RouteHijacking

Route hijacking refers to a class of internet routing incidents in which an attacker or misconfigured network announces IP prefixes that it does not own, or otherwise manipulates routing advertisements, to misdirect traffic. It exploits the trust model of the Border Gateway Protocol (BGP), the protocol that interconnects autonomous systems on the Internet. By announcing a prefix—often a more specific one or a forged origin—the attacker can attract traffic that should be delivered elsewhere, enabling interception, modification, or disruption of communications.

Common forms include prefix hijacking (advertising a prefix not actually allocated to the announcing AS), sub-prefix hijacking (advertising a more specific subset of a prefix), and route leaks (re-announcing routes in ways that alter AS paths). Causes range from deliberate malicious activity to inadvertent misconfigurations, often due to insufficient origin validation and lax filtering.

Impacts can include loss of confidentiality through traffic interception, integrity risks if traffic is altered, increased latency, or total service outages. The attack can go undetected for hours or days because plain BGP lacks built-in authentication and robust validation.

Defenses focus on validation and filtering: RPKI with ROA-based origin validation, BGPsec, and prefix filtering at customer and provider edges; real-time route monitoring and anomaly detection; and mutual coordination among providers to revoke faulty announcements quickly. Incident response typically involves withdrawing the illegitimate advertisement, notifying affected networks, and applying stricter filtering and validation.

Notable incidents have occurred when large providers or content networks were briefly unreachable due to hijacked routes. These events illustrate the importance of route validation, rapid detection, and coordinated defense in internet routing.