BGP + CDN/Cloud infrastructure attacks¶

Attack pattern¶

CDNs and clouds run on anycast: the same prefix announced from many places at once, so users land on the nearest edge. That convenience is a BGP dependency, and BGP can be lied to. An attacker who announces a CDN’s prefix from a position it controls draws a slice of that traffic to itself instead of to the real edge, with a certificate to forge or a service to quietly break once it does. Because so much of the internet sits behind a handful of these platforms, one convincing announcement reaches far past its target.

1. BGP + CDN/Cloud infrastructure attacks [OR]

    1.1 Anycast prefix hijacking [OR]
    
        1.1.1 CDN edge node targeting
            1.1.1.1 Anycast prefix announcement hijacking
            1.1.1.2 Edge location traffic interception
            1.1.1.3 Localised CDN outage creation
            
        1.1.2 SSL/TLS certificate manipulation
            1.1.2.1 Certificate authority bypass techniques
            1.1.2.2 Certificate transparency log evasion
            1.1.2.3 Fake certificate deployment
            
        1.1.3 Content manipulation attacks
            1.1.3.1 Malicious content injection at edge
            1.1.3.2 Cache poisoning techniques
            1.1.3.3 User traffic redirection
            
    1.2 Cloud region isolation bypass [OR]
    
        1.2.1 Regional prefix targeting
            1.2.1.1 Cloud region-specific prefix hijacking
            1.2.1.2 Availability zone isolation compromise
            1.2.1.3 Cross-region traffic manipulation
            
        1.2.2 Tenant isolation exploitation
            1.2.2.1 Multi-tenant infrastructure attacks
            1.2.2.2 Virtual network bypass techniques
            1.2.2.3 Hypervisor vulnerability exploitation
            
        1.2.3 Cloud management plane attacks
            1.2.3.1 Control plane API manipulation
            1.2.3.2 Metadata service exploitation
            1.2.3.3 Orchestration system compromise
            
    1.3 Combined attack methodologies [OR]
    
        1.3.1 Man-in-the-middle attacks
            1.3.1.1 Traffic interception through route hijacking
            1.3.1.2 SSL/TLS stripping techniques
            1.3.1.3 Session hijacking and credential theft
            
        1.3.2 Service disruption attacks
            1.3.2.1 Global service outage through anycast hijacking
            1.3.2.2 Regional service isolation
            1.3.2.3 Elastic load balancer manipulation
            
        1.3.3 Data exfiltration attacks
            1.3.3.1 Traffic redirection to malicious collectors
            1.3.3.2 Cloud storage bucket hijacking
            1.3.3.3 Database endpoint targeting
            
    1.4 Protocol exploitation techniques [OR]
    
        1.4.1 BGP protocol manipulation
            1.4.1.1 Anycast prefix announcement forging
            1.4.1.2 Route origin validation (ROV) bypass
            1.4.1.3 AS path manipulation for traffic engineering
            
        1.4.2 CDN-specific exploitation
            1.4.2.1 Cache hierarchy manipulation
            1.4.2.2 Edge server impersonation
            1.4.2.3 Content purging attacks
            
        1.4.3 Cloud API exploitation
            1.4.3.1 Management API unauthorised access
            1.4.3.2 Resource tagging manipulation
            1.4.3.3 Auto-scaling exploitation
            
    1.5 Infrastructure targeting [OR]
    
        1.5.1 Major CDN targeting
            1.5.1.1 Cloudflare anycast network attacks
            1.5.1.2 Akamai edge server targeting
            1.5.1.3 Amazon CloudFront prefix hijacking
            
        1.5.2 Cloud provider targeting
            1.5.2.1 AWS region isolation attacks
            1.5.2.2 Azure availability set manipulation
            1.5.2.3 Google Cloud platform targeting
            
        1.5.3 Hybrid infrastructure attacks
            1.5.3.1 CDN-origin path manipulation
            1.5.3.2 Multi-cloud traffic redirection
            1.5.3.3 On-premise to cloud path exploitation
            
    1.6 Advanced attack techniques [OR]
    
        1.6.1 Stealth hijacking methods
            1.6.1.1 Sub-prefix hijacking for specificity
            1.6.1.2 Time-limited route announcements
            1.6.1.3 Geographic-specific targeting
            
        1.6.2 Certificate authority attacks
            1.6.2.1 CA compromise for legitimate certificate issuance
            1.6.2.2 Certificate transparency log poisoning
            1.6.2.3 Intermediate CA exploitation
            
        1.6.3 Supply chain attacks
            1.6.3.1 CDN software backdoor insertion
            1.6.3.2 Cloud provider infrastructure compromise
            1.6.3.3 Third-party service exploitation
            
    1.7 Economic impact attacks [OR]
    
        1.7.1 E-commerce targeting
            1.7.1.1 Shopping cart manipulation
            1.7.1.2 Payment processing interception
            1.7.1.3 Inventory system manipulation
            
        1.7.2 Advertising revenue attacks
            1.7.2.1 Ad traffic redirection
            1.7.2.2 Impression fraud techniques
            1.7.2.3 Click fraud enablement
            
        1.7.3 API economy targeting
            1.7.3.1 API endpoint hijacking
            1.7.3.2 Microservice traffic manipulation
            1.7.3.3 Webhook redirection
            
    1.8 defence evasion techniques [OR]
    
        1.8.1 Monitoring avoidance
            1.8.1.1 Low-volume attack patterns
            1.8.1.2 Legitimate-looking traffic patterns
            1.8.1.3 Geographic distribution of attack sources
            
        1.8.2 Detection bypass methods
            1.8.2.1 Certificate pinning bypass
            1.8.2.2 HSTS header evasion
            1.8.2.3 DNSSEC validation bypass
            
        1.8.3 Persistence mechanisms
            1.8.3.1 Fast-flux anycast techniques
            1.8.3.2 Dynamic BGP policy adjustment
            1.8.3.3 Multi-vector attack redundancy
            
    1.9 Criminal ecosystem operations [OR]
    
        1.9.1 Ransom operations
            1.9.1.1 Service disruption for extortion
            1.9.1.2 Data hostage situations
            1.9.1.3 Double extortion techniques
            
        1.9.2 State-sponsored attacks
            1.9.2.1 Critical infrastructure targeting
            1.9.2.2 Economic espionage
            1.9.2.3 Geopolitical influence operations
            
        1.9.3 Organised crime targeting
            1.9.3.1 Financial institution targeting
            1.9.3.2 Cryptocurrency platform attacks
            1.9.3.3 Data trafficking operations
            
    1.10 Emerging threat vectors [OR]
    
        1.10.1 5G and edge computing
            1.10.1.1 Mobile edge computing targeting
            1.10.1.2 Network slicing vulnerabilities
            1.10.1.3 IoT traffic manipulation
            
        1.10.2 Serverless architecture attacks
            1.10.2.1 Function-as-a-service hijacking
            1.10.2.2 Event-driven architecture manipulation
            1.10.2.3 Cold start exploitation
            
        1.10.3 AI/ML infrastructure targeting
            1.10.3.1 Model serving infrastructure attacks
            1.10.3.2 Training data interception
            1.10.3.3 Inference pipeline manipulation

Anycast is a promise BGP can break¶

Anycast is BGP-shaped: the same prefix announced from many sites, and a hijack of it pulls traffic from the real edge to a false one.
Providers depend on the global BGP system, which runs on trust and often accepts announcements without adequate validation.
Certificate management at this scale is tangled enough that a plausible or forged certificate can pass.
The operations are vast, and comprehensive monitoring across them is hard, so an attack can run through a critical window unseen.
These platforms are central to internet commerce, which makes them worth serious effort.
A route hijack, a forged DNS response and a mis-issued certificate combine into one convincing redirect.