The "Pakistan vs. YouTube" Incident
A BGP Hijack occurs when an Autonomous System (AS) — a network under a single administrative domain, identified by a unique ASN (Autonomous System Number) — advertises a prefix (an IP address block) that it does not actually own. Because BGP generally prefers the most specific route (the smallest subnet, i.e., the largest prefix length), a hijacker can win the routing decision even against the legitimate owner.
The Classic Example — Pakistan Telecom, 2008:
- Pakistan Telecom wanted to block YouTube within Pakistan. They created a "blackhole" route for YouTube's IP range
208.65.153.0/24. - The Mistake: They accidentally advertised this route to the global internet via their upstream provider, PCCW (a major Hong Kong carrier).
- The Hijack: Pakistan Telecom's route was slightly more specific than YouTube's own advertisement. BGP's longest-prefix-match rule caused routers worldwide — including in the US and Europe — to update their routing tables to point at Pakistan Telecom.
- The Result: Global traffic destined for YouTube was routed into Pakistan Telecom's network. Their infrastructure was immediately overwhelmed. YouTube was unreachable worldwide for approximately two hours.
This was an accident. The same mechanism, used deliberately, is a powerful attack vector. An attacker who announces a more specific prefix for a bank's IP range can silently intercept all traffic to that bank — including HTTPS sessions if they can also perform a TLS downgrade.
Why BGP Cannot Stop This Alone:
BGP has no built-in mechanism to verify that the AS announcing a prefix actually has the right to do so. It is a routing protocol, not an authentication protocol. Every router in the path simply trusts the announcement it receives from its neighbor.
Interviewers frequently ask: "Why can't BGP just verify route ownership itself?" The answer is architectural: BGP was designed for reachability and policy, not authentication. Adding cryptographic verification to the BGP protocol itself would require replacing every router simultaneously — an impossible coordination problem. Instead, RPKI operates as an out-of-band validation layer that routers consult independently, leaving the BGP wire protocol unchanged.