Understanding Internet Routing Attacks: How ‘Road Signs’ Can Lead You Astray

The internet, a vast network connecting billions worldwide, relies on complex systems to guide data from one point to another. Think of it like a global postal service, with addresses and routes ensuring messages reach their intended destinations. However, this system isn’t foolproof. Attackers can manipulate these “road signs” and “phone books” of the internet, redirecting users to malicious websites, often without them even realizing it. This type of attack, known as a Border Gateway Protocol (BGP) hijack, recently affected users in several Chinese provinces, sending them to gambling sites instead of their intended destinations. This incident highlights a critical vulnerability in the internet’s infrastructure and the need for greater security measures.

The Mechanics of a BGP Hijack

At its core, the internet is a collection of interconnected networks, each managing its own block of IP addresses. The Border Gateway Protocol (BGP) is the system that allows these networks to communicate with each other, sharing information about which IP address ranges they can reach. It’s essentially the routing protocol of the internet, dictating the paths that data packets take across the globe.

BGP works by exchanging “routing information” between network routers. These routers announce which IP address prefixes (blocks of IP addresses) they can serve. When a router receives multiple announcements for the same IP address prefix, it uses a set of rules to decide which path to take. One of these rules is the “longest-prefix match.” This rule states that if two routes are announced for the same destination, the more specific route, meaning the one that covers a smaller, more precise range of IP addresses, will be preferred.

Attackers exploit this longest-prefix match rule. They can announce a more specific route for a legitimate website’s IP address range that actually points to their own controlled network. This forged route, being more specific, overrides the legitimate route that the internet’s routers would normally use. Suddenly, all traffic intended for that website is diverted to the attacker’s infrastructure.

Manipulating the Internet’s ‘Phone Book’

Beyond manipulating routing information, attackers can also tamper with the Domain Name System (DNS). The DNS acts like the internet’s phone book, translating human-readable website names (like www.example.com) into the numerical IP addresses that computers use to identify each other. When you type a website address into your browser, your computer queries a DNS server to find the corresponding IP address.

In a DNS manipulation attack, attackers can either:

• Poison the DNS cache: They can trick a DNS server into storing incorrect IP address information for a legitimate website. When users then try to access that website, the DNS server provides the attacker’s IP address instead of the correct one.
• Redirect DNS queries: They can intercept DNS requests from users and provide false answers, directing them to a malicious IP address.

In the recent incident, attackers combined both BGP hijacking and DNS tampering. They first used BGP to announce fake routes, pulling traffic towards their foreign autonomous system (AS 402425). Then, they tampered with DNS responses. This meant that even if a user’s device correctly requested the IP address for a legitimate website, the attacker’s compromised DNS system would provide the IP address of a gambling site, effectively sending the user to an unintended destination.

The Recent Incident in China

The incident affecting users in China serves as a stark example of these vulnerabilities in action. Attackers, operating from outside the country, managed to hijack internet routing and address data. They did not infect user devices directly. Instead, they manipulated the underlying infrastructure.

China’s National Computer Network Emergency Response Technical Team/Coordination Center (CNCERT) investigated the incident. They traced the tampering back to AS 402425, an autonomous system registered by a US company called Qorexa Labs in April 2026. The malicious IP ranges identified by CNCERT included 112.121.185.x, 117.55.193.x, and 43.230.161.x. While the measurements pinpointed the tampering within this network, they did not definitively establish Qorexa Labs’ intent or direct involvement.

The consequence for users was that their internet traffic was rerouted, leading them to gambling websites. This highlights how sophisticated these attacks can be, leveraging fundamental internet protocols to achieve malicious goals.

Not Just a China-Specific Problem

It’s crucial to understand that BGP route hijacking is not an isolated incident confined to any single country. These events occur with significant frequency on the global internet. Reports indicate that BGP route incidents happen hundreds of times each month, and many go unnoticed by corporate security teams.

A notable example occurred in 2024 when a BGP hijack involving Cloudflare’s widely used 1.1.1.1 DNS service impacted over 300 networks in 70 countries. This incident was reportedly caused by misconfigurations by two Brazilian internet operators. Despite the widespread disruption, it did not trigger alerts within many enterprise security systems, underscoring the difficulty in detecting and responding to such attacks.

These incidents demonstrate that the internet’s routing system, while functional, has inherent weaknesses that can be exploited by malicious actors. The global nature of the internet means that a vulnerability exploited in one region can have ripple effects worldwide.

Existing Tools and Recommendations for Mitigation

Fortunately, solutions and best practices exist to combat these routing security threats. Several tools and protocols are designed to add layers of security to the BGP system:

Resource Public Key Infrastructure (RPKI)

RPKI is a framework that allows network operators to cryptographically verify the legitimacy of BGP route announcements. It enables network owners to create digital certificates that authorize specific autonomous systems to announce certain IP address prefixes. Routers can then use these certificates to validate incoming route announcements, rejecting any that are not properly authorized. This helps prevent attackers from announcing routes they do not own or have permission to use.

Mutually Agreed Norms for Routing Security (MANRS)

MANRS is a global initiative that promotes a set of fundamental principles and best practices for improving internet routing security. It encourages network operators to adopt measures such as:

• Preventing incorrect routing information: Implementing checks to avoid publishing incorrect or malicious routing data.
• Preventing leaks and hijacks: Taking steps to stop unauthorized routes from entering or leaving their networks.
• Facilitating global routing statistics: Sharing data to improve the overall visibility and security of routing.
• Cooperating to de-escalate incidents: Working together to resolve routing issues quickly and effectively.

MANRS provides a framework for collaboration and accountability among internet service providers and network operators, aiming to build a more secure routing ecosystem.

Recommendations from CNCERT

In response to the recent incident, CNCERT has issued specific recommendations:

• Review and revoke malicious AS resources: Internet registries and platforms that trade IP addresses should actively review their records and revoke resources associated with malicious autonomous systems. This includes identifying and disabling AS numbers that are being used for illicit purposes.
• Filter routes containing AS 402425: Network operators are advised to implement filters that block any routes originating from or passing through AS 402425. This is a direct measure to prevent traffic from being diverted through the compromised foreign autonomous system.

These recommendations represent immediate steps that network operators can take to protect their users from similar attacks.

Advice for Ordinary Internet Users

While network operators and security professionals work on infrastructure-level solutions, ordinary users also play a role in protecting themselves. The advice for users is straightforward:

• Use a trusted public DNS service: Opt for reputable DNS providers known for their security and reliability. These services are less likely to be compromised or manipulated by attackers.
• Be cautious of sudden redirects: If a website you are trying to visit suddenly redirects to an unfamiliar or suspicious site, especially one related to gambling or other illicit activities, close the page immediately.
• Do not interact with suspicious sites: Avoid clicking any buttons, links, or downloading any files from a redirected site. These actions could lead to further malware infections or data theft.
• Clear browser cache and cookies: Regularly clearing your browser’s cache and cookies can help remove any potentially harmful data stored by previously visited sites.
• Keep systems and browsers updated: Ensure your operating system, web browser, and security software are always up to date. Software updates often include patches for known vulnerabilities that attackers might exploit.

By following these simple guidelines, users can significantly reduce their risk of falling victim to routing and DNS manipulation attacks.

The Broader Implications: A Global Supply-Chain Problem

The issue of routing security extends beyond technical configurations; it is a global supply-chain problem. The internet’s infrastructure is built on trust, and when that trust is broken through malicious manipulation, the consequences can be far-reaching. The Chinese incident serves as a warning that the internet’s trust model can be exploited against users in any country.

The fix for these vulnerabilities depends on the collective adoption of safeguards by networks, registries, and other stakeholders in the internet ecosystem. It requires a commitment to implementing existing security measures like RPKI and adhering to best practices outlined by initiatives like MANRS.

The internet’s future security relies on a shared responsibility. As attackers become more sophisticated, the need for robust, globally coordinated security measures becomes increasingly critical. Ensuring the integrity of internet routing is not just an engineering challenge; it is a fundamental requirement for maintaining a safe and reliable global digital infrastructure.

Conclusion

The manipulation of internet “road signs” through BGP hijacking and DNS tampering poses a significant threat to users worldwide. The recent incident in China, where users were redirected to gambling sites, underscores the reality and impact of these attacks. While the technical complexities of internet routing can seem daunting, existing tools like RPKI and initiatives like MANRS offer viable solutions for improving security. For everyday users, vigilance and adherence to basic cybersecurity practices are essential. Ultimately, securing the internet’s routing infrastructure requires a collaborative effort from network operators, security experts, and users alike, ensuring that the digital pathways we rely on remain safe and trustworthy.