Taking down a network with a TLS certificate: my RIPE NCC RPKI exploit chain
A security researcher discovered an exploit chain that could disconnect a network from the internet by compromising routing authorizations via a malicious link. The attack leverages XSS vulnerabilities, a shared session cookie, and lack of CSRF protection in RIPE NCC systems to manipulate RPKI and the RIPE Database. Although the vulnerabilities have been fixed, the exploit could have allowed attackers to silently disrupt connectivity for hours or enable route hijacking.
- ▪The exploit chain uses a malicious link to RIPE Atlas, which appears legitimate and can trigger an attack if clicked by a logged-in user.
- ▪By exploiting XSS vulnerabilities and missing CSRF protections, an attacker can modify RPKI Route Origin Authorisations to block a network's traffic.
- ▪Compromising the RIPE Database allows hijacking of network objects, locking out legitimate owners until manual intervention by RIPE NCC staff.
- ▪RPKI is trusted globally to validate internet routing, but its reliance on web interfaces introduces critical security risks if not properly secured.
- ▪The researcher responsibly disclosed the vulnerabilities after a 14-month process, and all issues have since been fixed.
Hacker News (Newest) files mainly under programming. We currently carry 5,306 of its stories.
Story provenance
Source · retrieval · rights · ranking — open for full record
inspect →
Story provenance
Attribution is not the same as permission. This drawer separates discovery metadata, excerpts, WeSearch-generated summaries, reuse status, and whether the publisher receives the visit. Nothing here claims a legal grant the publisher has not made.
Record
| Original publisher | Mxsasha |
| Canonical URL | https://mxsasha.eu/posts/ripe-ncc-rpki-exploit-chain/ |
| Publication time | Wed, 29 Apr 2026 09:23:46 +0000 |
| Retrieval time | 2026-04-29T09:36:54.536Z |
| Last seen | 2026-04-29T09:36:54.536Z |
| Headline source | Publisher (no WeSearch rewrite) |
| Excerpt source | publisher body |
| Excerpt method | First ~120 words (~800 chars) of extracted publisher body, fair-use limited. |
| Summary | WeSearch · cerebras-chat (WeSearch summarizer) |
| Summary source text | contentText |
| Citation coverage | Summary is a WeSearch-generated derivative; primary citation is the original publisher URL. |
| Cluster | c9L1WhIt33oW |
| Cluster logic | Grouped by semantic title/content similarity across sources within a rolling window. Same-publisher template collisions are excluded from coverage comparison. |
| Ranking reason | Story pages are not engagement-ranked. Hub feeds use recency, with optional source-diversified chronological ordering (cap consecutive stories per source). No personalized ranking. |
| Publisher visit | Yes — open original |
| Substitutes article? | No — link-out required for full text |
Rights status (four layers)
WeSearch handling by dimension
| Indexing | May the item be indexed (stored, ranked, made findable)? | Allowed |
| Snippet | May a short excerpt of the publisher's text be shown? | Allowed |
| AI summary | May WeSearch generate its own short summary of the article? | Limited |
| Retrieval / RAG | May the content be exposed for third-party retrieval-augmented generation? | Not asserted |
| Model training | May the content be used to train AI models? | Not asserted |
| Commercial reuse | May the content be reused commercially? | Not permitted |
Basis: Derived from the published RSS/Atom feed. Contact: [email protected]. Reviewed: 2026-07-24.
Opening excerpt (first ~120 words) tap to expand
Taking down a European network with a TLS certificate: my RIPE NCC RPKI exploit chainApril 29, 2026One click on a malicious, but not suspicious, link. That is all it could take for a network operator to get disconnected from the internet, through a chain of vulnerabilities I discovered. From that single click, I could fully control their routing authorisations in a RIPE NCC portal, telling the rest of the internet not to accept their routes. I could also hijack all their RIPE Database objects, locking the legitimate owners out until RIPE NCC staff manually restore them.This attack chain comes down to surprising entry points, risky architectural decisions, and components that don’t look security-critical until they are.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at Mxsasha.
Discussion
0 commentsMore from Mxsasha
