Transcript Document
BotTorrent: Misusing BitTorrent to Launch DDoS Attacks Karim El Defrawy, Minas Gjoka, Athina Markopoulou UC Irvine
Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks?
o Summary
Introduction o In 2006, 60% of Internet traffic was due to peer-to-peer (P2P) protocols (Cache Logic) o BitTorrent is more than 35% by end of 2006 (Cache Logic) o Mininova torrent search engine hit 2 billion downloads (Mininova - June 13 th 2007)
P2P traffic is rising
BitTorrent is responsible for a significant amount of P2P traffic
P2P based DDoS attacks recently observed o announced on May 14 th 2007 observing an increase in P2P based DDoS attacks o Attack based on the direct connect (DC) P2P system o Attack involved over 300 000 IPs o http://www.prolexic.com/news/20070514-alert.php
P2P based DDoS attacks recently observed o announced on May 14 th 2007 observing an increase in P2P based DDoS attacks o Attack based on the direct connect (DC) P2P system o Attack involved over 300 000 IPs o http://www.prolexic.com/news/20070514-alert.php
P2P DDoS is already happening !
Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks?
o Summary
How BitTorrent works?
- User publishes torrents - Set up a tracker to coordinate the download
How BitTorrent works?
- User publishes torrents - Set up a tracker to coordinate the download 1- Users download torrents
How BitTorrent works?
- User publishes torrents - Set up a tracker to coordinate the download 1- Users download torrents 2 Users’ clients contact tracker to join swarm and get list of peers in swarm
How BitTorrent works?
- User publishes torrents - Set up a tracker to coordinate the download 1- Users download torrents 2 Users’ clients contact tracker to join swarm and get list of peers in swarm 3- Download different parts of file from different peers
Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks?
o Summary
Different attacks
Entity Faked
Report Fake Peer Report Fake Tracker Report Fake Peer
BT Mode
Centralized Tracker Mode Centralized Tracker Mode DHT Mode
Requirements
Send a spoofed message to tracker announcing victim as peer Publish torrents pointing to victim as a tracker (multi-tracker) Send fake BT PING message to DHT network spoofing source address of victim
Different attacks
Entity Faked
Report Fake Peer Report Fake Tracker Report Fake Peer
BT Mode
Centralized Tracker Mode Centralized Tracker Mode DHT Mode
Requirements
Send a spoofed message to tracker announcing victim as peer Publish torrents pointing to victim as a tracker (multi-tracker) Send fake BT PING message to DHT network spoofing source address of victim
How an attack faking tracker works?
- Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents
How an attack faking tracker works?
- Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents 1- Users download torrents with fake trackers pointing to victim
How an attack faking tracker works?
- Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents 1- Users download torrents with fake trackers pointing to victim 2- Clients contact victim in hope of starting the download
How an attack faking tracker works?
- Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents 1- Users download torrents with fake trackers pointing to victim 2- Clients contact victim in hope of starting the download ….
Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks?
o Summary
Experiment Setup o Victim machine: Pentium 2, 512 Mbps RAM, Debian Linux, 100Mbps Ethernet, running a light HTTP server o Modified tracker reports a fake (high) number of seeders and leechers to search engine o Publish fake torrents on search engines o Wait ….
Proof of concept attack results
Exp. # # Torrents Ports Attacked Open (Freq) Closed
I II III IV 25 10 25 25 1 (1) 1 (10) 1 (1) 6 10 501 1 (50) + 1 (1) 49+201
Throughput (Kbps) Avg a Max a Total Unique # Hosts TCP Conn. Avg/sec New Host Interarrival Time (sec)
62.77
137.78
132.97
176.69
127.2
25331 520.4
55127 380.3
86320 482.8
58046 753.93
1400.74
1580.88
1440.17
7.89
3.62
2.31
3.44
a Excluding the initial transient period (6 hours) of the experiment
Number of TCP connections per second
Attack throughput
Amount of traffic from clients
Distribution of sources in the IP address space
Mapping attack sources to ASs and BGP prefixes o Attack sources in 2433 ASs on the Internet o Attack sources in 12424 announced BGP prefixes
Attack ports
Related Work o Attack using Overnet : poison around 7000 files to be effective (Naoumov - 2006) o Attack faking client: poison swarms of 1119 torrents to generate several thousand TCP connections (Cheung Sia - 2006) o Attack faking tracker is more effective: tracker is a central point in the architecture
Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks?
o Summary
Reporting the problem We contacted: o BitTorrent and Bram Cohen o Search Engines: Mininova, Pirate Bay, BitTorrent Monster o Clients developers: Azureus, Bitcomet o Prolexic o Response from Azureus developers only
Solutions o Handshake between clients and trackers similar to the one between clients.
o Clients exchange view of trackers similar to exchanging view of peers. o Mechanism to identify and trace the seeders of the fake torrents (based on hashes).
Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks?
o Summary
Summary o Presented misusing BitTorrent to launch DDoS attacks o Proof of concept attack implementation o Analyzed characteristics of the attack o Proposed fixes to BitTorrent to detect and prevent such attacks o Currently implementing fixes
Questions ?
Thank you!
Distribution of IPs on BGP Prefixes 0.014
0.012
0.01
0.008
0.006
0.004
0.002
0 10 0 10 1 10 2 10 3 BGP Prefix Rank 10 4 10 5
0.04
0.035
0.03
0.025
0.02
0.015
0.01
0.005
0 10 0 Distribution of IPs on ASs 10 1 10 2 AS Rank 10 3 10 4
Unique hosts per second