Hi Hi @BAZ
This is really a very good practical question and my solution was given blow.
The Border Gateway Protocol is the default routing protocol used by routers to communicate with other routers about the best way to reach Internet domains. Organizations publish information about the fastest—most efficient—route to take to reach their network, and routers use BGP to find this information. If something goes wrong along that route, the router can publish alternate information so that traffic flow is not disrupted.
BGP was written under the assumption that no one would lie about the routes, so there’s no process for verifying the published announcements. If someone publishes incorrect route information, routers move traffic along that route. Users don’t know they are being sent to the wrong server, or that their information passed through hostile networks (or countries) that can eavesdrop on their activities.
BGP is fairly noisy, and configuration mistakes happen pretty regularly, with the correct information published within minutes. This makes it difficult to tell when announcements are malicious and when they aren’t.
For users, just the fact that they used an affected DNS resolver would have exposed them to this attack. One good thing is that the increased use of HTTPS and the fact that browsers now warn users when a certificate is signed by an unknown authority or if one is missing means users may be able to avoid becoming victims even if they get rerouted to suspicious sites.
If you were using HTTPS, the fake website would display a TLS certificate signed by an unknown authority (the domain listed in the certificate was correct but it was self-signed). The only way for this attack to work would be to continue and accept the wrong certificate. From that point on, everything you send would be encrypted but the attacker had the keys.
Furthermore, Anyone who paid attention to the browser alert would have known something weird was happening and would have been able to back out. This attack highlights why it is so important to train users to heed the certificate warnings. Too many times, users are told to ignore warnings because the certificate expired or because it was a self-signed cert.
I hope my answer will help you.
Thanks
