Cloudflare has introduced a new tool to help improve BGP security which can hold ISPs accountable for their BGP safety measures.In a recent blog post, the cloud services provider said that Border Gateway Protocol (BGP) security issues such as leaks and hijacks have been accepted as an unavoidable part of the internet for far too long.The BGP protocol has been in use since the 1990s and it is the de-facto system used to route internet traffic between internet networks worldwide.
Since that time though, the system has seen the introduction of a number of new security measures including TLS, DNSSEC and projects like the Resource Public Key Infrastructure (RPKI) to make it less vulnerable to leaks and hijacking.Unfortunately though, BGP hijacking still occurs at the ISP level with Russia's state-owned telecoms provider Rostelecom and China Telecom being two of the biggest offenders.
For example, traffic intended for more than 200 of the world's largest content delivery networks (CDNs) and cloud hosting providers was recently redirected through Rostelecom.In an effort to hold ISPs accountable, Cloudflare has launched a new website called isBGPSafeYet which allows users to check whether or not their ISP is using RPKI which helps filter out invalid traffic routes.The site runs a test where it tries to fetch two pages (valid.rpki.cloudflare.com and invalid.rpki.cloudflare.com) to see an ISP has enabled RPKI.
If the test fails, Cloudflare's site allows users to tweet out the fact that their ISP isn't using RPKI in the hope that public pressure may lead to increased adoption of the public key infrastructure framework.While RPKI isn't perfect at preventing BGP hijacking, almost half of all networks employing the tool are less susceptible to route leaks, according to Cloudflare's tests.The company has also made the scripts used in its new website available on GitHub for others to use.Via ZDNet