What improvements are in the works to mitigate the effect of these sort of hijacks?
I happen to have published research in this area[0]. There are two systems being developed to secure BGP.
The first is the RPKI which aims to provide a Public Key Infrastructure to attest to the origination of IP addresses. To grossly oversimplify it: everyone would get a certificate that says "AS X is allowed to originate IP prefix Y". Many routers already support the RPKI[1] and the RPKI is currently undergoing deployment[2], but it should take some time before operators begin using it to make routing decisions. Once used the RPKI offers substantial security benefits[3].
The second protocol is BGPSEC which is designed secure routing paths. It will use the RPKI as its foundation.
Comments
I happen to have published research in this area[0]. There are two systems being developed to secure BGP.
The first is the RPKI which aims to provide a Public Key Infrastructure to attest to the origination of IP addresses. To grossly oversimplify it: everyone would get a certificate that says "AS X is allowed to originate IP prefix Y". Many routers already support the RPKI[1] and the RPKI is currently undergoing deployment[2], but it should take some time before operators begin using it to make routing decisions. Once used the RPKI offers substantial security benefits[3].
The second protocol is BGPSEC which is designed secure routing paths. It will use the RPKI as its foundation.
[0]: https://www.cs.bu.edu/~goldbe/papers/sigRPKI.pdf
[1]: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp...
[2]: http://rpki-monitor.antd.nist.gov/
[3]: http://arxiv.org/pdf/1307.2690v1.pdf
And presumably the only organisation issuing the certs will be the organisation issuing IP space, right? RIGHT?... Guys?