February 28, 2003 11:01 AM PST
Expert: Router holes threaten Net
However, a technological chicken-and-egg problem has stymied the development of a secure replacement for BGP, said Stephen Dugan, speaking at the Black Hat Security Briefings here on Thursday. There'll only be an improvement if the majority of routers use a secure protocol--but the high cost of implementing Secure BGP means that few companies will adopt it.
"The people who are writing the (Internet engineering) drafts are running out of financing because people aren't listening," Dugan said. "We need to develop the technology before someone attacks the system. But until there is an attack, companies might not be willing to spend the money."
Some 12,000 routers that act as the gateway to approximately 130,000 networks are currently using BGP. A router running BGP can communicate with its neighbors, essentially telling them to which networks the router can efficiently send data.
However, a misconfigured router, or one that has been compromised by an online intruder, can cause chaos by advertising itself as the best path to an unrelated network. That's because routers using BGP implicitly trust their neighbors on the Internet--they don't ask for any sort of digital identification. Using such digital forgery could allow an attacker to redirect traffic, to wiretap data, to create an information "black hole" and even to masquerade as another server, Dugan said.
"Anyone at an Internet service provider could do this," he said. "We have to stop trusting routers."
The security problems are not theoretical.
Routers and security
CNET White Papers
Even the U.S. government has focused on the weakness in the Internet's routers. Along with the domain name system (DNS), the Bush Administration recently pointed to BGP as critical technology that needs to be secured.
"The security and continued functioning of the Internet will be greatly influenced by the success or failure of implementing more secure and more robust BGP and DNS," the government stated in its latest National Strategy to Secure Cyberspace policy statement. "The nation has a vital interest in ensuring that this work proceeds."
Despite the danger, the work is going slow.
The Internet Engineering Task Force (IETF), the group that sets the technical standards for the Internet, has worked to formulate a specification for Secure BGP. However, network-hardware makers have been slow to sign off on the new technology because implementation would include a costly digital signature infrastructure and hardware upgrades.
Dugan readily admits that the costs could be high, and that those costs would make the Internet more expensive to use.
"It will raise up the cost of getting an address," he said. "But it's work that has to be done."