Exploring the Blind Spot of Internet Exchange Point Route Servers#

Stefano Servillo, University of Rome "La Sapienza" (with Spadaccino, Konstantaras, Luciani, Cuomo)

• Why: A formally defined, quantified vulnerability in the IRR-based route-server filtering that most of the world's IXPs rely on — directly relevant to routing security practice.
• What: The blind spot: IRR validation via AS-SET expansion builds a prefix list per peer but never binds prefixes to their legitimate origin AS, so a prefix covered by a route object under any AS that appears in a member's AS-SET is accepted by the route server regardless of who really owns it. Stale AS-SETs make this worse: of ~130k allocated ASes only ~77k are active, so AS-SETs routinely contain unallocated, private, or inactive ASes whose route objects can weaponize the gap. The team demonstrates prefix hijacking through this path, quantifies prevalence across a large set of IXPs, and validates with real route-server data from AMS-IX and NAMEX.
• How: Feasibility analysis defines the conditions (prefix not ROA-covered, update not filtered by intermediate ASes, origin AS in a member's AS-SET but not required to be there, etc.), followed by control-plane data analysis; practical countermeasures to strengthen RS filtering are proposed.
• Where applicable: Applies to any IXP or operator doing IRR-based filtering anywhere; RPKI ROAs close the hole for covered prefixes, which sharpens the case for ROA coverage as hijack insurance rather than just leak hygiene. Research-grade but with production validation.