In 2008, Pakistan tried to block YouTube inside its own borders — and accidentally took YouTube offline for most of the planet for two hours. No one was hacked. No vulnerability was exploited. A single network simply announced to the world that it was YouTube, and the entire internet believed it. That's not a bug. That's how the internet was designed to work.

The protocol that routes all global traffic runs on trust. And trust, at internet scale, is a security nightmare that has never been fully solved.

The internet isn't one network. It's tens of thousands of separate networks — internet service providers, corporations, universities, cloud providers — stitched together into something that behaves like a single global system. The glue holding them together is a protocol called BGP, the Border Gateway Protocol. Its job is deceptively simple: it's how these independent networks tell each other which slices of the internet they can deliver traffic to. When you load a website, BGP is the system that figures out the path your data takes across all those separate networks to reach its destination.

BGP was designed in 1989 — sketched out, according to the engineers who created it, on the back of a few napkins. It was built for a small, collegial internet where every network operator essentially knew and trusted every other one. That internet no longer exists. But the protocol running the modern internet of billions of users, trillions of dollars, and constant adversarial pressure is fundamentally the same trusting design, and its core assumption has never been safe to make.

The assumption at the heart of BGP is that networks tell the truth. When a network announces "I can deliver traffic to this range of internet addresses," every other network simply believes it. There's no built-in verification. No authority checks whether the announcing network actually owns those addresses or has any right to route traffic for them. The system was designed on the premise that operators are honest and competent, and that if someone announces a route, they must legitimately serve it.

BGP doesn't authenticate announcements. It's a global system where anyone with a connected network can claim to be the destination for any address on the internet — and by default, everyone else will believe them.

Worse, the protocol is designed to prefer the most specific and most direct-looking route. So if a legitimate network announces a broad range of addresses, and a second network announces a smaller, more specific slice of that same range, BGP will steer traffic to the more specific announcement — regardless of who actually owns it. This is the entire mechanism of a hijack, and it requires no exploit, no malware, no breaking in. It requires only that a network make an announcement and that the rest of the internet do what it was built to do: believe it.

A BGP hijack happens when a network announces routes for addresses it doesn't own, and the rest of the internet accepts the false announcement. The consequences range from accidental outage to deliberate interception. In the Pakistan case, the government ordered a local provider to blackhole YouTube's traffic domestically. The provider announced a more specific route for YouTube's addresses to redirect that traffic into a dead end — but the announcement leaked out to the wider internet through the provider's international connections. Suddenly BGP everywhere preferred that more specific route, and the world's YouTube traffic flowed toward a black hole in Pakistan. It took hours to unwind.

The malicious version is far more dangerous, because a hijack doesn't have to be a black hole. An attacker can announce a route, receive the misdirected traffic, quietly inspect or record it, and then pass it along to the real destination so that nothing appears broken. This is a route through an interceptor that the victim never sees. In 2018, attackers hijacked the routing for a cryptocurrency service's DNS provider, redirected users to a malicious copy of the site, and stole hundreds of thousands of dollars in digital currency — all without breaching a single one of the victim's own systems. The theft happened in the routing layer, in the space between networks, where the victim had no visibility at all.

Why it stays unsolved

A fix exists — cryptographic verification of who owns which addresses. But BGP is run by tens of thousands of independent organizations with no central authority to force adoption. Security only works if nearly everyone participates, and getting the entire internet to upgrade in unison is less a technical problem than a coordination problem with no one in charge.

This is why BGP incidents keep happening decades after the flaw was understood. Major cloud outages, traffic from entire countries briefly rerouted through unexpected networks, financial services knocked offline — many trace back to BGP, and many are accidents rather than attacks, a mistyped configuration by one operator cascading across the globe. The security community has spent years deploying the cryptographic defenses that would fix this, and adoption is slowly climbing. But "slowly" is the operative word, and until participation approaches universal, the internet continues to route trillions of dollars of traffic on a protocol that takes every network at its word.

The mental model worth taking from BGP is bigger than routing: the most fragile parts of any system are the foundations laid so early that everyone forgot they were choices. BGP's trust model wasn't a mistake in 1989 — it was a reasonable decision for the internet that existed then. It became a vulnerability only because the world changed around a foundation that couldn't easily change with it. Every mature system has layers like this: assumptions baked in when the stakes were low, load-bearing by the time the stakes got high, and nearly impossible to replace because everything above them now depends on the way they work.

Once you start looking for this pattern, you see it everywhere in security. Email's lack of built-in authentication. The trust placed in certificate authorities. Legacy protocols still running because too much depends on them to justify the migration. The lesson isn't "BGP is broken." It's that "it works, so don't touch it" quietly becomes "it's too embedded to fix" — and the gap between those two statements is where systemic risk accumulates, invisible until the day it isn't. Recognizing which of your own foundations are trust-by-default, and unexamined because they've simply always worked, is one of the most valuable instincts in security.

What gets me about BGP is that most people using the internet every day have no idea their traffic's entire path depends on strangers telling the truth. It's a quiet reminder that the systems we treat as solid ground are often held together by agreements we've stopped noticing. I think the most interesting security work is finding those forgotten foundations before an attacker does. So here's what I'm curious about: in the systems you work with or rely on, what's the one piece you've always just trusted to work — the thing you've never actually examined because it's never given you a reason to? Hit reply. I'd genuinely like to know what comes to mind.

This week's question

In the systems you rely on, what's the one piece you've always just trusted to work — the foundation you've never examined because it's never given you a reason to? Hit reply. I read every response.

Think clearly,

— DJ Brar

SKBSEC | SKB Decoded  ·  www.skbsec.com