BGP and DNS infrastructure attacks¶

Attack pattern¶

BGP decides where an address is; DNS decides which address a name points to. Between them they answer every question of where to send a packet, and each leans on the other: DNS servers are reached over routes BGP chose, and BGP’s own tooling looks up names. Attack them together and the leverage compounds, hijack the prefix a nameserver lives on and forge its answers, or poison resolution to send traffic toward a prefix already primed to receive it. Two trusting protocols, and the trust in one covers for the lie in the other.

1. BGP and DNS infrastructure attacks [OR]

    1.1 BGP-DNS interdependence exploitation [OR]
    
        1.1.1 Route manipulation affecting DNS resolution
            1.1.1.1 BGP hijacking of authoritative DNS server prefixes
            1.1.1.2 Anycast DNS route manipulation
            1.1.1.3 Localised DNS outage through route poisoning
            
        1.1.2 DNS manipulation affecting BGP operations
            1.1.2.1 Malicious DNS responses for BGP next-hop addresses
            1.1.2.2 DNS cache poisoning against BGP speaker resolution
            1.1.2.3 TXT record exploitation for BGP policy manipulation
            
    1.2 Combined BGP-DNS attack techniques [OR]
    
        1.2.1 Man-in-the-middle attacks
            1.2.1.1 Traffic interception through route hijacking + DNS spoofing
            1.2.1.2 SSL/TLS certificate validation bypass
            1.2.1.3 Combined attack infrastructure deployment
            
        1.2.2 Service disruption attacks
            1.2.2.1 Coordinated BGP route withdrawal and DNS amplification
            1.2.2.2 Anycast DNS instability through BGP manipulation
            1.2.2.3 Recursive resolver targeting through route manipulation
            
        1.2.3 Resource exhaustion attacks
            1.2.3.1 BGP update flooding combined with DNS query storms
            1.2.3.2 Memory exhaustion through malicious routing + DNS responses
            1.2.3.3 CPU exhaustion through complex protocol interactions
            
    1.3 Protocol-specific vulnerability exploitation [OR]
    
        1.3.1 BGP protocol exploitation
            1.3.1.1 TCP MD5 authentication bypass
            1.3.1.2 BGP session hijacking
            1.3.1.3 Route reflection manipulation
            
        1.3.2 DNS protocol exploitation
            1.3.2.1 DNSSEC implementation vulnerabilities
            1.3.2.2 DNS cache poisoning techniques
            1.3.2.3 Protocol extension vulnerabilities
            
        1.3.3 Inter-protocol vulnerability chaining
            1.3.3.1 BGP route leaks + DNS amplification combination
            1.3.3.2 Route hijacking + DNS tunnelling for data exfiltration
            1.3.3.3 BGP convergence delays + DNS TTL exploitation
            
    1.4 Infrastructure targeting [OR]
    
        1.4.1 Core internet infrastructure attacks
            1.4.1.1 Root DNS server targeting
            1.4.1.2 Tier 1 ISP route manipulation
            1.4.1.3 Internet exchange point exploitation
            
        1.4.2 Cloud provider targeting
            1.4.2.1 Cloud anycast DNS exploitation
            1.4.2.2 Multi-cloud BGP policy manipulation
            1.4.2.3 CSP infrastructure compromise
            
        1.4.3 Enterprise network targeting
            1.4.3.1 Corporate DNS resolver compromise
            1.4.3.2 Enterprise BGP peering manipulation
            1.4.3.3 Internal-external route redistribution attacks
            
    1.5 Advanced persistent techniques [OR]
    
        1.5.1 State-sponsored attacks
            1.5.1.1 Long-term route manipulation campaigns
            1.5.1.2 DNS infrastructure compromise
            1.5.1.3 Strategic internet positioning
            
        1.5.2 Criminal operations
            1.5.2.1 Ransom operations through combined attacks
            1.5.2.2 Financial fraud infrastructure
            1.5.2.3 Botnet command and control
            
        1.5.3 Insider threat exploitation
            1.5.3.1 Rogue network administrator actions
            1.5.3.2 Compromised credential exploitation
            1.5.3.3 Policy manipulation attacks
            
    1.6 Evasion and obfuscation techniques [OR]
    
        1.6.1 Detection avoidance
            1.6.1.1 Low-and-slow attack patterns
            1.6.1.2 Legitimate-looking traffic mimicry
            1.6.1.3 Geographic distribution of attack sources
            
        1.6.2 Attribution obfuscation
            1.6.2.1 False flag operations
            1.6.2.2 Intermediate system exploitation
            1.6.2.3 Cross-border attack masking
            
        1.6.3 Persistence mechanisms
            1.6.3.1 Multiple vector redundancy
            1.6.3.2 Fast-flux DNS techniques
            1.6.3.3 Dynamic BGP policy adjustment
            
    1.7 Specific attack methodologies [OR]
    
        1.7.1 BGP hijacking + DNS spoofing
            1.7.1.1 YouTube Pakistan incident methodology
            1.7.1.2 Cryptocurrency exchange targeting
            1.7.1.3 Financial institution targeting
            
        1.7.2 Route leaks + DNS manipulation
            1.7.2.1 MainOne-China Telecom incident patterns
            1.7.2.2 Verizon Asia-Pacific redirection
            1.7.2.3 Content delivery network targeting
            
        1.7.3 Combined DDoS techniques
            1.7.3.1 DNS amplification + BGP route poisoning
            1.7.3.2 Anycast instability attacks
            1.7.3.3 Recursive resolver exhaustion
            
    1.8 Emerging threat vectors [OR]
    
        1.8.1 IoT botnet exploitation
            1.8.1.1 Massive IoT DNS amplification
            1.8.1.2 Consumer device routing manipulation
            1.8.1.3 ISP infrastructure targeting
            
        1.8.2 5G network targeting
            1.8.2.1 Mobile core network exploitation
            1.8.2.2 Network slicing vulnerabilities
            1.8.2.3 Edge computing infrastructure
            
        1.8.3 Quantum computing implications
            1.8.3.1 Cryptographic vulnerability anticipation
            1.8.3.2 Post-quantum migration attacks
            1.8.3.3 Quantum network targeting
            
    1.9 defence evasion techniques [OR]
    
        1.9.1 BGP security bypass
            1.9.1.1 RPKI validation evasion
            1.9.1.2 BGPsec implementation flaws
            1.9.1.3 Route origin validation bypass
            
        1.9.2 DNS security bypass
            1.9.2.1 DNSSEC validation exploitation
            1.9.2.2 DNS-over-HTTPS manipulation
            1.9.2.3 Response policy zone bypass
            
        1.9.3 Monitoring system evasion
            1.9.3.1 BGP monitoring platform deception
            1.9.3.2 DNS query pattern manipulation
            1.9.3.3 Logging and detection avoidance
            
    1.10 Criminal ecosystem operations [OR]
    
        1.10.1 DDoS-for-hire services
            1.10.1.1 Booter service utilisation
            1.10.1.2 Stresser platform abuse
            1.10.1.3 Criminal service integration
            
        1.10.2 Ransomware operations
            1.10.2.1 Critical infrastructure targeting
            1.10.2.2 Double extortion techniques
            1.10.2.3 Payment channel establishment
            
        1.10.3 Cybercrime marketplace services
            1.10.3.1 Attack tool distribution
            1.10.3.2 Stolen credential marketing
            1.10.3.3 Infrastructure leasing

One covers for the other¶

The two are interlocked: DNS resolves names, BGP reaches the addresses, and attacking the pair opens more failure points than either alone.
Both were built on trust, with authentication and validation optional rather than required.
Both are complex enough that implementations diverge and leave holes.
The defences, DNSSEC and RPKI, are unevenly deployed, so the gaps are real.
Catching an attack that spans both needs joined-up monitoring that few organisations run.
The payoff is large and the full defence is costly, so the economics favour the attacker.