Skip to main content

SICO: Surgical Interception Attacks by Manipulating BGP Communities

Author(s): Birge-Lee, Henry; Wang, Liang; Rexford, Jennifer; Mittal, Prateek

To refer to this page use:
Abstract: The Border Gateway Protocol (BGP) is the primary routing protocol for the Internet backbone, yet it lacks adequate security mechanisms. While simple BGP hijack attacks only involve an adversary hijacking Internet traffic destined to a victim, more complex and challenging interception attacks require that adversary intercept a victim's traffic and forward it on to the victim. If an interception attack is launched incorrectly, the adversary's attack will disrupt its route to the victim making it impossible to forward packets. To overcome these challenges, we introduce SICO attacks (Surgical Interception using COmmunities): a novel method of launching interception attacks that leverages BGP communities to scope an adversary's attack and ensure a route to the victim. We then show how SICO attacks can be targeted to specific source IP addresses for reducing attack costs. Furthermore, we ethically perform SICO attacks on the real Internet backbone to evaluate their feasibility and effectiveness. Results suggest that SICO attacks can achieve interception even when previously proposed attacks would not be feasible and outperforms them by attracting traffic from an additional 16% of Internet hosts (worst case) and 58% of Internet hosts (best case). Finally, we analyze the Internet topology to find that at least 83% of multi-homed ASes are capable of launching these attacks.
Publication Date: 2019
Citation: Birge-Lee, Henry, Liang Wang, Jennifer Rexford, and Prateek Mittal. "SICO: Surgical Interception Attacks by Manipulating BGP Communities." In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (2019): pp. 431-448. doi:10.1145/3319535.3363197
DOI: 10.1145/3319535.3363197
Pages: 431 - 448
Type of Material: Conference Article
Journal/Proceeding Title: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security
Version: Final published version. This is an open access article.

Items in OAR@Princeton are protected by copyright, with all rights reserved, unless otherwise indicated.