Summary

  • Leslie Nobile, ARIN's Director of Registration Services, presented an IP address hijacking report at ARIN XII on 23 October 2003. ARIN described a method that targeted mainly legacy address blocks by making unauthorized changes to WHOIS registration records, creating an apparent right to control the associated resource record.
  • ARIN had opened 110 reported or discovered cases from April through October. Its slides listed 84 closed, 15 under investigation and 11 with no evidence of hijacking. These are case dispositions, and the presentation showed possible routing as one step in a typical attack path.
  • Nobile described ARIN's investigations and record-locking work, then presented possible stronger verification, change-history and legacy-record arrangements. The room argued over who would bear the cost and what authority ARIN had to impose new conditions on older holders.

The address book that could vouch for a stranger

Imagine asking an Internet registry who speaks for an old address block. Its WHOIS record supplies an organization, a contact and the details that other operators use to decide whom to call. Now imagine that the contact was replaced by someone who had no right to make the change. The directory would still answer promptly. That was the discomfort Leslie Nobile brought to ARIN XII in Chicago on 23 October 2003.

Nobile was ARIN's Director of Registration Services. Her original presentation described people targeting mainly legacy IP address blocks to alter WHOIS registration records without authorization. Once the false information appeared, the record could make a claimant seem to have authority over the resource. The affected resources could be IP addresses or autonomous system numbers. A database entry, ordinarily treated as a reliable starting point, became the costume in which an impostor approached the rest of the network.

The slides connected the deception to practical damage: misleading network operators, compromising the WHOIS database, legal exposure, more work for staff, slower replies and rising staffing and legal costs. Those were ARIN's stated effects of the class of cases it was handling. The record's claim of authority mattered because other people used it to decide how to act. A wrong contact field can travel much farther than the screen on which it first appears.

Nobile put a number on the workload. Between April and October 2003, ARIN opened 110 cases that had been reported to it or discovered by staff. At the date of the presentation, 84 were closed, 15 were still being investigated, and 11 had no evidence of hijacking. Those three groups add to 110. The last group belongs in the headline arithmetic. These were opened cases, with eleven entries already cleared of evidence. The slide gives no count of networks actually routed by impostors. The exact status breakdown is more revealing than a larger, blurrier claim would be.

An old block, a stale contact, a new name

One slide laid out a typical route through the records. The target might be a legacy block that was not currently routed, with stale or absent points of contact. An attacker could examine the associated domain information, register an expired or similar domain name, make incremental changes to point-of-contact, organization and network records, then try to route the network. The slide presented a method; the status table gave no path-by-path account of the 110 cases. Its value is the anatomy: a weak contact trail lets later changes look more ordinary than they are.

Legacy address space created a particular administrative challenge. Some holders had received blocks before ARIN existed. Contact details could be old; the holder might have no current contract with ARIN. The registry still needed an accurate public record so operators could find the right party. The presenter and audience wrestled with a difficult question: how to make a record harder to steal without making legitimate old holders surrender rights or accept obligations they had never agreed to.

In a separate category table, ARIN listed 45 legacy Class C records, 48 Class B, one Class A, four direct allocations and one reassignment. The case-status table separately reported outcomes. Old entries dominated Nobile's practical concern. A dormant or lightly maintained record could be a tempting opening. Staff still had to identify its legitimate holder through evidence beyond the label legacy.

The form of the attempted impersonation also matters. This was a registry-record problem: someone could seek to change who appeared authorized in WHOIS. Routing a prefix was a possible later move in Nobile's depicted chain. A network can be misled at the record layer before a route changes, and ARIN's presentation did not report a count of successful route announcements. The door that Nobile pointed to was the relationship between an authoritative looking record and the real person or organization entitled to update it.

ARIN's tools, and the tools still on the drawing board

The 2003 slides separated work under way from ideas for future action. ARIN said it had identified patterns used to uncover unauthorized changes, researched every case reported or discovered, documented and tracked cases, worked with law enforcement and other regional registries, and adjusted procedures. It had developed a new database status attribute that could lock down records. These were the operational measures Nobile said the organization was taking at the time.

The same presentation said ARIN sent only selected incidents to law enforcement and kept investigation details from general public disclosure. That boundary left the public with aggregate status numbers and a description of the mechanism, while individual investigations stayed inside a smaller circle. People in the meeting could debate the policy response using the case totals and attack-path diagram.

Other slides offered possible actions. ARIN could require more verification information, such as tax identifiers or raised-seal corporate papers; pursue legal options; revise its registration agreement; publish a historical WHOIS change log; use stronger validation software; validate WHOIS data periodically; or tighten authentication, authorization and accountability. A separate Registry of Legacy Resources was also floated, with choices about whether old records could be updated outside a regional registry or could receive validated name-server and contact changes for a fee.

The slides marked these options as possible actions; evidence of implementation would have to come from later records.

There is a design problem inside that menu. A change log could show how a contact name moved across a record, giving operators context for a suspicious claim. A lock could slow unauthorized edits. Stronger verification might block an impostor at the door. But a verification rule requiring a corporate seal fits a corporation much better than an individual who legitimately holds an old allocation. A separate legacy register might reduce the cost of maintaining inactive records or make the boundary visible; it could also change what old holders were allowed to update and who paid for that privilege.

Each remedy changes the path through which a person proves authority.

The argument after the slides

The meeting minutes preserve a lively response. One attendee worried that corporate documents and tax identifiers would be useless or intrusive for individual holders. Others saw a separate legacy registry as a way to reduce cross-subsidy between fee-paying members and older holders. A participant argued for a visible history of WHOIS changes so an ISP could judge whether a record deserved trust. Another wanted ARIN to talk to legacy holders before moving their records. A legacy holder objected to being newly charged without a contractual basis. The room asked whose proof, cost and consent a safer database would require.

That debate exposes the economic part of the hijack problem. Maintaining and validating contact data costs staff time, and the burden rises sharply when records are contested. An old address holder may have strong reasons to resist an imposed fee or a document requirement that did not exist when the block was issued. A network operator consulting WHOIS needs to know whether the listed contact is current and whether an apparent change has been checked. A registry could reduce one risk by tightening updates, then create another by making a rightful update prohibitively difficult.

The 2003 audience saw those tradeoffs in Nobile’s presentation and the ensuing debate.

Nobile's presence gave the discussion an operational center. She ran the department that issued resources, maintained registry and routing directories, administered reverse mapping DNS and answered registry help-desk requests, as ARIN later described in its 2004 annual report. The 2003 annual report records her hijacking presentation at the public meeting. She carried a case queue and an attack path into a policy forum that could argue about the authority to repair it.

A report that understood the real target

By the end of Nobile's presentation, the obvious security advice was to keep organization and resource records current and to use stronger authentication when available. That advice has a dry sound until one reads the diagram of expired domains, stale contacts and gradual edits. Every abandoned address on a contact record creates another place where a claimant can dress up as the rightful holder. Network operators and registry staff may act on what the record appears to say.

The 110-case queue made that danger measurable at ARIN's desk in 2003. The status breakdown made it honest. The possible remedies showed how many different powers a registry would have to exercise to protect the record: verify identity, lock edits, preserve history, coordinate investigations, alter agreements and decide what service an old holder could expect. Those are stronger interventions than correcting a typo in an address book. The meeting's argument over legacy rights and fees sat at the center of the security story.

Nobile's report leaves a useful image. The impostor did not need a convincing uniform if the registry's own directory could lend one. The people in the room were trying to decide how to take that uniform back without locking the real holder outside.