BGP Hijacking: Trust Like It's 1989

On April 8, 2010, route announcements from China Telecom redirected traffic for roughly 15% of all internet destinations through China for 18 minutes.

Routers worldwide accepted the detour via BGP, which is the core protocol networks use to advertise reachability for IP addresses.

Here is a short story of how BGP started with a lunch meeting in 1989, and what you can do to protect yourself today.

Two napkins in 1989

It's 1989. Kirk Lougheed of Cisco and Yakov Rekhter of IBM sketched out a new routing protocol over lunch at an IETF conference.

Published in June 1989 as RFC 1105, the Border Gateway Protocol earned a famous nickname documented by the Computer History Museum: the "Two Napkin Protocol."

Kirk Lougheed, to The Washington Post (2015): "In the early days of the Internet, getting stuff to work was the primary goal. There was no concept that people would use this to do malicious things. . . . Security was not a big issue."

There's nothing in BGP that verifies whether a neighbor router owns the IP addresses it claims:

RFC 4272 (2006): "no mechanism has been specified within BGP to validate the authority of an AS to announce NLRI information."

In the quote above: Autonomous System (AS) is an individual network, and Network Layer Reachability Information (NLRI) refers to the IP address range it claims it can reach.

BGP hijacking Case Studies

China Telecom, April 2010

On April 8, 2010, IDC China Telecommunication, a relatively small Chinese network, announced routes for more than 50,000 blocks of IP addresses, most of which belonged to other networks.

China Telecom, a big network, passed those announcements on, and for about 18 minutes routers around the world sent traffic for those addresses through China.

Most traffic still reached the destination address, albeit with some delay due to the detour.

Renesys (2010): "Internet routing, believe it or not, still works on the honor system."

Rostelecom, April 2020

In April 2020, Russian provider Rostelecom announced 8,870 prefixes belonging to nearly 200 networks including Amazon, Akamai, and Cloudflare, according to Qrator Labs.

This time, instead of a delay, the traffic vanished.

ThousandEyes observed it being dropped directly inside Rostelecom's network.

Qrator attributed the 2020 incident to an accidental leak, much like Renesys's assessment of the 2010 detour.

Note that to BGP, an accident and an intentional cyberattack can look the exact same.

RPKI: a partial solution

A partial solution has existed since 2012: RPKI (Resource Public Key Infrastructure).

RPKI allows IP address owners to publish cryptographically signed statements identifying which networks are authorized to announce their prefixes.

However, adoption remains optional. RPKI protects a route only when receiving networks actively validate those signed statements and drop routes that fail validation.

Our check of IPv4 routes seen by RIPE RIS collectors on October 5, 2026, reveals a stark contrast:

• Worldwide: 70.31% of routes have a valid RPKI statement.
• Korea: Only 2.52% do.

Yakov Rekhter, to The Washington Post (2015): "There is a cost associated with doing security. And the question is: Who is going to pay the price?"

Security countermeasures

Transport encryption (TLS) keeps diverted traffic from being read in transit. However, an attacker can hijack your server's IP addresses and obtain a TLS certificate for your domain name, as occurred in the KLAYswap theft.

The reality is the best you can do is monitor these things and react as quickly as possible if something fishy comes up:

1. Follow the steps we outlined in the KLAYswap theft post to prevent hijackers from abusing TLS certificates.
2. If you manage your own IP addresses, use route monitoring tools like the open-source BGPalerter.

We would love to know: before reading this post, did you assume the internet verified who owns an IP address?

References

1. US-China Economic and Security Review Commission — 2010 Annual Report to Congress, p. 244 (November 2010)
2. Jim Cowie, Renesys — China's 18-Minute Mystery (18 November 2010, archived)
3. Craig Labovitz, Arbor Networks — China Hijacks 15% of Internet Traffic? (19 November 2010, archived)
4. Computer History Museum — The Two-Napkin Protocol (4 March 2015)
5. IETF — RFC 1105: A Border Gateway Protocol (BGP) (June 1989)
6. Craig Timberg, The Washington Post — Net of Insecurity, Part 2: The long life of a quick 'fix' (31 May 2015)
7. IETF — RFC 4272: BGP Security Vulnerabilities Analysis (January 2006)
8. Qrator Labs — This is how you deal with route leaks (2 April 2020)
9. ThousandEyes — Why Rostelecom's Route Hijack Highlights the Need for BGP Security (2 April 2020, archived)
10. IETF — RFC 6480: An Infrastructure to Support Secure Internet Routing (February 2012)
11. RIPE NCC — RIS raw data and RPKI ROA archive (snapshots of 4–5 October 2026)
12. NTT — BGPalerter (open source)