COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-584

BGP Route Disabling

An adversary suppresses the Border Gateway Protocol (BGP) advertisement for a route so as to render the underlying network inaccessible. The BGP protocol helps traffic move throughout the Internet by selecting the most efficient route between Autonomous Systems (AS), or routing domains. BGP is the basis for interdomain routing infrastructure, providing connections between these ASs. By suppressing the intended AS routing advertisements and/or forcing less effective routes for traffic to ASs, the adversary can deny availability for the target network.

Abstraction

Detailed

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

An adversary suppresses the Border Gateway Protocol (BGP) advertisement for a route so as to render the underlying network inaccessible. The BGP protocol helps traffic move throughout the Internet by selecting the most efficient route between Autonomous Systems (AS), or routing domains. BGP is the basis for interdomain routing infrastructure, providing connections between these ASs. By suppressing the intended AS routing advertisements and/or forcing less effective routes for traffic to ASs, the adversary can deny availability for the target network.

Requirements

What does the attack require?

Prerequisites

  • The adversary must have control of a router that can modify, drop, or introduce spoofed BGP updates.The adversary can convince

Skills required

Not stated in the MITRE record.

Resources required

  • BGP Router

Impact

What does a successful attack lead to?

Other

Affected scopes: Availability

Defence

How is it prevented and mitigated?

1
Implement Ingress filters to check the validity of received routes. However, this relies on the accuracy of Internet Routing Registries (IRRs) databases which are often not well-maintained.
2
Implement Secure BGP (S-BGP protocol), which improves authorization and authentication capabilities based on public-key cryptography.

Real world

MITRE example instances

Example instance 1Detail
Blackholing: The adversary intentionally references false routing advertisements in order to attract traffic to a particular router so it can be dropped.
CAPEC-584: BGP Route Disabling — DayBreach Saldırı Sözlüğü · DayBreach