BotTorrent: Misusing BitTorrent to Launch DDoS Attacks Karim El Defrawy, Minas Gjoka, Athina Markopoulou UC Irvine

Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks? o Summary

Introduction oIn 2006, 60% of Internet traffic was due to peer-to-peer (P2P) protocols (Cache Logic) oBitTorrent is more than 35% by end of 2006 (Cache Logic) oMininova torrent search engine hit 2 billion downloads (Mininova - June 13 th 2007)

P2P traffic is rising

BitTorrent is responsible for a significant amount of P2P traffic

P2P based DDoS attacks recently observed o announced on May 14 th 2007 observing an increase in P2P based DDoS attacks o Attack based on the direct connect (DC) P2P system o Attack involved over IPs o

P2P based DDoS attacks recently observed o announced on May 14 th 2007 observing an increase in P2P based DDoS attacks o Attack based on the direct connect (DC) P2P system o Attack involved over IPs o P2P DDoS is already happening !

Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks? o Summary

How BitTorrent works? - User publishes torrents - Set up a tracker to coordinate the download

How BitTorrent works? - User publishes torrents - Set up a tracker to coordinate the download 1- Users download torrents

How BitTorrent works? - User publishes torrents - Set up a tracker to coordinate the download 1- Users download torrents 2- Users’ clients contact tracker to join swarm and get list of peers in swarm

How BitTorrent works? - User publishes torrents - Set up a tracker to coordinate the download 1- Users download torrents 2- Users’ clients contact tracker to join swarm and get list of peers in swarm 3- Download different parts of file from different peers

Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks? o Summary

Different attacks Entity FakedBT ModeRequirements Report Fake PeerCentralized Tracker Mode Send a spoofed message to tracker announcing victim as peer Report Fake TrackerCentralized Tracker Mode Publish torrents pointing to victim as a tracker (multi-tracker) Report Fake PeerDHT ModeSend fake BT PING message to DHT network spoofing source address of victim

Different attacks Entity FakedBT ModeRequirements Report Fake PeerCentralized Tracker Mode Send a spoofed message to tracker announcing victim as peer Report Fake TrackerCentralized Tracker Mode Publish torrents pointing to victim as a tracker (multi-tracker) Report Fake PeerDHT ModeSend fake BT PING message to DHT network spoofing source address of victim

How an attack faking tracker works? - Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents

How an attack faking tracker works? - Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents 1- Users download torrents with fake trackers pointing to victim

How an attack faking tracker works? - Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents 1- Users download torrents with fake trackers pointing to victim 2- Clients contact victim in hope of starting the download

How an attack faking tracker works? - Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents 1- Users download torrents with fake trackers pointing to victim 2- Clients contact victim in hope of starting the download ….

Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks? o Summary

Experiment Setup o Victim machine: Pentium 2, 512 Mbps RAM, Debian Linux, 100Mbps Ethernet, running a light HTTP server o Modified tracker reports a fake (high) number of seeders and leechers to search engine o Publish fake torrents on search engines o Wait ….

Proof of concept attack results Exp. # # Torrents Ports AttackedThroughput (Kbps)Total Unique # Hosts TCP Conn. Avg/sec New Host Interarrival Time (sec) Open (Freq)ClosedAvg a Max a I101 (1) II251 (10) III251 (1) IV251 (50) + 1 (1) a Excluding the initial transient period (6 hours) of the experiment

Number of TCP connections per second

Attack throughput

Amount of traffic from clients

Distribution of sources in the IP address space

o Attack sources in 2433 ASs on the Internet o Attack sources in announced BGP prefixes Mapping attack sources to ASs and BGP prefixes

Attack ports

Related Work oAttack using Overnet : poison around 7000 files to be effective (Naoumov ) oAttack faking client: poison swarms of 1119 torrents to generate several thousand TCP connections (Cheung Sia ) oAttack faking tracker is more effective: tracker is a central point in the architecture

Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks? o Summary

We contacted: oBitTorrent and Bram Cohen oSearch Engines: Mininova, Pirate Bay, BitTorrent Monster oClients developers: Azureus, Bitcomet oProlexic oResponse from Azureus developers only Reporting the problem

Solutions oHandshake between clients and trackers similar to the one between clients. oClients exchange view of trackers similar to exchanging view of peers. oMechanism to identify and trace the seeders of the fake torrents (based on hashes).

Outline o Introduction o How BitTorrent works o Using BitTorrent to launch DDoS attacks o Experiment details and results o Can we fix BitTorrent to prevent such attacks? o Summary

Summary oPresented misusing BitTorrent to launch DDoS attacks oProof of concept attack implementation oAnalyzed characteristics of the attack oProposed fixes to BitTorrent to detect and prevent such attacks oCurrently implementing fixes

Questions ?

Thank you!

Distribution of IPs on BGP Prefixes

Distribution of IPs on ASs

Unique hosts per second