1. Peer-to-Peer Networks & Music File Sharing Tim Caserza COEN 150 Holliday6-2-04

2. Outline What is peer-to-peer? What is peer-to-peer? History of peer-to-peer History of peer-to-peer Peer-to-Peer network designs Peer-to-Peer network designs The RIAA, the law, and music file sharing The RIAA, the law, and music file sharing Peer-to-peer network security concerns Peer-to-peer network security concerns Conclusion Conclusion

3. What is Peer-to-Peer? Two main structures of network applications Two main structures of network applications Client/Server Client/Server Peer-to-Peer (P2P) Peer-to-Peer (P2P) Very simple example of client/server model: web servers Very simple example of client/server model: web servers User’s web browser (client) requests a page from a web server. The web server processes the request and returns the appropriate content, displayed in user’s browser. User’s web browser (client) requests a page from a web server. The web server processes the request and returns the appropriate content, displayed in user’s browser. Server never requests a page from client Server never requests a page from client Client disconnects from server once response is received Client disconnects from server once response is received One-way transfer One-way transfer

4. What is Peer-to-Peer? (continued) Another example of client/server model: File Transfer Protocol (FTP) Another example of client/server model: File Transfer Protocol (FTP) User (client) connects to FTP server. Client can browse files on server as well as upload and download files. User (client) connects to FTP server. Client can browse files on server as well as upload and download files. Server cannot request files from client. Server cannot request files from client. Only one file transfer at a time, multiple requests get queued. Only one file transfer at a time, multiple requests get queued. Client disconnects when he is finished. Client disconnects when he is finished.

5. That’s great and all, but you still haven’t told us what P2P is P2P P2P Everyone is both a client and a server (node) Everyone is both a client and a server (node) If you want a file from another user, you download it (client). If another user wants a file from you, they download it from you/you upload it to them (server). If you want a file from another user, you download it (client). If another user wants a file from you, they download it from you/you upload it to them (server). Multi-threaded: you can send and receive multiple files simultaneously. Multi-threaded: you can send and receive multiple files simultaneously. Nodes connected to each other through a network Nodes connected to each other through a network Clients disconnect when they are finished Clients disconnect when they are finished

6. History and Explanation of Peer-to-Peer Networks Usenet Usenet Napster Napster Gnutella Gnutella Gia Gia

7. Usenet Originally designed to allow a UNIX computer to dial into another computer, exchange files and disconnect Originally designed to allow a UNIX computer to dial into another computer, exchange files and disconnect Has grown into an enormous news network which uses the Network News Transport Protocol to enable a computer to efficiently find newsgroups and read and post messages Has grown into an enormous news network which uses the Network News Transport Protocol to enable a computer to efficiently find newsgroups and read and post messages Decentralized network– no one central authority, only thousands of individual nodes that allow users to search through newsgroups Decentralized network– no one central authority, only thousands of individual nodes that allow users to search through newsgroups Paved the way for modern P2P networks Paved the way for modern P2P networks

8. Napster Before Napster, music mainly shared through FTP servers Before Napster, music mainly shared through FTP servers Developed by Shawn Fanning in 1999 as a means for people around the world to download music files and share their own collections with other users on its network Developed by Shawn Fanning in 1999 as a means for people around the world to download music files and share their own collections with other users on its network Users connected to a centralized Napster server and the names of their shared files were sent and stored on the central server Users connected to a centralized Napster server and the names of their shared files were sent and stored on the central server To search, a request was sent to the Napster server, which searched its database for the requested song and replied with the locations of users on the network with the song available for download To search, a request was sent to the Napster server, which searched its database for the requested song and replied with the locations of users on the network with the song available for download Centralized server was the cause for the downfall of Napster Centralized server was the cause for the downfall of Napster

9. Gnutella The answer to centralized server problems The answer to centralized server problems Developed in 2000 by Justin Frankel and Tom Pepper Developed in 2000 by Justin Frankel and Tom Pepper Uses decentralized servers Uses decentralized servers If one server is shut down the network is still there If one server is shut down the network is still there Many servers are in other countries with different laws Many servers are in other countries with different laws Nearly impossible to shut down an entire network Nearly impossible to shut down an entire network Searching uses “flooding” Searching uses “flooding” A search sends a request to all its neighbor nodes, which search their shared folders and forward the search to all their neighbors, and so on until the entire network is searched A search sends a request to all its neighbor nodes, which search their shared folders and forward the search to all their neighbors, and so on until the entire network is searched Nodes are repeatedly searched many times Nodes are repeatedly searched many times Very inefficient, poor scalability Very inefficient, poor scalability

10. Problem With Napster and Gnutella Networks Developed by one or two programmers, rather than a team or group of programmers Developed by one or two programmers, rather than a team or group of programmers Did not have efficiency and scalability in mind Did not have efficiency and scalability in mind Popularity of file sharing has caused researchers to take interest in the future of P2P networks Popularity of file sharing has caused researchers to take interest in the future of P2P networks Researchers and engineers working to techniques to increase efficiency and scalability Researchers and engineers working to techniques to increase efficiency and scalability

11. Gia Still in development Still in development Search uses a random walk rather than flooding Search uses a random walk rather than flooding Each node asks a “random” neighbor, who asks a “random” neighbor Each node asks a “random” neighbor, who asks a “random” neighbor Every node is “smart” Every node is “smart” Aware of the connection speed and the number of shares on its neighbors Aware of the connection speed and the number of shares on its neighbors Random walks are biased towards nodes more capable of handling many requests Random walks are biased towards nodes more capable of handling many requests

12. Still Not There Yet Gia is much more efficient and scalable than Gnutella, but still not even close to the ideal solution Gia is much more efficient and scalable than Gnutella, but still not even close to the ideal solution Random walks are still very inefficient, but they greatly reduce duplicate queries of the same node in the same search Random walks are still very inefficient, but they greatly reduce duplicate queries of the same node in the same search Doesn’t flood the network Doesn’t flood the network

13. The Recording Industry Association of America (RIAA) A trade group that represents the recording industry and is responsible for recording and distributing 90% of the music in the U.S. A trade group that represents the recording industry and is responsible for recording and distributing 90% of the music in the U.S. Biggest opponent to using peer-to-peer file sharing for the purpose of sharing copyrighted files illegally Biggest opponent to using peer-to-peer file sharing for the purpose of sharing copyrighted files illegally Before Napster, the RIAA mainly dealt with tracking down illegal CD manufacturing facilities Before Napster, the RIAA mainly dealt with tracking down illegal CD manufacturing facilities Sued Napster for aiding its users in illegally distributing copyrighted music by providing a central server for anyone to connect to and distribute copyrighted music Sued Napster for aiding its users in illegally distributing copyrighted music by providing a central server for anyone to connect to and distribute copyrighted music

14. P2P Music Sharing’s Effect on the RIAA

15. The RIAA Takes Action January 2003 – RIAA begins filing subpoenas to ISPs to release the identities of the users that they had identified as illegally sharing large amounts of music January 2003 – RIAA begins filing subpoenas to ISPs to release the identities of the users that they had identified as illegally sharing large amounts of music September 2003 – RIAA files 261 copyright lawsuits against individuals September 2003 – RIAA files 261 copyright lawsuits against individuals Offered amnesty to any of the 261 who promised to stop illegally downloading and sharing music files Offered amnesty to any of the 261 who promised to stop illegally downloading and sharing music files One and only warning to people illegally sharing music One and only warning to people illegally sharing music

16. RIAA Lawsuit Statistics As of the end of March 2004: As of the end of March 2004: 1977 people have been sued 1977 people have been sued Thousands of small-scale sharers have received warnings Thousands of small-scale sharers have received warnings Roughly one-fifth of those sued by the RIAA have settled out of court with the RIAA Roughly one-fifth of those sued by the RIAA have settled out of court with the RIAA Average settlement: $3000 fine Average settlement: $3000 fine No lawsuits have been brought to trial yet No lawsuits have been brought to trial yet

17. How They Track Illegal File-Sharers Have programs to search the network for specific files that are being shared illegally Have programs to search the network for specific files that are being shared illegally IP addresses of any responses are recorded IP addresses of any responses are recorded RIAA determines the ISP hosting the IP address linked to illegally sharing files RIAA determines the ISP hosting the IP address linked to illegally sharing files Contacts the ISP Contacts the ISP Informs them of the illegal activity Informs them of the illegal activity Lets them know they will be sued if the offending material is not removed Lets them know they will be sued if the offending material is not removed ISP determines who was using the IP address at the time of the infraction ISP determines who was using the IP address at the time of the infraction Shuts off their internet access Shuts off their internet access Contacts them and inform them of the situation Contacts them and inform them of the situation

18. Problems With the Process RIAA might record wrong IP address RIAA might record wrong IP address IP spoofing utilities available IP spoofing utilities available Connections through proxies Connections through proxies Open-source P2P applications Open-source P2P applications ISP might connect wrong person with IP address ISP might connect wrong person with IP address “Sue first and ask questions later” attitude “Sue first and ask questions later” attitude Patriot Act allows subpoena of information of anyone suspected of illegal file-sharing Patriot Act allows subpoena of information of anyone suspected of illegal file-sharing Lawsuit can be filed once they have the information Lawsuit can be filed once they have the information Electronic Frontier Foundation (EFF) angered by the process and abuse of Patriot Act, defends those who have evidence to prove their innocence in court Electronic Frontier Foundation (EFF) angered by the process and abuse of Patriot Act, defends those who have evidence to prove their innocence in court

19. “Oops!” The RIAA Makes Some Mistakes Ross Plank Ross Plank Accused of sharing hundreds of Latin American music files on Kazaa Accused of sharing hundreds of Latin American music files on Kazaa Does not listen to Latin American music Does not listen to Latin American music Has never used Kazaa Has never used Kazaa His records show he was not using the IP address that the RIAA linked the address to the illegal file sharing at the time they linked it His records show he was not using the IP address that the RIAA linked the address to the illegal file sharing at the time they linked it Being defended by EFF Being defended by EFF

20. “Oops!” They Did it Again… Sarah Ward Sarah Ward 65-year-old teacher 65-year-old teacher Accused of sharing hundreds of music files illegally on Kazaa Accused of sharing hundreds of music files illegally on Kazaa Uses a Mac, which is unable to run Kazaa Uses a Mac, which is unable to run Kazaa Only evidence: 3 screen shots Only evidence: 3 screen shots Case dropped by RIAA weeks later Case dropped by RIAA weeks later

21. Study on the Security of P2P Networks Conducted by the U.S. House of Representatives Committee on Government reform in 2002-2003 Conducted by the U.S. House of Representatives Committee on Government reform in 2002-2003 Findings: Findings: Great deal of personal/confidential data being shared Great deal of personal/confidential data being shared Many viruses, worms, Trojan horses found propagating through network Many viruses, worms, Trojan horses found propagating through network Spyware and adware come with most P2P applications Spyware and adware come with most P2P applications

22. Personal/Confidential Information Shared On searches conducted by the committee using Kazaa, the following were found freely available: On searches conducted by the committee using Kazaa, the following were found freely available: Completed tax returns with social security numbers, income and investment info Medical records of military personnel and military medical supply records Confidential legal documents such as attorney-client communications regarding divorce proceedings and living wills Personal correspondence, including entire e-mail inboxes of individuals Business files, including contracts and personnel evaluations Campaign and political records and private correspondence with constituents Resumes with personal addresses, contact information, job histories, salary requirements, and references Default setting when Kazaa is installed is to have Kazaa find files on your computer to share Default setting when Kazaa is installed is to have Kazaa find files on your computer to share May find files you didn’t indend to share May find files you didn’t indend to share

23. Viruses, Worms, Trojan Horses in P2P Networks Easily spread by users who are not educated on malicious programs, and not cautions when downloading programs Easily spread by users who are not educated on malicious programs, and not cautions when downloading programs Report done by ZDNet found Report done by ZDNet found eight worms infected P2P networks between May and September 2002 Benjamin worm: Created and shared new Kazaa folders Masked itself as popular music and other multimedia files

24. Spyware and Adware Come with many P2P applications like Kazaa Come with many P2P applications like Kazaa Spyware: Spyware: Tracks surfing habits, purchases, etc. and reports info back to creators Tracks surfing habits, purchases, etc. and reports info back to creators Could be used to collect credit card information and other private information Could be used to collect credit card information and other private information Adware: Adware: Causes annoying pop-up ads to appear even when not surfing the internet Causes annoying pop-up ads to appear even when not surfing the internet Is not outlawed because accepting the EULA gives the application permission to install the spyware and adware Is not outlawed because accepting the EULA gives the application permission to install the spyware and adware

25. Conclusion Security issues need to be addressed in future P2P applications Security issues need to be addressed in future P2P applications Users of P2P networks need to be educated on how to properly use their P2P application Users of P2P networks need to be educated on how to properly use their P2P application Avoid sharing personal/confidential information Avoid sharing personal/confidential information Avoid spreading viruses, worms and Trojan Horses Avoid spreading viruses, worms and Trojan Horses Learn how to remove spyware and adware Learn how to remove spyware and adware Lawmakers need to be educated on P2P and constantly updated on it so the law stays up to date with the technology Lawmakers need to be educated on P2P and constantly updated on it so the law stays up to date with the technology