1. The Case for DDoS Resistant Membership Management in P2P Systems
Xin Sun, Ruben Torres and Sanjay Rao
Internet Systems Lab
Purdue University
Hello, I’m Ruben Torres from Purdue University.
This work is targeted to control DDoS attacks created with clients of popular peer-to-peer systems to external hosts, which are not even part of the peer to peer network.

2. DDoS Attack Exploiting P2P Systems
Index for F M
<REQ F>
<RESP Sources>
REQ F
RESP victim A A
victim
<REQ F>
<F>
REQ F C
This is an example of an attack that we have done in KAD, very popular DHT based file sharing application. In this example, A is looking for file F. In the normal search process A contacts I who provides the information of C, which is the source the file. In the attack scenario, the malicious user provides the victim’s information. A sends a message to the victim who is not even part of the peer to peer system. We can imagine millions of users sending unnecessary traffic to the victim and filling up its access bandwidth.
Normal search process
Attack
Done in KAD (part of Emule) - DHT based file sharing application
4/14/2019
Internet Systems Lab - Purdue University

3. Interplay Between P2P Systems Design and System Exploitability
Some awareness about vulnerabilities with P2P systems, [Paxson ’01, Naumov ’06, Defrawy ’07, Sun ‘07]
Our Focus: Interplay between membership management mechanisms and the seriousness of the attacks possible
We identified design constructs in P2P systems exploitable to greatly amplify attack magnitudes:
Use of push-based mechanisms
Multiple logical IDs for one physical ID (e.g. IP address)
Poorly design mechanisms for validation based on active-probing
Attack magnitude of 700 Mbps on real KAD network.
Recently, there have been some works showing the problem, but we focus on the interplay between membership management mechanisms and the exploitability of the system. In particular, we have identified three mechanisms, some intrinsically exploitable, to greatly amplify the attack magnitude:
Use of push-based mechanisms. In KAD, this allow new users and users behind NAT be learnt by others. At the same time, malicious nodes use the same mechanism to push themselves into others routing tables, so they become popular and attract many queries.
Multiple logical IDs to one physical ID. In KAD, this allow several nodes behind the same NAT to connect to the P2P network. At the same time, malicious nodes include in a response many IDs to the victim’s IP address, causing multiple queries sent to the victim.
And poorly design mechanisms for validation. In KAD clients will verify every new membership information learnt.
4/14/2019
Internet Systems Lab - Purdue University

4. Solution: DDoS Resistant Membership Management
Main idea: self-validation of membership information
Active probing
Bound validation failures to prevent this being source of DDoS attack
No reliance on central authority
Resistant to benign validation (NATs, churn, packet loss)
To solve this problem, we propose a framework for self-validation of membership information. It is based on active probing but bounding the number of validation failures to the same IP or prefix to prevent DDoS attacks. No central authority that provides the good nodes; and that is resistant to benign validation failures.
4/14/2019
Internet Systems Lab - Purdue University

5. Internet Systems Lab - Purdue University
Current Status
Design and built initial prototype
Integrated with mature P2P systems:
KAD – File sharing
ESM - Video Broadcasting
Preliminary results are promising
For more information
Details on attack: “DDoS Attacks by Subverting Membership Management in P2P Systems”, NPSec in conjunction with ICNP 2007
Technical report in preparation
4/14/2019
Internet Systems Lab - Purdue University

6. Internet Systems Lab - Purdue University
Thanks! Contact: More information on this project:
4/14/2019
Internet Systems Lab - Purdue University

7. Internet Systems Lab - Purdue University
Real Attack with KAD
By exploiting the mechanisms described before, we performed an attack on the real KAD system. Peak attack magnitude of 700 Mbps observed at the victim (a PC in our lab).
More than 1 million concurrent users
200 attackers
15 hours period
4/14/2019
Internet Systems Lab - Purdue University