50+ Vulnerabilities Uncovered in RPKI security Framework for Internet Routing

RPKI is a security framework designed to enhance the integrity of Internet routing by associating specific IP address blocks and ASNs with their legitimate holders. 

It employs cryptographic certificates that are known as ROAs to validate BGP route announcements which ensures that only authorized entities can advertise specific IP prefixes.

The following cybersecurity researchers from “ATHENE & Goethe-Universitat Frankfurt” and “ATHENE & TU Darmstadt” discovered that RPKI security is under fire, as 53 vulnerabilities were exposed in the new research.

RPKI security Framework for Internet Routing

The BGP is primarily crucial for Internet routing, but it lacks inherent security, which makes it vulnerable to attacks.

Analyse Any Suspicious Links Using ANY.RUN’s New Safe Browsing Tool: Try for Free

The RPKI was developed to address this issue by enabling “Routing Origin Validation” (‘ROV’) through “ROAs.” 

RPKI’s adoption has grown significantly since its introduction with over 50% of announced prefixes now covered by “ROAs” and about 25% of networks enforcing “ROV.” 

The U.S. government has recognized RPKI’s importance by issuing a strategic roadmap and FCC rulemaking to promote its adoption. 

However, the challenges persist which include “lack of understanding,” “resource constraints,” and “administrative barriers.” 

This analysis identifies gaps in RPKI implementation across “specifications,” “software,” “operations,” and “deployment.” 

The goal is to enhance RPKI’s maturity and security by progressing it toward full operational readiness on the TRL scale and improving global Internet routing security.

Despite RPKI reducing malicious announcements, several challenges still remain including “instability of implementation,” “varying validation results in RP software packages,” and “DDoS issues.”

These problems arise from “insufficient RFC,” “bugs in programs,” and “complexity of work.”

The architecture of RPKI consists of also ROAs which refer to the objects that contain cryptographic repositories in “distributed repositories” and are validated by “RPs.”

The BGP decision-making within the routers is subject to the validation process. However, most networks run RPKI in a ‘fail open’ test wherein ‘NotFound’ or ‘Invalid’ routes are still accepted in order to avoid isolation.

The most significant momentum in RPKI over the last few months has been, probably, the endorsement of RPKI by the White House as one of the elements of its cybersecurity strategy.

This highlights the need to address existing issues and improve RPKI’s readiness for global, production-level deployment.

Recommendations

Recommendations include:-

• Refining RPKI standards to resolve conflicts.
• Developing automated tools for software management.
• Considering the full threat landscape, including malicious attacks.
• Addressing the increased attack surface from RPKI deployment.

Free Webinar on How to Protect Small Businesses Against Advanced Cyberthreats -> Free Webinar