BGP hijacking attacks target payment systems

Researchers discovered BGP hijacking attacks targeting payment-processing systems and using new tricks to maximize the attackers' hold on DNS servers.

Doug Madory, director of internet analysis at Oracle Dyn, previously saw Border Gateway Protocol (BGP) hijacking attacks in April 2018, and he said has seen them continue through July. The first attack targeted an Amazon domain name system (DNS) server in order to lure victims to a malicious site and steal cryptocurrency, but more recent attacks targeted a wider range of U.S. payment services.

"As in the Amazon case, these more recent BGP hijacks enabled imposter DNS servers to return forged DNS responses, misdirecting unsuspecting users to malicious sites. By using long TTL [time-to-live] values in the forged responses, recursive DNS servers held these bogus DNS entries in their caches long after the BGP hijack had disappeared -- maximizing the duration of the attack," Madory wrote in a blog post. "The normal TTL for the targeted domains was 10 minutes (600 seconds). By configuring a very long TTL, the forged record could persist in the DNS caching layer for an extended period of time, long after the BGP hijack had stopped."

Madory detailed attacks on telecom companies in Indonesia and Malaysia, as well as BGP hijacking attacks on U.S. credit card and payment-processing services -- the latter of which lasted anywhere from a few minutes to almost three hours. While the payment service attacks featured similar techniques to the Amazon DNS server attack, it's unclear if the same threat actors are behind them.

Justin Jett, director of audit and compliance for Plixer, based in Kennebunk, Maine, said BGP hijacking attacks are "extremely dangerous, because they don't require the attacker to break into the machines of those they want to steal from."

"Instead, they poison the DNS cache at the resolver level, which can then be used to deceive the users. When a DNS resolver's cache is poisoned with invalid information, it can take a long time post-attacked to clear the problem. This is because of how DNS TTL works," Jett wrote via email. "As Oracle Dyn mentioned, the TTL of the forged response was set to about five days. This means that once the response has been cached, it will take about five days before it will even check for the updated record and, therefore, is how long the problem will remain, even once the BGP hijack has been resolved."

Madory said he was not optimistic about what these BGP hijacking attacks might portend because of how fundamental BGP is to the structure of the internet.

"If previous hijacks were shots across the bow, these incidents show the internet infrastructure is now taking direct hits," Madory wrote. "Unfortunately, there is no reason not to expect to see more of these types of attacks against the internet."

Matt Chiodi, vice president of cloud security at RedLock, based in Menlo Park, Calif., was equally as worried and said that these BGP hijacking attacks should be taken as a warning.

"BGP and DNS are the silent warriors of the internet, and these attacks are extremely serious because nearly all other internet services assume they are secure. Billions of users rely on these mostly invisible services to accomplish everything from Facebook to banking," Chiodi wrote via email. "Unfortunately, mitigating BGP and DNS-based attacks is extremely difficult given the trust-based nature of both systems."