Router holes 'threaten the internet'

The border gateway protocol, a widely used technology for efficiently routing data through the internet, is rife with security holes and needs to be replaced, a security consultant has warned.

However, a technological chicken-and-egg problem has stymied the development of a secure replacement for BGP, said Stephen Dugan, speaking at the Black Hat Security Briefings In Seattle late last week. There'll only be an improvement if the majority of routers use a secure protocol - but the high cost of implementing Secure BGP means that few companies will adopt it.

"The people who are writing the (internet engineering) drafts are running out of financing because people aren't listening," Dugan said. "We need to develop the technology before someone attacks the system. But until there is an attack, companies might not be willing to spend the money."

Some 12,000 routers that act as the gateway to approximately 130,000 networks are currently using BGP. A router running BGP can communicate with its neighbours, essentially telling them to which networks the router can efficiently send data.

However, a misconfigured router, or one that has been compromised by an online intruder, can cause chaos by advertising itself as the best path to an unrelated network. That's because routers using BGP implicitly trust their neighbors on the internet - they don't ask for any sort of digital identification. Using such digital forgery could allow an attacker to redirect traffic, to wiretap data, to create an information "black hole" and even to masquerade as another server, Dugan said.

"Anyone at an internet service provider could do this," he said. "We have to stop trusting routers."

The security problems are not theoretical.

In April 1997, a small Virginia internet service provider misconfigured its router, leading it to advertise that it was the best route to the entire internet. The ensuing avalanche of data took down the router and disrupted major segments of the net, causing an outage that in some places lasted as long as two hours.

Even the US government has focused on the weakness in the internet's routers. Along with the domain name system (DNS), the Bush Administration recently pointed to BGP as critical technology that needs to be secured.

"The security and continued functioning of the internet will be greatly influenced by the success or failure of implementing more secure and more robust BGP and DNS," the government stated in its latest National Strategy to Secure Cyberspace policy statement. "The nation has a vital interest in ensuring that this work proceeds."

Despite the danger, the work is going slow.

The Internet Engineering Task Force (IETF), the group that sets the technical standards for the internet, has worked to formulate a specification for Secure BGP. However, network hardware makers have been slow to sign off on the new technology because implementation would include a costly digital signature infrastructure and hardware upgrades.

Dugan readily admits that the costs could be high, and that those costs would make the internet more expensive to use.

"It will raise up the cost of getting an address," he said. "But it's work that has to be done."