What is a subprefix hijack and how can RPKI help reduce this risk?

• A. Attack using a more-specific subprefix of a legitimate route; RPKI-origin validation reduces risk by constraining authorized origins (though subprefixes not covered by ROAs still require other controls).
• B. Subprefix hijack by encrypting subprefixes.
• C. Subprefix hijack is a method to increase route stability.
• D. RPKI cannot help with subprefix hijack.

Answer: (A)

A subprefix hijack is when someone announces a more-specific subprefix of a legitimate BGP route, taking advantage of the fact that many routers prefer longer (more specific) prefixes. This can divert traffic away from the rightful owner to the attacker.

RPKI helps reduce this risk through origin validation. Each ROA (Route Origin Authorization) ties an origin AS to a prefix with a maximum length. When a BGP route is received, validators check whether the announcing AS is authorized to originate that prefix and of what length. If the route is not authorized, or the subprefix length exceeds what the ROA allows, the route is marked not valid or is deprioritized/dropped by networks that implement strict validation. This makes it much harder for someone to use a more-specific subprefix to attract traffic, because unauthorized origins and subprefixes won't be trusted.

However, if the subprefix is not covered by any ROA, or the ROA from a parent prefix allows the more-specific subprefix (via a large maxLength), RPKI won't prevent the hijack. In those cases, additional controls like prefix filtering and broader operational practices are needed to mitigate the risk.