Just saw this:

https://www.virtualizor.com/blog/security-incident-bgp-hijacking/

Real BGP Hijack against Hetzner where the attackers managed to issue real Let’s Encrypt certificates despite the CA checking from multiple vantage points across different RIRs and ASNs.

The prefix had ROA, so the attackers spoofed the origin to use Hetzner’s AS.

The ROA was up to /24, Hetzner only advertised the /16. The moment the attackers advertised the spoofed /24 with a longer path they attracted 100% of the traffic. 

Traffic went back to Hetzner within 20’ of them announcing this specific /24 and competing with the hijackers.

If that ROA was just for the /16 I bet this wouldn’t have happened, and I’m almost certain Let’s Encrypt would not have issued that certificate. 

Antonis

On 26 Aug 2026, at 16:13, Tim Bruijnzeels <tbruijnzeels@ripe.net> wrote:

Hi all,

To clarify:

On 26 Aug 2026, at 14:52, Havard Eidnes via routing-wg <routing-wg@ripe.net> wrote:

I'll have to admit that I've not looked too closely under the

covers, but to my mind, if I originate 192.168.0.0/16 into the

routing system, and do not want to authorize any longer routes in

this address space than this /16, do I not then use the maxLength

attribute to say "16"?  That's certainly what it looks like to me

through the RIPE NCC RPKI ROA issuance assistant..

The RIPE NCC RPKI Dashboard expects and explicit max length that
defaults to the actual prefix length. This is essentially done this
way to keep the UI simple. It forces the user to make an explicit
choice (go with the default or change it).

On the encoded ROA object the max length is omitted if it matches
the prefix length.

Kind regards,

Tim Bruijnzeels
Principal Engineer RPKI
RIPE NCC

-----
To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/routing-wg.ripe.net/
As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings.
More details at: https://www.ripe.net/membership/mail/mailman-3-migration/

-----
To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/routing-wg.ripe.net/
As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings.
More details at: https://www.ripe.net/membership/mail/mailman-3-migration/