The internet took the wrong turn BGP hijacking and route leaks

The internet's word-of-mouth directions

The internet isn't one network. It's tens of thousands of separate networks — internet service providers, cloud platforms, universities, banks, large enterprises — stitched together. Each of these networks, known technically as an “autonomous system,” controls blocks of IP addresses, the numeric street addresses of the online world.

BGP is how these networks tell each other who lives where. Every network constantly makes announcements to its neighbours: “I can deliver traffic to these addresses,” or “I know a path to the network that can.” Neighbours pass those announcements along to their neighbours, and out of this global game of word-of-mouth, every router builds its map of the internet. When you load a website, your data hops from network to network, each one following the directions it has heard.

Here's the remarkable part: BGP was designed in 1989, famously sketched out across three napkins at an engineering conference. It was built for a small, collegial internet where network operators knew each other by name. So it was built on a simple assumption: everyone tells the truth.

A handshake protocol in a hostile world

BGP has no built-in way to verify that an announcement is genuine. Any network can, in principle, claim to be the home of any address on the internet, and its neighbours will generally accept the claim and spread the word.

Two quirks of the protocol make this worse. First, routers prefer specific directions over general ones: a claim covering a smaller, more precise block of addresses beats a broader claim covering a larger one, the way “deliver to Unit 3” overrides “deliver somewhere on this street.” Second, announcements ripple outward automatically. A false claim doesn't stay local; it can circle the globe in minutes.

When the false claim is deliberate, we call it a hijack. When it's an accident, we call it a route leak. Both can be devastating, and your firewall can't see either one coming.

Hijacking: stealing traffic with a lie

A BGP hijack is exactly what it sounds like: a network announces addresses it doesn't own, and the internet obediently redirects traffic meant for the real owner.

Sometimes the goal is disruption. Sometimes it's theft. In April 2018, attackers hijacked the IP addresses of Amazon's Route 53 — a service that acts as part of the internet's phone book — by making fraudulent, highly specific announcements through a compromised provider. For about two hours, some users trying to reach the cryptocurrency site MyEtherWallet were quietly steered to a convincing fake. Anyone who logged in handed over their credentials, and roughly US$150,000 in cryptocurrency walked out the door. The victims typed the correct address. Their browsers did nothing wrong. The road itself had been redrawn.

The most unsettling variant is interception. A sophisticated attacker doesn't have to take your traffic offline: they can reroute it through equipment they control, read or copy it, then pass it along to the real destination. Everything still works. Pages load, emails send, perhaps a few milliseconds slower than usual. Security researchers have repeatedly observed traffic for banks, governments and technology companies taking bizarre, unexplained detours through distant networks, consistent with this kind of surveillance.

Route leaks: no villain required

Now for the uncomfortable twist: you don't need an attacker at all. Most routing disasters are caused by honest mistakes.

A route leak happens when a network passes on routing information it was never supposed to share, or announces more than it should. Picture a small suburban street putting up a sign claiming to be the fastest route between two capital cities. The sign is wrong, but if the traffic authorities believe it, half the country's trucks attempt the detour, and the street is crushed instantly.

That's almost exactly what happened in June 2019. A small ISP in Pennsylvania was running a “route optimiser,” a tool that generates very specific routing entries. Those entries leaked out through a customer's network to Verizon, one of the largest carriers in the United States, which broadcast them to the world without adequate filtering. Suddenly a huge share of traffic for Cloudflare, and by extension a significant slice of the internet's websites and services, tried to squeeze through a network never built to carry it. Major services degraded or dropped offline for hours. Nobody attacked anyone. Three separate networks simply failed to double-check what they were passing along.

Even the giants aren't immune to routing's gravity. In 2021, Facebook accidentally withdrew its own BGP announcements during routine maintenance and erased itself from the internet's map for six hours, reportedly locking its own engineers out of the systems needed to fix it.

RPKI: giving the internet a land registry

The good news is that the industry isn't standing still. The main fix is called RPKI — Resource Public Key Infrastructure — and the easiest way to think of it is as a land title registry for internet addresses.

Under RPKI, the legitimate holder of a block of addresses publishes a cryptographically signed record stating which network is authorised to announce those addresses. Other networks can then check announcements against the registry and drop the ones that don't match. If this validation had been widespread in 2008, Pakistan Telecom's claim to be YouTube would have been rejected on the spot.

Adoption has genuinely accelerated. More than half of the internet's routes are now covered by these signed records, and major carriers and cloud providers actively discard invalid announcements. That's real progress from a decade ago, when RPKI was little more than an academic project.

But it's a seatbelt, not a force field. RPKI verifies only the origin of an announcement — who's allowed to make the claim — not the entire path traffic will take, and a determined attacker can still forge announcements that appear to come from the right place. More importantly, enforcement is uneven: plenty of networks still don't check, so a bogus route can spread through the gaps. Stronger protections that validate the full path are being developed, but they're years from broad deployment.

Why your perfect security can't save you

Here's the part that matters most for business leaders. You can patch every server, enforce multi-factor authentication everywhere, run a zero-trust architecture and pass every audit with flying colours, and none of it touches this problem. Routing happens outside your walls, on infrastructure you don't own, operated by people you've never met.

Think of it this way: you can build the strongest bank vault in the world, but if someone changes the road signs so your customers drive to a counterfeit branch across town, your vault is irrelevant.

An upstream routing failure can take your website and services offline, silently divert your customers toward phishing replicas of your login page, or knock out the third parties you depend on — your DNS provider, your payment gateway, your cloud platform — without any of those companies being breached either. Your organisation's addresses can be hijacked without a single hostile packet ever crossing your firewall, because the attack happens to traffic while it's still on its way to you.

What you can actually do about it

No single business can fix BGP. But you're far from helpless, and most of the meaningful steps cost surprisingly little.

Start by asking pointed questions of your internet and hosting providers: do they publish signed RPKI records for their addresses, do they validate routes and drop invalid ones, and do they filter what their customers announce? Providers who take routing security seriously will have crisp answers; those who don't will reveal themselves quickly. If your organisation holds its own IP address space — allocated through APNIC here in the Asia-Pacific — publishing your own signed records is one of the cheapest, fastest security wins available.

Next, monitor. Specialist services watch the global routing system and can alert you within minutes if someone, anywhere, starts announcing your addresses. Without monitoring, you'll find out from angry customers instead.

Finally, design for the assumption that the roads will occasionally fail. Enforce strong encryption everywhere so that intercepted traffic is unreadable gibberish, build redundancy across providers, and make sure your incident response plan includes scenarios that begin outside your own network entirely.

The road ahead

The internet works because tens of thousands of independent networks cooperate using a protocol sketched on napkins for a friendlier era. Most days, that cooperation is a quiet miracle. Occasionally, the whole system takes a wrong turn — and when it does, it doesn't check whether you were doing everything right.

Genuine resilience means securing your perimeter and understanding the dependencies that live beyond it. If you'd like to know how exposed your organisation is to failures upstream — and how to prepare for them — the team at Xiph Cyber can help you map the risks and build a plan.