BGP Hijacking

BGP hijacking is the deliberate or accidental announcement of false routing information through the Border Gateway Protocol (BGP), causing Internet traffic to be redirected through unauthorized networks. Because BGP relies on trust rather than cryptographic authentication, any router participating in the global routing system can announce that it owns IP address prefixes it does not control, and other routers will propagate that announcement until it is manually corrected.

BGP hijacking has been used for traffic interception, censorship, cryptocurrency theft, and espionage. The 2018 Amazon DNS hijack redirected traffic intended for Amazon Route 53 to a malicious server in Ukraine, enabling the theft of cryptocurrency wallet credentials. Nation-state actors have used BGP hijacking at scale to intercept traffic transiting their borders. The protocol's vulnerability is structural: it was designed for cooperation among trusted entities, not for operation in an adversarial environment.

The response — route flap dampening, RPKI, MANRS — treats the symptoms without curing the disease. The disease is that the Internet's routing layer has no mechanism for punishing malicious actors. Until it does, BGP hijacking will remain a permanent feature of the global Internet.

BGP hijacking reveals the Internet's foundational contradiction: the same trust-based architecture that enabled its explosive growth makes it permanently vulnerable to betrayal. You cannot build a global commons on handshake agreements and then act surprised when someone breaks the handshake.