1. BotTorrent: Misusing BitTorrent to Launch DDoS Attacks Karim El Defrawy, Minas Gjoka, Athina Markopoulou UC Irvine

2. Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks? o Summary

3. Introduction oIn 2006, 60% of Internet traffic was due to peer-to-peer (P2P) protocols (Cache Logic) oBitTorrent is more than 35% by end of 2006 (Cache Logic) oMininova torrent search engine hit 2 billion downloads (Mininova - June 13 th 2007)

5. P2P traffic is rising

7. BitTorrent is responsible for a significant amount of P2P traffic

8. P2P based DDoS attacks recently observed o announced on May 14 th 2007 observing an increase in P2P based DDoS attacks o Attack based on the direct connect (DC) P2P system o Attack involved over 300 000 IPs o http://www.prolexic.com/news/20070514-alert.php

9. P2P based DDoS attacks recently observed o announced on May 14 th 2007 observing an increase in P2P based DDoS attacks o Attack based on the direct connect (DC) P2P system o Attack involved over 300 000 IPs o http://www.prolexic.com/news/20070514-alert.php P2P DDoS is already happening !

10. Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks? o Summary

11. How BitTorrent works? - User publishes torrents - Set up a tracker to coordinate the download

12. How BitTorrent works? - User publishes torrents - Set up a tracker to coordinate the download 1- Users download torrents

13. How BitTorrent works? - User publishes torrents - Set up a tracker to coordinate the download 1- Users download torrents 2- Users’ clients contact tracker to join swarm and get list of peers in swarm

14. How BitTorrent works? - User publishes torrents - Set up a tracker to coordinate the download 1- Users download torrents 2- Users’ clients contact tracker to join swarm and get list of peers in swarm 3- Download different parts of file from different peers

15. Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks? o Summary

16. Different attacks Entity FakedBT ModeRequirements Report Fake PeerCentralized Tracker Mode Send a spoofed message to tracker announcing victim as peer Report Fake TrackerCentralized Tracker Mode Publish torrents pointing to victim as a tracker (multi-tracker) Report Fake PeerDHT ModeSend fake BT PING message to DHT network spoofing source address of victim

17. Different attacks Entity FakedBT ModeRequirements Report Fake PeerCentralized Tracker Mode Send a spoofed message to tracker announcing victim as peer Report Fake TrackerCentralized Tracker Mode Publish torrents pointing to victim as a tracker (multi-tracker) Report Fake PeerDHT ModeSend fake BT PING message to DHT network spoofing source address of victim

18. How an attack faking tracker works? - Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents

19. How an attack faking tracker works? - Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents 1- Users download torrents with fake trackers pointing to victim

20. How an attack faking tracker works? - Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents 1- Users download torrents with fake trackers pointing to victim 2- Clients contact victim in hope of starting the download

21. How an attack faking tracker works? - Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents 1- Users download torrents with fake trackers pointing to victim 2- Clients contact victim in hope of starting the download ….

22. Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks? o Summary

23. Experiment Setup o Victim machine: Pentium 2, 512 Mbps RAM, Debian Linux, 100Mbps Ethernet, running a light HTTP server o Modified tracker reports a fake (high) number of seeders and leechers to search engine o Publish fake torrents on search engines o Wait ….

24. Proof of concept attack results Exp. # # Torrents Ports AttackedThroughput (Kbps)Total Unique # Hosts TCP Conn. Avg/sec New Host Interarrival Time (sec) Open (Freq)ClosedAvg a Max a I101 (1)662.77127.225331753.937.89 II251 (10)10137.78520.4551271400.743.62 III251 (1)501132.97380.3863201580.882.31 IV251 (50) + 1 (1)49+201176.69482.8580461440.173.44 a Excluding the initial transient period (6 hours) of the experiment

25. Number of TCP connections per second

26. Attack throughput

27. Amount of traffic from clients

28. Distribution of sources in the IP address space

29. o Attack sources in 2433 ASs on the Internet o Attack sources in 12424 announced BGP prefixes Mapping attack sources to ASs and BGP prefixes

30. Attack ports

31. Related Work oAttack using Overnet : poison around 7000 files to be effective (Naoumov - 2006) oAttack faking client: poison swarms of 1119 torrents to generate several thousand TCP connections (Cheung Sia - 2006) oAttack faking tracker is more effective: tracker is a central point in the architecture

32. Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks? o Summary

33. We contacted: oBitTorrent and Bram Cohen oSearch Engines: Mininova, Pirate Bay, BitTorrent Monster oClients developers: Azureus, Bitcomet oProlexic oResponse from Azureus developers only Reporting the problem

34. Solutions oHandshake between clients and trackers similar to the one between clients. oClients exchange view of trackers similar to exchanging view of peers. oMechanism to identify and trace the seeders of the fake torrents (based on hashes).

35. Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks? o Summary

36. Summary oPresented misusing BitTorrent to launch DDoS attacks oProof of concept attack implementation oAnalyzed characteristics of the attack oProposed fixes to BitTorrent to detect and prevent such attacks oCurrently implementing fixes

37. Questions ?

38. Thank you! keldefra@uci.edu mgjoka@uci.edu athina@uci.edu

39. Distribution of IPs on BGP Prefixes

40. Distribution of IPs on ASs

41. Unique hosts per second