The Internet is a network of networks. Each "Autonomous system" (AS) connects to the internet using a router that "speaks" the Border Gateway Protocol (BGP) to disseminate and receive routing information. The problem is that there is no authoritative way to figure out who is supposed to receive which IP address space (no, "whois" information is not authoritative). If I got a new IP address range assigned, or if I agree to route it as part of an agreement with another network, then I will use BGP to advertise this to the Internet. Sadly, nobody has figured out yet how to validate these advertisements. There are many proposals, but none of which has the necessary traction right now. 

As a result, it is somewhat common for BGP abused to advertise IP addresses that an organization doesn't actually own. This can lead to a denial of service, or miscreants can start using it for a man-in-the-middle attack. BGPMon, a company that monitors BGP traffic for anomalies, just yesterday discovered how part of a netblock assigned to VISA was re-routed to Rosetelecom, a large Russian telecom provider. This may not be entirely the fault of Rosetelecom. Any of its customers could have sent the announcement. Of course, Rosetelecom should have noticed this as well.

So in short, what can you do about it?

1 - The internet is an untrusted network. Deal with it. Assume people are rerouting, eavesdropping and manipulating your traffic. Technologies like TLS will help you detect these issues if properly implemented. VPNs can help to secure trusted connections within an organization or between trusted partners. But this is exactly why you have to audit these configurations and make sure they are configured based on current best practices.

2 - Monitor if someone is trying to hijack IP address space you are using. Tools like BPGMon are useful to do so if you don't want to set up your own monitoring infrastructure, which is quite costly. 

3 - If you do own IP address space, and if you do manage BGP yourself, then make sure you implement the few security features that are available. BPGMon has a nice blog post about some of the options [2] 

[1] https://bgpstream.com/event/80327
[2] https://bgpmon.net/securing-bgp-routing-with-rpki-and-roas/

---
Johannes B. Ullrich, Ph.D., Dean of Research, SANS Technology Institute
STI|Twitter|