BGP is not your BFF

Security researchers have determined that flaws in the Border Gateway Protocol (BGP) can allow your Internet traffic to be intercepted, read, changed, and then forwarded on to the intended recipient, all without your knowledge. Ruh roh, Reorge.

After the recent media coverage of the problems with the DNS protocol, people started to wonder how this sort of thing could happen. It's pretty simple. Back when these protocols were first designed, only a handful of computer geeks affiliated with specific universities, the military, and the US government used this newly-created network, and they all trusted each other. So, they constructed trust protocols to send their datagrams and packets over ARPANET, the fair-haired child that would someday grow up and become the Internet we know today.

What made sense (trust) back in the 60s and 70s doesn't make sense today, and trusted protocols (like DNS, BGP, and others) have outlived their usefulness. Make no mistake - the BGP hole is not new. It's been known for more than ten years. But development of a replacement protocol has been painfully slow.

Work on S-BGP (Secure BGP) is in proof of concept mode, and it looks promising, but it adds a lot of overhead to existing routers as they process, validate, and authenticate the additional digital certificates that are needed to ensure trust and security. This could cause bottlenecks and slow down Internet traffic significantly.

Cisco is experimenting with their own flavor, soBGP, and there are a couple of other solutions kicking around, but until the world can agree on a protocol, nothing can be fixed. Expect this hole to be around for awhile, or at least until there's a massive compromise that focuses everyone's attention on the problem at hand.