300-445 Question 203
Single answerYour organization has experienced sudden performance degradation in its network, including significant packet loss and increased latency. Upon investigation, you discover that traffic destined for your network is being rerouted through unfamiliar autonomous systems (ASes), leading to potential traffic interception and disruption. Which network security issue is most likely causing this problem?
- A
DDoS attack
- B
DNS hijacking
- C
BGP hijacking
- D
Route leaking
Show answer and explanation
Correct answer: C
Explanation
The symptoms described in the scenario, including traffic being rerouted through unfamiliar autonomous systems and potential interception, are indicative of a BGP hijacking attack. BGP hijacking exploits the trust-based nature of the Border Gateway Protocol, allowing attackers to announce fraudulent routes. This can lead to significant performance degradation, interception of data, and potential security breaches.
- A. Incorrect.
DDoS attacks overwhelm a network or service with excessive traffic, causing denial of service. However, they do not involve rerouting traffic through unauthorized ASes.
- B. Incorrect.
DNS hijacking involves redirecting domain name requests to malicious servers, which could cause service interruptions or compromise user data. This does not pertain to rerouting traffic through unauthorized autonomous systems.
- C. Correct.
BGP hijacking occurs when an attacker announces incorrect routes using the Border Gateway Protocol (BGP), causing traffic to be misrouted through unauthorized networks. This matches the described symptoms of traffic interception and disruption.
- D. Incorrect.
Route leaking involves the improper advertisement of routes between ASes, which might lead to suboptimal routing but does not specifically align with the described traffic interception scenario.