DDoS Vulnerability Analysis of BitTorrent Protocol CS239 project Spring 2006

Background BitTorrent (BT)  P2P file sharing protocol  30% of Internet traffic  top 10 scanned port in the Internet DDoS  Distributed – hard to guard against by simply filtering at upstream routers  Application level (resources)  Network level (bandwidth)

How BT works.torrent file (meta-data)  Information of files being shared  Hashes of pieces of files Trackers (coordinator)  http, udp trackers  Trackerless (DHT) BT clients (participants)  Azureus  BitComet  uTorrent  etc. Online forum (exchange medium)  For user to announce and search for.torrent files

Communication with trackers Tracker seeder clients client.torrent I have the file! Who has the file? Discussion forum Who has the file?

Message exchange HTTP/UDP tracker  Get peer + announce combined (who is sharing files)  Scrapping (information lookup) DHT (trackerless)  Ping/response (announcing participation in DHT network)  Find node (location peers in DHT network)  Get peer (locate who is sharing files)  Announce (announce who is sharing files)

Vulnerabilities Spoofed information  * Both http and udp trackers allow specified IP in announce  DHT does not allow specified IP in announce Allow spoofed information on who is participating in DHT network Possible to redirect a lot of DHT query to a victim Compromised tracker

Attack illustration Tracker victim clients attacker Victim has the files! Discussion forum Who has the files?.torrent

Experiments Discussion forum (  1191 newly uploaded.torrent files in 2 days Victim ( )  Apache web server (configured to serve 400 clients)  tcpdump, netstat Attacker  Python script to process.torrent files and contact trackers Zombies  Computers running BitTorrent clients in the Internet

Statistics Total1191 Corrupted6 Single tracker999 Multiple trackers186 Support DHT121 http trackers1963 udp trackers85 Unique http trackers311 Unique udp trackers21 Torrents Trackers

Measurements (1) Attacker  1191 torrent files used  30 concurrent threads, contact trackers once

Measurements (2) Attacker  1191 torrent files used  40 concurrent threads, contact trackers 10 times  Attack ends after 8 hours

Measurements (3) distinct IPs recorded Number of connection attempts per host  Retry 3,6,9,… seems a common implementation

Measurement (abnormal behavior) o Top 15 hosts with highest number of connection attempts o Country: SINGAPORE (SG) o Country: UNITED STATES (US) o Country: (Unknown Country?) (XX) o Country: UNITED STATES (US) o Country: UNITED KINGDOM (UK) o Country: UNITED KINGDOM (UK) o Country: ICELAND (IS) o Country: UNITED KINGDOM (UK) o Country: HONG KONG (HK) o Country: UNITED KINGDOM (UK) o Country: UNITED KINGDOM (UK) o Country: CANADA (CA) o Country: FINLAND (FI) o Country: UNITED STATES (US) o Country: CANADA (CA) o Content pollution agents? o Other researchers?

Top 15 countries United States Canada United Kingdom Germany France Spain Australia Sweden Netherlands Malaysia Norway Poland Japan Brazil China

Countries with less BT clients running Albania Bermuda Bolivia Georgia Ghana Kenya Lao Lebanon Monaco Mongolia Nicaragua Nigeria Qatar Tanzania Uganda Zimbabwe

Solution Better tracker implementation Authentication with trackers  Similar to the one used in DHT Filtering packets by analyzing the protocol  e.g. check [SYN|ACK|80] incoming packets for legitimate HTTP header

End Q and A

Tracker seeder client.torrent I have the file! Who has the file? Discussion forum

Tracker victim clients attacker Victim has the files! Discussion forum Who has the files?.torrent