Control-plane attacks can break data-plane assumptions
Attacking the systems that decide how traffic flows can be more effective than attacking the traffic.
Routing, DNS and orchestration are the control plane. Compromise there redirects, blocks or exposes everything downstream without touching a single application. Defences concentrated on the data path assume the control path is sound, and that assumption is rarely tested with the same rigour.
More on Internet routing
- BGP announces reachability, not truthA claim, not a proof
- BGP hijacking can redirect traffic before applications see itThe points move under the train
- Route leaks can be accidental and disruptiveThe whole motorway down a side lane
- RPKI validates route origins, not the whole pathOnly the first pair of hands is signed for
- More specific Internet routes usually winThe narrower claim takes it
- Anycast sends one address to multiple placesOne address, many doorsteps