based primarily on trust but each peer is supposed to do sanity checking to determine whether the announcing ASN is allowed to announce a specific prefix. ISPs will check the RIPE whois database [RIPE] and build appropriate access list filters so that only valid IP prefixes can be delivered from a peer. However, not all ISPs do this sanity checking and therefore, either by mistake or on purpose, a wrong prefix can be announced. Typically, IP hijacking involves malicious attempts to announce prefixes to the global Internet and thereby divert incoming traffic to that IP range. This can then be leveraged into a ―man in the middle" attack, where the captured data could be either be merely copied locally, or even manipulated and sent onward to the intended target. A protocol rule of BGP is that a more specific prefix will take precedence over a more general prefix. Therefore, if an NREN announces a prefix of 100.1.0.0/22 (IP range of 100.1.0.0-100.1.3.255) a malicious announcement of 100.1.1.0/24 (IP range of 100.1.1.0-100.1.1.255) would usurp the previous announcement and all data destined to 000.0.0.0/00 would flow to the wrong destination on the Internet. There are no known methods for protecting against this type of attack, only reactive email alerts can be sent. The NREN would then have to contact the ASN that is not doing proper filtering and ask them to correct the situation. This typically takes a number of hours.
