Malicious BGP hijacks: Appearances can be deceiving

Pierre Antoine Vervier, Quentin Jacquemart, Johann Schlamp, Olivier Thonnard, Georg Carle, Guillaume Urvoy-Keller, Ernst Biersack, Marc Dacier

Research output: Chapter in Book/Report/Conference proceedingConference contribution

6 Citations (Scopus)

Abstract

BGP hijacking is a well known threat to the Internet routing infrastructure. There has been considerable interest in developing tools that detect prefix hijacking but such systems usually identify a large number of events, many of them being due to some benign BGP engineering practice or misconfiguration. Ramachandran et al. [1] and later Hu et al. [2] also correlated suspicious routing events with spam and claimed to have found evidence of spammers temporarily stealing prefixes to send spam. In an effort to study at large scale the existence and the prevalence of malicious BGP hijacks in the Internet we developed a system which (i) identifies hijacks using BGP, traceroute and IRR data and (ii) investigates traffic originating from the reported networks with spam and netflow data. In this paper we present a real case where suspicious BGP announcements coincided with spam and web scam traffic from corresponding networks. Through this case study we show that a correlation of suspicious routing events with malicious activities is insufficient to evidence harmful BGP hijacks. We thus question previously reported cases and conclude that identifying malicious BGP hijacks requires additional data sources as well as feedback from network owners in order to reach decisive conclusions.

Original languageEnglish
Title of host publication2014 IEEE International Conference on Communications, ICC 2014
PublisherIEEE Computer Society
Pages884-889
Number of pages6
ISBN (Print)9781479920037
DOIs
Publication statusPublished - 1 Jan 2014
Event2014 1st IEEE International Conference on Communications, ICC 2014 - Sydney, NSW, Australia
Duration: 10 Jun 201414 Jun 2014

Publication series

Name2014 IEEE International Conference on Communications, ICC 2014

Conference

Conference2014 1st IEEE International Conference on Communications, ICC 2014
CountryAustralia
CitySydney, NSW
Period10/6/1414/6/14

    Fingerprint

ASJC Scopus subject areas

  • Computer Networks and Communications

Cite this

Vervier, P. A., Jacquemart, Q., Schlamp, J., Thonnard, O., Carle, G., Urvoy-Keller, G., Biersack, E., & Dacier, M. (2014). Malicious BGP hijacks: Appearances can be deceiving. In 2014 IEEE International Conference on Communications, ICC 2014 (pp. 884-889). [6883431] (2014 IEEE International Conference on Communications, ICC 2014). IEEE Computer Society. https://doi.org/10.1109/ICC.2014.6883431