BGP hijacking
BGP runs largely on trust: when a network advertises "I can reach prefix P," its neighbours mostly believe it. BGP hijacking abuses that trust. It happens when an autonomous system advertises IP prefixes it does not actually own (or a more specific piece of someone else's prefix), and other networks accept the false route and start sending the victim's traffic to the attacker. Imagine someone putting up a fake road sign for your town's address — and drivers obediently following it into a dead end or an ambush.
It works because of two facts. First, BGP has no built-in proof of ownership: routers historically accept prefix announcements at face value. Second, routers prefer a more specific route. So if a victim owns 203.0.113.0/24 and an attacker announces 203.0.113.0/25 (a smaller, more specific half), longest-prefix match means many routers will route that traffic to the attacker instead — even where the victim's own correct announcement is still present. The hijacked traffic can then be black-holed (dropped, causing an outage), eavesdropped or tampered with (man-in-the-middle), or used to impersonate services. Famous incidents have knocked sites offline globally and rerouted cryptocurrency traffic to steal funds.
Sometimes a hijack is malicious; just as often it is an accident — a fat-fingered configuration or a route leak that escapes a network's borders. The main defences are authentication systems bolted onto a protocol that originally had none: the Resource Public Key Infrastructure (RPKI) lets a prefix owner cryptographically state which AS is allowed to originate it (a Route Origin Authorization), and Route Origin Validation lets routers reject announcements that don't match. These help against origin hijacks, but BGP security is still a work in progress — RPKI does not validate the whole AS path, and adoption, while rising, is far from universal.
A victim correctly announces 203.0.113.0/24. An attacker's AS announces 203.0.113.0/25 and 203.0.113.128/25 — two more-specific halves. Because routers prefer the longest prefix match, traffic for those addresses worldwide flows to the attacker, even though the victim's /24 is still being announced. With RPKI/ROV deployed, neighbours would see the attacker's AS is not the authorized origin and drop the bogus announcements.
Announcing a more-specific prefix you don't own diverts traffic via longest-prefix match; RPKI/ROV is the main defence.
Hijacks are often accidents (route leaks, typos), not attacks — and RPKI only validates the route's ORIGIN, not the whole AS path, so it is a partial, not complete, fix for BGP's trust problem.