Looking-glasses are web applications commonly deployed by Autonomous Systems to offer restricted web access to their routing infrastructure, in order to ease remote debugging of connectivity issues. In our study, we looked at existing deployments and open-source code to assess the security of this critical software. As a result, we found several flaws and misconfigurations that can be exploited to escalate from a web attack to a remote command execution on backbone routers.
This paper summarises the results of our study, and shows how even an attacker with very limited resources can exploit such flaws in operators’ networks and gain access to core Internet infrastructure. Depending on systems configuration, these attacks may result in traffic disruption and global BGP routes injection, with severe implications for the security of the Internet.