Routing Security in Latin America and the Caribbean Table of Contents Acknowledgments 3 Introduction 4 What is at Stake? 5 Types of incidents 8 Route Hijacking (BGP Hijacking) 9 Route Leaks (BGP Leaks) 10 Incidents Timeline 12 Event Analysis 15 Methodology 15 Numbers around the World 16 Numbers in the Region 27 Events by Country 28 Rankings in Latin America 35 Mitigation Strategies 36 Initiatives 38 FORT Project 39 Conclusion 40 Annexes 41 Number of Incidents by Month around the World 41 2017 Statistics 42 2018 Statistics 46 2 Acknowledgments Author: Augusto Luciano Mathurin Supervisors: Carolina Caeiro Guillermo Cicileo Reviewers: Carlos Martinez-Cagnazzo Raúl Ramirez Castañeda Style Editor: María Eugenia Martínez Graphic Designer: Martin Mañana English Translator: Justina Díaz Cornejo Collaborators: Andrei RoBachevsky Gerardo Pias Mariela Rocha 3 Introduction Routing is one of the few components of Internet infrastructure that is still insecure. Nowadays, it is easy to hijack routing systems to Block weBsites, spy on users and redirect traffic to false destinations. These vulneraBilities may affect the free flow of information around the world and pose a threat to the security and privacy of users. Internet standardization Bodies have Been struggling for a long time to identify strategies that make routing more secure. The purpose of this three-part report is to help us address and understand this issue both globally and in our region. ● Firstly, as an introduction, this report explains that the Internet can Be the target of various attacks of very diverse technical characteristics, and then moves on to routing infrastructure attacks that Become incidents: hijacks and leaks in the BGP protocol. ● It then provides an exhaustive analysis of incident data collected in 2017, 2018 and part of 2019. This is to understand —on the Basis of statistics that can Be studied By country— how routing security has evolved in the last few years. Statistics help us get a grasp of how our region compares to the rest of the world and actually show how these incidents may affect Internet freedom. ● Lastly, it outlines the various measures that network operators can adopt to enhance the Internet routing system. Mainly, the implementation of a puBlic key infrastructure for resource certification (RPKI), which has Been the most successful initiative in securing BGP routing. This report is part of a RPKI deployment campaign in Latin America and the CariBBean, promoted By the FORT project, a joint initiative of LACNIC and NIC.MX, which seeks to improve routing system security and resilience. 4 What is at Stake? Tip! This section aims at introducing technical concepts and topics that provide the report with context. If you are knowledgeable about network operation, you can skip this part and go straight to the “Incidents Timeline” section. Cyber-attacks are not new. They Began as a few incidents that made amazing news headlines, But they are now part of the daily news: the week's Blocking, data Breach, malware or attack. Some governments seek to prevent their citizens from communicating freely through the Internet,1 for cultural and historical reasons, to avoid organized demonstrations or incidents, to hide uncomfortaBle truths or simply to keep the upper hand on the population in the name of security and social wellBeing. Criminal associations engage in online massive scams and even some organizations try to saBotage their competition. But, how can there Be attacks on the Internet? To answer this question, we first need to think what the oBjective of the attacker is or, in other words, which quality of the information they want to affect. It is possible to attack the confidentiality (which translates into espionage attacks), the availaBility (which results in censorship) or the integrity (which devolves into fraud) of information. Once the objective has been set (what to attack), the strategy is planned (how to attack) and, as is often the case, it is possiBle to reach the same destination (to accomplish the oBjective) through different paths. Internet architecture is complex, and different attacks can Be carried out at several different levels or layers and they evolve with time. At the same time, the security measures to mitigate them are Being perfected. As regards censorship, which is the most common goals, there are different types of technical strategies to carry it out.2 The most famous are: ● Blocking the access to certain IP addresses. For instance, an ISP can prevent its clients from accessing a certain site, discarding all of the requests whose destination is the IP address that corresponds to the servers where the Blocked portal is hosted. This technique can also Be used from the other end; i.e., a server that rejects the requests coming from an IP set. For example, the ones that Belong to a certain country. ● DNS filtering. Generally, ISPs offer their own DNS resolver server; i.e., the service that translates URLs or domains (like www.lacninc.net) into an IP address (in this case, 200.3.14.184). It is possible to block domains that belong to the sites an attacker wants to censor. This way, clients 1<https://www.maketecheasier.com/internet-censorship-block-citizens-from-weBsites/> 2<http://www.unesco.org/new/en/communication-and-information/resources/puBlications-and-communication- materials/puBlications/full-list/freedom-of-connection-freedom-of-expression-the-changing-legal-and-regulatory-ecology-shaping-the- internet/> 5 are not able to reach their intended destination. This technique can Be easily avoided By changing the device’s DNS resolver server, although nowadays most of DNS queries are not made using encryption. This means that providers can also set filters even when queries are not sent to their DNS servers. ● URL filtering. When clients connect to the Internet through a proxy server, it is possiBle to filter the addresses or URLs of weBsites that contain certain words. ● The “kill switch” solution is also possiBle. This means turning routers off using software (through malware) or physically unplugging them. This way, it is possiBle to deprive a population of Internet access or to take down a server. ● Content removal. Sometimes, it is not necessary to censor an entire web portal, but just to somehow force it to stop showing certain content. This technique is the most commonly used when resolving some legal disputes, such as copyright infringement. ● Denial-of-service attacks. Another way to shut down a server is to saturate it By redirecting an irrational amount of garBage traffic to it. This list is not exhaustive. It simply aims at providing a notion of the range of potential or existing attacks. This report focuses on the attacks that happen in another part of the Internet infrastructure: the routing layer. Akin to a road network, the Internet has its own highways and crossroads, which are caBles and routers. When driving, we use a GPS, a driver-assistance system to know how to get from point A to point B, driving on all the necessary routes and making the necessary stops. Similarly, the Internet uses its own navigation system, called BGP (Border Gateway Protocol), which makes it possiBle for data traffic in the network to reach its destination. Just like most of Internet protocols, the BGP was created toward the end of 1980s, in a scenario that was very different from the current one. At the time, only a small numBer of networks needed to Be connected. Back then, security was not a core principle to have in mind, so the protocol was strongly based on a trust game between the parties. Things are different today. With over 92,0003 registered autonomous systems that are part of this Internet navigation system, it can no longer Be assumed that all of its participants are trustworthy. Certain actors may even Be rivals, like two competing ISPs that offer their services to the same population. How is this scenario harmful to Internet users? Back to the road network analogy, if caBles are the roadways, then the BGP would Be the road sign system; i.e., all the signs that indicate which roads to take in order to get to the desired destination. The proBlem with —and, at the same time, the advantage of— the Internet is that there is no central Body to manage it, so it is impossible to control who places the signs on this road network or whether their indications are authentic. This is the so-called BGP trust game, and it can Be used to carry out attacks, censor, and spy on users. When we visit a weBsite, Both endpoints (our device and the server hosting the portal) have an IP address that allows their identification. Thus, data packets have a source and a destination, But what happens on the way? 3 <https://www-public.imtBs-tsp.eu/~maigron/RIR_Stats/RIR_Delegations/World/ASN-ByNB.html> 6 In the postal system, letters are not sent straight to their destination, but to intermediaries, the post offices.4 When using this system, the letter goes to a local post office and may go through several intermediary post offices until it arrives at the city where it will reach its final address. On the Internet, when data packets are sent from our device to the desired endpoint, these are first sent to the “post offices”, i.e., the autonomous systems. An autonomous system is a network or a network set managed By an organization and has a common routing policy. Generally, autonomous systems are ISPs or organizations that connect multiple ISPs. Just like devices connected to the Internet are identified with an IP address, autonomous systems are identified with a 16- or 32-bit number, called ASN (Autonomous System NumBer).