1. Having Fun with P2P Keith W. Ross Polytechnic University http://cis.poly.edu/~ross

2. Many Apps Migrating Client-Server to P2P File sharing File and patch distribution Live video streaming Video on demand VoIP Hybrid CDN/P2P

3. Today’s Talk P2P security –Is BitTorrent Unstoppable? Survey of P2P video streaming research –Creating an open P2P video streaming ecosystem Research supported by: NSF, Microsoft, Movie Labs, Huawei, Verizon, Panasonic, Len Shustek

4. Why study P2P Security? P2P is potentially more vulnerable than client server. Need to understand the security issues for architecting future P2P apps Attacks from entertainment industry reveal weak spots in P2P

5. Security work joint with: Jian Liang Rakesh Kumar Prithula Dhungel Di Wu Naoum Naoumov Xiaojun Hei

6. Earlier work on Kazaa and eDonkey FastTrack/Kazaa –Unstructured P2P network Overnet/Kad –Structured (DHT) P2P network –Part of eDonkey/eMule

7. File Pollution: Infocom 05 pollution company polluted content original content

8. File Pollution pollution company pollution server pollution server pollution server pollution server file sharing network

9. File Pollution Unsuspecting users spread pollution !

10. File Pollution Unsuspecting users spread pollution ! Yuck

11. Index Poisoning: Infocom 06 index title location bigparty 123.12.7.98 smallfun 23.123.78.6 heyhey 234.8.89.20 file sharing network 123.12.7.98 23.123.78.6 234.8.89.20

12. Index Poisoning index title location bigparty 123.12.7.98 smallfun 23.123.78.6 heyhey 234.8.89.20 123.12.7.98 23.123.78.6 234.8.89.20 index title location bigparty 123.12.7.98 smallfun 23.123.78.6 heyhey 234.8.89.20 bighit 111.22.22.22 111.22.22.22

16. FastTrack Copies

17. Overnet Copies

18. Is BitTorrent Unstoppable? (IPTPS 2008; extended version available) How can record/movie companies limit piracy in BitTorrent? –Suing companies? –Suing users? –Internet attacks? How vulnerable is BitTorrent to attacks?

19. BitTorrent tracker: tracks peers in torrent; provides tracker list torrent: group of peers exchanging chunks of a file trading chunks peer torrent index server: search for torrents; provides.torrent file

20. BitTorrent Ecosystem Open protocol –50+ client implementations –Dozens of tracker implementations –Dozens of torrent location sites 5 million simultaneous users & growing Evolving: –Peer discovery: DHTs, gossiping –Proprietary protocols, private torrents

21. BitTorrent Basics Seeds and leechers File divided into 256KB pieces. Each piece is 16 blocks. –Download blocks and assemble pieces –Hash piece to check integrity Peers advertise pieces they have to neighbors Peer sends blocks to four neighbors currently sending it data at the highest rate And also to one random neighbor

22. Classes of BitTorrent Attacks Attacks against an existing torrent – against leechers – against initial seed – against peer discovery – against peer discover Decoy attacks: attacker creates own torrent –Seeding a polluted file –Seeding a file and delivering only 99%

23. Fake Block Attack Attacker establishes TCP connections with legitimate peers Peer downloads one fake block from attacker –and 15 good blocks from legit peers –Hash failure – download is prolonged Acknowledgment: Thanks to Vishal Misra for bringing this attack to our attention.

24. Simple analysis of fake block attack What is the probability of a hash failure? n = # neighbors advertising piece m = attack nodes (m < n) k = # neighbors from which it is downloading the 16 blocks

25. Probability of a clean piece 70% failure requires 20% attack neighbors γ increases for rare pieces and in end game

26. Connection attack Attacker establishes many TCP connections to each target peer. –Doesn’t upload any blocks –Chatty peer: keeps connection active with repeated BT handshake messages

27. Passive Measurements Collect traces while downloading –Azureus and uTorrent –DSL and Ethernet –54 downloads of “Foo Fighters” (108 MB) Developed parser to analyze BT trace To estimate download time without attack: –Obtain blacklist from torrentfreak.com –Use Peer Guardian to prevent connections to blacklisted peers

28. Azureus results Download is NOT being prolonged by more than 50% for DSL

29. Zoom in one Azureus trace Chatty-peers make up a major fraction of the useful peers.

30. Handshake messages sent by chatty peers

31. uTorrent

32. Zoom in on uTorrent trace

33. Passive Measurement Conclusions Anti-P2P companies applying different strategies for different BT clients Largely ineffective for Ethernet clients For DSL, download time increases by 30-60%

34. Active Measurements Crawl peers in torrent and identify –Fake-block attack peers –Chatty peers Looked at 8 box-office movie torrents –Some under attack; some not Crawler speaks Azureus protocol to Azureus peers –and conventional protocol to all other peers

35. Active Measurement Conclusions Several, but not all, top-box movies are under attack Published blacklists do not cover all the attackers in a torrent Most attackers enter through gossiping

36. Seed Attack “Nip in the bud” Make many connections to seed, download at high rate Rationale: Conventional algo gives all its bandwidth to 5 highest downloaders

37. Planet Lab experiments Put 30 leechers on PL nodes; upload capacity capped at 512 kbps Seed upload capacity 160 kbps –Azureus and uTorrent 0-60 attack peers Start seed, start 5 leechers, start attack peers, start 25 leechers

38. Seed attack results delayattacker bandwidth

39. BitTorrent Conclusions Attacks against leechers can prolong downloads –But is 50% enough? –Blacklists are helpful; adaptive blacklist is needed Seed is surprisingly resilient to attacks Attacks must be tailored to client types BitTorrent ecosystem is difficult to stop!

40. Today’s Talk P2P security –Is BitTorrent Unstoppable? Survey of P2P video streaming research –Creating an open P2P video streaming ecosystem Research supported by: NSF, Microsoft, Movie Labs, Huawei, Verizon, Panasonic, Len Shustek

41. Live Streaming: Faculty Collaborators Professor Yong Liu Professor Yao Wang Professor Shiv Panwar and Professor Nitsesh Saxena (CS)

42. obtain list of peers trade chunks tracker peer Basic idea P2P live streaming Source of video

44. PPLive: Chinese New Year 2006

45. @ Polytechnic Infrastructure for measuring P2P live video systems –Xiaojun Hei, Jian Liang, Yong Liu Stochastic modeling of P2P live streaming –Rakesh Kumar, Yong Liu Incentives and scalable video for live P2P streaming –Zhengye Liu, Yanming Shen, Shiv Panwar, Yao Wang Security of P2P live streaming systems –Prithula Dhungel, Xiaojun Hei, Nitesh Saxena P2P VoD, Hybrid P2P-CDN –Angela Wang, MSR colleagues Developing our own live P2P video system –Master’s students

46. Open P2P Live Streaming Create an ecosystem for live streaming Need incentives –The more you upload the better the quality Layered video –Chunk-based –Substream-based Accommodate user generated content

47. Thank You !