1 Denial-of-Service Resilience in P2P File Sharing Systems Dan Dumitriu (EPFL) Ed Knightly (Rice) Aleksandar Kuzmanovic (Northwestern) Ion Stoica (Berkeley) Willy Zwaenepoel (EPFL)

2 The Myth P2P systems are very robust! They are very tolerant of random failures They are tolerant of node churn

3 Our Findings P2P file sharing systems are very vulnerable in the face of coordinated attack However, resources required to mount a successful attack are large

4 DoS Attacks Goals of DoS Prevent successful downloads i.e. reduce goodput to near zero Two classes considered File targeted Already in use! Affects any P2P network, including Bittorrent We developed Network targeted attack Targets P2P networks using flooding search

5 Outline Methodology File Attack Network Attack Defenses Against Network Attack Conclusions

6 Methodology Analytical modeling Discrete-time Simulation Discrete Event simulation Gnutella simulator Structella simulator Metrics Percent of good files in the system P(good reply), i.e. % of replies not tampered with Goodput

7 User Model Two phase user-system interaction Query User sends query for particular file Responses are received and stored User waits for a certain amount of time Download One or more responses are selected based on policy Downloads are initiated Closed loop

8 Outline Methodology File Attacks Network Attacks Defenses Against Network Attacks Conclusions

9 File-targeted Attacks Attacker offers fake content, for a specific file Content must have a valid checksum & header Detection of fake content must be “slow” Attacker needs to “get in early” Unwitting users offer false content and thus it spreads

10 Interesting Questions What is the impact on rate of spread of good files? What is the impact of “freeloaders”? What is the impact of the “user persistence” factor?

11 Spreading Corruption Fraction of Nodes With File

12 Persistence and Freeloading Here it is! Fraction of Nodes With File

13 Cost of File-targeted Attack Attacker needs to serve 10% of downloads of a file Real cost could be significant If files are very popular If attacker wants to pollute many files Cost is per file! Can we do better? Can we take down the entire P2P network?

14 Outline Methodology File Attacks Network Attacks Defenses Against Network Attacks Conclusions

15 Network-targeted Attacks Objective is to serve fake content and waste system’s bandwidth Compromises the search mechanism Affects entire P2P network and all files Intercept replies being routed to requesting peer Replies already have correct filename and checksum Modify replies to redirect downloader “False Reply” attack redirects to attacker node which serves false content, with good checksum and header Advertise fast downloads

16 Goodput Under Attack

17 Interesting Questions What is the impact of network diameter? What is the impact of “SuperNodes”? What is the impact of graph topology? What is the impact of “desired anonymity”? What is the impact of the type of routing overlay?

18 Path Length

19 SuperNodes

20 Power Law

21 Overlay Network

22 Overlay Network - Goodput

23 Outline Methodology File Attacks Network Attacks Defenses Against Network Attacks Conclusions

24 Client Counter-Strategies Clients can defend themselves? Modify reply selection policy! How well can they do given: Redundant downloads? Randomized selection? Reputation systems?

25 Randomization

26 Redundancy

27 Reputation System

28 Cost of Network Attacks Attacker only needs to compromise ~2.5% of supernodes in a network Cost is still significant, but not unmanageable If P2P system has 4 million nodes attacker needs ~10000 nodes Attacker’s nodes can be “virtual” Attacker nodes must be “well connected”

29 Outline Methodology File Attacks Network Attacks Defenses Against Network Attacks Conclusions

30 Conclusions P2P Systems are vulnerable! File attacks work! Network Attack is devastating, but considerable resources are required Structured overlay helps, somewhat Reputation systems do little to alleviate the situation User behavior is a major influence Users may trade off between goodput without attack and attack effectiveness

31 Thank You!

32 Extra slides…

33 Relationship Depends on client selection strategy “Best” select Random select Redundant select

34 Relationship

35 Freeloaders

36 Gnutella search mechanism A Steps: Node 2 initiates search for file A

37 Gnutella search mechanism A Steps: Node 2 initiates search for file A Sends message to all neighbors A A

38 Gnutella search mechanism A Steps: Node 2 initiates search for file A Sends message to all neighbors Neighbors forward message A A A

39 Gnutella search mechanism Steps: Node 2 initiates search for file A Sends message to all neighbors Neighbors forward message Nodes that have file A initiate a reply message A:5 A A:7 A A

40 Gnutella search mechanism Steps: Node 2 initiates search for file A Sends message to all neighbors Neighbors forward message Nodes that have file A initiate a reply message Query reply message is back- propagated A:5 A:7 A A

41 Gnutella search mechanism Steps: Node 2 initiates search for file A Sends message to all neighbors Neighbors forward message Nodes that have file A initiate a reply message Query reply message is back- propagated A:5 A:7

42 Gnutella search mechanism Steps: Node 2 initiates search for file A Sends message to all neighbors Neighbors forward message Nodes that have file A initiate a reply message Query reply message is back- propagated File download directly download A

43 Redundancy

44 What are P2P systems? Search Centralized Napster Distributed Gnutella, Kazaa, Overnet, etc. Bittorrent Download Single source Multiple source Bittorrent

45 Conclusions Attack depends on freeloading being common Attack depends on users giving up, not being very persistent If all good users are cooperative, i.e. share files, attack does not scale Bittorrent is susceptible It is already happening!

46 “Slow Node” attack redirects to “very slow” node which has the file