Severe Vulnerabilities Discovered in Software to Protect Internet Routing

Vulnerabilities Discovered in Software to Protect Internet Routing
(c) Fraunhofer SIT

A research team from the National Research Center for Applied Cybersecurity ATHENE led by Prof. Dr. Haya Schulmann has uncovered 18 vulnerabilities in crucial software components of Resource Public Key Infrastructure (RPKI).

RPKI is an Internet standard meant to protect Internet traffic from being hijacked by hack-ers. By now, all affected vendors provided patches for their products. The vulnerabilities could have had devastating consequences: Internet hijacks have already been exploited, e.g., for phishing passwords and other sensitive information, tricking certificate authori-ties into issuing fraudulent Web certificates, stealing cryptocurrency, distributing mal-ware, and poisoning caches of DNS servers.

The ATHENE team consisting of Prof. Dr. Haya Schulmann and Niklas Vogel, both from Goethe University of Frankfurt, Donika Mirdita from TU Darmstadt, and Prof. Dr. Michael Waidner from TU Darmstadt and Fraunhofer SIT uncovered and disclosed 18 vulnerabilities. The National Vulnera-bility Database (NVD), operated by the US National Institute of Standards and Technology (NIST), assigned five Common Vulnerabilities and Exposures (CVE) entries to these vulnerabilities, some critical with a score of 9.3 out of 10. The team used a testing tool, CURE, which they developed specifically for this project and which ATHENE makes available free of charge to all developers of RPKI software. The researchers found vulnerabilities in all popular implementations of the valida-tor component of RPKI. They range between crashes, violation of standard behavior, and even severe bugs that allow a network adversary to completely take over an RPKI certificate hierarchy in order to inject its own trust anchor – effectively being able to forge authentic and valid yet bo-gus routing information (i.e., BGP announcements). It is unknown whether any of the vulnerabili-ties were already exploited by hackers in the wild.

RPKI is a relatively new standard. Today, about 50% of the Internet’s network prefixes are covered by RPKI certificates, and 37.8% of all Internet domains validate RPKI certificates. In particular, many large providers and operators support RPKI, e.g., Amazon Web Services, Cogent, Deutsche Telekom, Level 3, and Zayo.

The research work was carried out in the ATHENE research area Analytic Based Cybersecurity (ABC) (more information at https://abc.athene-center.de/en/) and appeared at the 2024 Network and Distributed System Security (NDSS) Symposium in San Diego, California, USA. The research paper can be downloaded from https://www.ndss-symposium.org/ndss-paper/the-cure-to-vulnerabilities-in-rpki-va…. The testing tool CURE developed and used by the researchers to uncover the vulnerabilities can be downloaded from https://github.com/rp-cure/rp-cure.

About ATHENE

The National Research Center for Applied Cybersecurity ATHENE is a research center of the Fraunhofer Society that brings together the Fraunhofer Institutes for Secure Information Technol-ogy (SIT) and for Computer Graphics Research (IGD), Technische Universität Darmstadt, Goethe-Universität Frankfurt am Main, and Darmstadt University of Applied Sciences. With more than 600 scientists, ATHENE is Europe’s most prominent cybersecurity research center and Germa-ny’s leading scientific research institution in this domain. ATHENE is supported by the German Federal Ministry of Education and Research (BMBF) and the Hessian Ministry for Higher Education, Research, Science and the Arts (HMWK). Further information about ATHENE can be found at https://www.athene-center.de/en/.

Press Contact: Mrs. Cornelia Reitz, cornelia.reitz@athene-center.de

Wissenschaftliche Ansprechpartner:

Prof. Haya Schulmann

Weitere Informationen:

https://www.athene-center.de/en/

Media Contact

Cornelia Reitz Presse- und Öffentlichkeitsarbeit
Nationales Forschungszentrum für angewandte Cybersicherheit ATHENE

All latest news from the category: Information Technology

Here you can find a summary of innovations in the fields of information and data processing and up-to-date developments on IT equipment and hardware.

This area covers topics such as IT services, IT architectures, IT management and telecommunications.

Back to home

Comments (0)

Write a comment

Newest articles

‘Invisible’ protein keeps cancer at bay

Scientists in Germany have revealed how an unstructured protein traps cancer-promoting molecules. Each second of our lives, cells in our body grow and divide to ensure we stay healthy. However,…

Practical 3D tracking at record-breaking speeds

With speeds over 200 times faster than traditional methods, new technology could benefit autonomous driving, industrial inspection and security applications. Researchers have developed a new 3D method that can be…

Scientists discover new behavior of membranes

…that could lead to unprecedented separations. Researchers use new technique to overcome perceived limitation of membranes with pores of consistent size. Imagine a close basketball game that comes down to…

Partners & Sponsors