The Case for DDoS Resistant Membership Management in P2P Systems Xin Sun, Ruben Torres and Sanjay Rao Internet Systems Lab Purdue University Hello, I’m Ruben Torres from Purdue University. This work is targeted to control DDoS attacks created with clients of popular peer-to-peer systems to external hosts, which are not even part of the peer to peer network.

DDoS Attack Exploiting P2P Systems Index for F M <REQ F> <RESP Sources> REQ F RESP victim A A victim <REQ F> <F> REQ F C This is an example of an attack that we have done in KAD, very popular DHT based file sharing application. In this example, A is looking for file F. In the normal search process A contacts I who provides the information of C, which is the source the file. In the attack scenario, the malicious user provides the victim’s information. A sends a message to the victim who is not even part of the peer to peer system. We can imagine millions of users sending unnecessary traffic to the victim and filling up its access bandwidth. Normal search process Attack Done in KAD (part of Emule) - DHT based file sharing application 4/14/2019 Internet Systems Lab - Purdue University

Interplay Between P2P Systems Design and System Exploitability Some awareness about vulnerabilities with P2P systems, [Paxson ’01, Naumov ’06, Defrawy ’07, Sun ‘07] Our Focus: Interplay between membership management mechanisms and the seriousness of the attacks possible We identified design constructs in P2P systems exploitable to greatly amplify attack magnitudes: Use of push-based mechanisms Multiple logical IDs for one physical ID (e.g. IP address) Poorly design mechanisms for validation based on active-probing Attack magnitude of 700 Mbps on real KAD network. Recently, there have been some works showing the problem, but we focus on the interplay between membership management mechanisms and the exploitability of the system. In particular, we have identified three mechanisms, some intrinsically exploitable, to greatly amplify the attack magnitude: Use of push-based mechanisms. In KAD, this allow new users and users behind NAT be learnt by others. At the same time, malicious nodes use the same mechanism to push themselves into others routing tables, so they become popular and attract many queries. Multiple logical IDs to one physical ID. In KAD, this allow several nodes behind the same NAT to connect to the P2P network. At the same time, malicious nodes include in a response many IDs to the victim’s IP address, causing multiple queries sent to the victim. And poorly design mechanisms for validation. In KAD clients will verify every new membership information learnt. 4/14/2019 Internet Systems Lab - Purdue University

Solution: DDoS Resistant Membership Management Main idea: self-validation of membership information Active probing Bound validation failures to prevent this being source of DDoS attack No reliance on central authority Resistant to benign validation (NATs, churn, packet loss) To solve this problem, we propose a framework for self-validation of membership information. It is based on active probing but bounding the number of validation failures to the same IP or prefix to prevent DDoS attacks. No central authority that provides the good nodes; and that is resistant to benign validation failures. 4/14/2019 Internet Systems Lab - Purdue University

Internet Systems Lab - Purdue University Current Status Design and built initial prototype Integrated with mature P2P systems: KAD – File sharing ESM - Video Broadcasting Preliminary results are promising For more information Details on attack: “DDoS Attacks by Subverting Membership Management in P2P Systems”, NPSec 2007 - in conjunction with ICNP 2007 Technical report in preparation 4/14/2019 Internet Systems Lab - Purdue University

Internet Systems Lab - Purdue University Thanks! Contact: rtorresg@purdue.edu More information on this project: http://cobweb.ecn.purdue.edu/~isl/secp2p.htm 4/14/2019 Internet Systems Lab - Purdue University

Internet Systems Lab - Purdue University Real Attack with KAD By exploiting the mechanisms described before, we performed an attack on the real KAD system. Peak attack magnitude of 700 Mbps observed at the victim (a PC in our lab). More than 1 million concurrent users 200 attackers 15 hours period 4/14/2019 Internet Systems Lab - Purdue University