The Threat Landscape of IP Leasing in the RPKI Era

Short-term IPv4 leasing is on the rise, allowing address owners (lessors) to rent out spare address blocks to lessees who rely on them for critical operations. Yet under existing RPKI practices, the lessor remains the recognized authority, retaining full control over the ROAs needed to validate BGP announcements.

This paper uncovers how such arrangements fundamentally clash with the assumptions of route origin validation: even after leasing out an address block, the lessor can unilaterally invalidate the lessee's announcements, causing RPKI-enforcing ASes to drop or redirect traffic. We show that a malicious lessor can leverage RPKI to covertly hijack a leased prefix by feeding "lease-compliant" ROAs to select relying parties while presenting "rogue" ROAs to the rest of the Internet.

Through experiments on two major cloud platforms and the PEERING testbed, spanning multiple continents, we confirm that these attacks can reroute leased-prefix traffic with little visibility to the lessee or standard monitoring tools. We further illustrate scenarios in which a rogue lessor intercepts TLS certificate validation or executes region-specific hijacks, highlighting the severity of such threats. Finally, we propose practical mitigations, including multi-RP ROA verification, delegating ROA authority to neutral brokers, and adopting partial delegation in RIR portals.

By exposing the interplay between IP leasing and RPKI, we aim to spur both policy reforms and technical advancements that strengthen routing security in the face of ever-growing address shortages.