Understanding the Stealthy BGP Hijacking Risk in the ROV Era

Understanding the Stealthy BGP Hijacking Risk in the ROV Era

Speakers: Yihao Chen

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=IGOlXoQ6A74

Overview

This research reveals a concerning side effect of partial RPKI/ROV (Route Origin Validation) deployment: stealthy BGP hijacking. While ROV effectively prevents direct hijacking at deployed ASes, it creates inconsistent routing views across the internet -- a protected AS may forward traffic through an unprotected neighbor that silently diverts it to a hijacker. Because the hijack is invisible in the control plane of the ROV-deploying AS, these attacks evade both monitoring systems and post-incident analysis.

The researchers detected approximately 1,300 potential stealthy hijacking events in the first two months of 2025 (roughly 18-29 per day, with up to 5 new cases daily), affecting 150 prefixes across 73 origin ASes in 31 countries. Large-scale BGP simulation reveals a 14.1% success probability for stealthy sub-prefix hijacking under current ROV deployment levels (~7,000 ASes). Critically, this risk was essentially zero before ROV deployment and will only decrease once ROV adoption reaches approximately 40% of ASes -- making this a transitional risk that the internet must navigate.

Background

▶ Watch: BGP hijacking basics and RPKI/ROV introduction (0:00)

BGP (Border Gateway Protocol) is the routing protocol that keeps the global internet connected, enabling autonomous systems to establish interdomain routes. BGP provides no native origin authentication for route announcements, enabling BGP hijacking -- where an attacker announces prefixes they do not own, diverting traffic from the legitimate origin.

RPKI (Resource Public Key Infrastructure) was introduced approximately 10 years ago to address this. It uses cryptographically signed certificates called ROAs (Route Origin Authorizations) that map IP prefixes to their authorized origin AS numbers. When an AS deploys ROV, it downloads all ROA certificates and validates received BGP announcements, rejecting those that do not match authorized origins.

While ROA coverage has grown to over half of IP prefixes, actual ROV filtering deployment remains at only about 20-30% of ASes. This partial deployment creates the conditions for stealthy hijacking: a ROV-deploying AS correctly filters invalid routes, but its traffic may traverse unprotected intermediate ASes that accept the hijacker's route and silently divert traffic.

The researchers emphasize this is not a flaw in ROV itself, but rather a side effect of its partial deployment -- a transitional risk that emerges during the rollout period.

Key Findings

▶ Watch: How partial deployment makes hijacking invisible to protected ASes (4:00)

Stealthy hijacking occurs almost daily in the wild. In the first two months of 2025, approximately 1,300 potential stealthy hijacking events were observed, corresponding to 18-29 events per day with up to 5 newly emerging cases daily. After deduplication, 100 unique incidents were identified.

Most incidents are short-lived but some persist. Approximately 17% last less than a week, while 13% persist for more than 30 days -- the long-lasting cases likely represent unintended misconfigurations rather than active attacks.

Sub-prefix hijacking dominates. Around 90 incidents involved sub-prefix hijacking, which is typically associated with more severe impact because it targets more specific routes that take priority in BGP best-path selection.

Detection depends heavily on vantage point selection. Most incidents are visible from three or fewer vantage points, and over 40% are observable from even fewer. Removing just 20 vantage points significantly reduced observation counts, highlighting the difficulty of comprehensive monitoring.

14.1% success probability for stealthy sub-prefix hijacking under current deployment. Large-scale simulation with ~7,000 ROV-enabled ASes shows a 14.1% probability for sub-prefix hijacking and 2% for exact-prefix hijacking. Without ROV, these stealthy hijacking probabilities are essentially zero (though direct hijacking probabilities are much higher).

The risk follows an inverted-U curve. Starting from 700 ROV-deploying ASes in October 2023 (10% risk), the risk increased to 14% as deployment grew to 7,000 ASes. However, simulation shows that a 10% increase in deployment reduces risk to 10%, and at approximately 40% ROV deployment, the risk approaches zero.

Technical Deep Dive

▶ Watch: 1,300 stealthy hijacking events observed in 2 months (8:00)

The stealthy hijacking mechanism works as follows: Consider ASes A, B (ROV-deploying), and C, D, F (non-ROV) in a topology where hijacker ASG attacks a prefix originated by AST. ASes B and D deploy ROV and correctly filter the hijacker's announcement. However, ASC and F, which do not deploy ROV, accept the hijacker's route.

From ASA's perspective (which deploys ROV and peers with B), the hijack is invisible in the control plane because ASB filtered it. ASA expects its traffic to follow the legitimate path through B. However, if the legitimate path traverses an intermediate AS that does not deploy ROV and has accepted the hijacker's route, traffic is silently diverted. This is the "stealthy" property: the hijack succeeds without any visible indication in the control plane of ROV-deploying ASes.

Detection methodology: The researchers compare routing tables from multiple vantage points using data from RouteViews and RIPE RIS, validating prefix origins against RPKI ROAs and WHOIS data. CAIDA and AS relationship datasets capture behavioral patterns. Inconsistencies between vantage points reveal cases where some see legitimate routes while others see hijacked routes.

Simulation methodology: The researchers construct an internet topology from CAIDA AS relationship data and combine multiple ROV measurement sources for deployment status. An efficient matrix-based GPU-accelerated BGP simulator generates complete routing tables across all AS pairs, enabling analysis of all possible victim-hijacker triples for stealthy hijacking vulnerability.

The real-world validation includes verification through looking glass servers, which confirmed that observed stealthy hijacking incidents resulted in actual traffic diversion.

Demo / Proof of Concept

▶ Watch: GPU-accelerated BGP simulation: 14.1% success probability (10:00)

The researchers have launched a public website that publishes daily incident reports of stealthy BGP hijacking, providing ongoing monitoring for the community. They also documented 22 incidents directly observed from their own vantage points, providing the highest confidence validation through firsthand visibility.

Real cases were verified through looking glass servers, confirming that the control-plane inconsistencies translated to actual data-plane traffic diversion.

Defensive Implications

▶ Watch: Operational recommendations and ROV++ discussion (14:00)

ROV deployment should accelerate, not slow down. The paper explicitly does not discourage ROV deployment. The stealthy hijacking risk follows an inverted-U curve that peaks during partial deployment and approaches zero at approximately 40% AS-level ROV adoption. Slowing deployment would prolong the risk period.

Operators should monitor filtered routes. Discarded ROV-invalid announcements can signal abnormal activity, including potential stealthy hijacking affecting neighbors. Operators who simply drop invalid routes without logging or alerting miss valuable intelligence.

Route collectors provide essential visibility. RouteViews and RIPE RIS data are critical for detecting stealthy hijacking, but coverage gaps mean many incidents go unobserved. The community would benefit from additional vantage points and more systematic monitoring.

Consider ROV++ and risk-aware routing. Supplemental defenses beyond basic ROV (such as ROV++ or risk-aware routing strategies) can mitigate the transitional risk during partial deployment. Currently, ROV operates at the BGP routing layer where routers simply drop invalid routes without higher-level awareness of the implications.

All Tier 1 ASes now deploy ROV, which is encouraging, but the 20-30% overall deployment rate is insufficient to eliminate stealthy hijacking. The research provides a concrete target: 40% deployment as the threshold where the risk substantially diminishes.

Key Takeaways

• Partial ROV deployment creates a new class of stealthy BGP hijacking that is invisible in the control plane of protected ASes
• Approximately 1,300 stealthy hijacking events were observed in 2 months of 2025, with up to 5 new cases emerging daily
• Current ROV deployment (~7,000 ASes) yields a 14.1% success probability for stealthy sub-prefix hijacking
• This risk was essentially zero before ROV deployment and will approach zero again at ~40% AS-level ROV adoption
• Most incidents are visible from 3 or fewer vantage points, making comprehensive detection dependent on diverse observation infrastructure
• 90 out of 100 unique incidents involved sub-prefix hijacking, the more severe attack variant
• A public website publishes daily stealthy BGP hijacking incident reports for community monitoring

About the Speaker(s)

The paper is from Tsinghua University, presented by Yihao Chen on behalf of the first author who was unable to attend. The research team specializes in BGP security, RPKI deployment analysis, and large-scale internet routing simulation, with capabilities including GPU-accelerated BGP simulation infrastructure.