The primary underlying vulnerability in BGP that we address in this paper is the ability of an AS to create invalid routes. There are two types of invalid routes:
Invalid routes in the Control plane: This occurs when an AS propagates an advertisement with a fake AS path (i.e., one that does not exist in the Internet topology), causing other AS's to choose this route over genuine routes. A single malicious adversary can divert traffic to pass through it and then cause havoc by, for example, dropping packets (rendering destinations unreachable), eavesdropping (violating privacy), or impersonating end-hosts within the destination network (like Web servers etc.).
Invalid routes in the Data Plane: This occurs when a router
forwards packets in a manner inconsistent with the routing advertisements
it has received or propagated; in short, the routing path in the
data plane does not match the corresponding routing path advertised in
the control plane. Mao et al. [26] show that for nearly 
of
Internet paths, the control plane and data plane paths do not match.
Two primary sources of invalid routes are misconfigurations and deliberate attacks. While these are the only sources of invalid routes in the control plane, data plane invalidity can occur additionally due to genuine reasons (e.g. intra/inter-domain routing dynamics [26]). The fact that a sizable fraction of Internet routes are invalid in the data plane motivates the need for separately verifying the correctness of routes in the data plane and not merely focusing on the control plane. Prior works on securing BGP focus primarily on the control plane.
Misconfigurations occur in several forms ranging from buggy
configuration scripts to human errors. In the control plane, Mahajan
et al. [25] infer that misconfigurations produce invalid
route announcements to roughly 
prefixes every day (roughly
of the prefix entries in a typical routing table). Stale
routes (not propagating new announcements) and forwarding errors at a
router (e.g., lack of forwarding entry) are two other data plane
misconfigurations causing invalid routes.
While AS's might act in malicious ways on their own, the biggest worry
about deliberate attacks comes from adversaries who break into
routers. Routers are surprisingly vulnerable; some have default
passwords [10,33], others use standard
interfaces like telnet and SSH, and so routers share all their known
vulnerabilities. For our purposes in this paper, the only difference
between a misconfiguration and an attack is that attackers can take
active countermeasures (by, for instance, spoofing responses to
various probes) while misconfigured routers don't.
Deliberate attacks can involve an isolated adversary (i.e., a
single compromised router) or colluding adversaries (i.e., a set
of compromised routers). Colluding adversaries have the additional
ability to tunnel route advertisements and fake additional links
in the topology.
The spectrum of problems we address in this paper can be described, in order of increasing difficulty, as misconfigurations, isolated adversaries and colluding adversaries. We now describe the extent to which Listen and Whisper provide protection against these threats.