BotTorrent: Misusing BitTorrent to Launch DDoS Attacks

1. BotTorrent: Misusing BitTorrent to Launch DDoS Attacks Karim El Defrawy, Minas Gjoka, Athina Markopoulou UC Irvine

2. Outline • Introduction • How BitTorrent works • Using BitTorrent to launch DDoS attacks • Experiment details and results • Can we fix BitTorrent to prevent such attacks? • Summary

3. Introduction • In 2006, 60% of Internet traffic was due to peer-to-peer (P2P) protocols (Cache Logic) • BitTorrent is more than 35% by end of 2006 (Cache Logic) • Mininova torrent search engine hit 2 billion downloads (Mininova - June 13th 2007)

5. P2P traffic is rising

7. BitTorrent is responsible for a significant amount of P2P traffic

8. P2P based DDoS attacks recently observed • announced on May 14th 2007 observing an increase in P2P based DDoS attacks • Attack based on the direct connect (DC) P2P system • Attack involved over 300 000 IPs • http://www.prolexic.com/news/20070514-alert.php

9. P2P based DDoS attacks recently observed • announced on May 14th 2007 observing an increase in P2P based DDoS attacks • Attack based on the direct connect (DC) P2P system • Attack involved over 300 000 IPs • http://www.prolexic.com/news/20070514-alert.php P2P DDoS is already happening !

10. Outline • Introduction • How BitTorrent works • Using BitTorrent to launch DDoS attacks • Experiment details and results • Can we fix BitTorrent to prevent such attacks? • Summary

11. How BitTorrent works? - User publishes torrents - Set up a tracker to coordinate the download

12. How BitTorrent works? - User publishes torrents - Set up a tracker to coordinate the download 1- Users download torrents

13. How BitTorrent works? - User publishes torrents - Set up a tracker to coordinate the download 1- Users download torrents 2- Users’ clients contact tracker to join swarm and get list of peers in swarm

14. How BitTorrent works? - User publishes torrents - Set up a tracker to coordinate the download 1- Users download torrents 2- Users’ clients contact tracker to join swarm and get list of peers in swarm 3- Download different parts of file from different peers

15. Outline • Introduction • How BitTorrent works • Using BitTorrent to launch DDoS attacks • Experiment details and results • Can we fix BitTorrent to prevent such attacks? • Summary

16. Different attacks

17. Different attacks

18. How an attack faking tracker works? - Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents

19. How an attack faking tracker works? - Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents 1- Users download torrents with fake trackers pointing to victim

20. How an attack faking tracker works? - Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents 1- Users download torrents with fake trackers pointing to victim 2- Clients contact victim in hope of starting the download

21. How an attack faking tracker works? - Attacker publishes fake torrents with multiple tracker entries (or single) - Set up a tracker to report high number of seeders and leechers for these torrents 1- Users download torrents with fake trackers pointing to victim 2- Clients contact victim in hope of starting the download ….

22. Outline • Introduction • How BitTorrent works • Using BitTorrent to launch DDoS attacks • Experiment details and results • Can we fix BitTorrent to prevent such attacks? • Summary

23. Experiment Setup • Victim machine: Pentium 2, 512 Mbps RAM, Debian Linux, 100Mbps Ethernet, running a light HTTP server • Modified tracker reports a fake (high) number of seeders and leechers to search engine • Publish fake torrents on search engines • Wait ….

24. Proof of concept attack results a Excluding the initial transient period (6 hours) of the experiment

25. Number of TCP connections per second

26. Attack throughput

27. Amount of traffic from clients

28. Distribution of sources in the IP address space

29. Mapping attack sources to ASs and BGP prefixes • Attack sources in 2433 ASs on the Internet • Attack sources in 12424 announced BGP prefixes

30. Attack ports

31. Related Work • Attack using Overnet : poison around 7000 files to be effective (Naoumov - 2006) • Attack faking client: poison swarms of 1119 torrents to generate several thousand TCP connections (Cheung Sia - 2006) • Attack faking tracker is more effective: tracker is a central point in the architecture

32. Outline • Introduction • How BitTorrent works • Using BitTorrent to launch DDoS attacks • Experiment details and results • Can we fix BitTorrent to prevent such attacks? • Summary

33. Reporting the problem • We contacted: • BitTorrent and Bram Cohen • Search Engines: Mininova, Pirate Bay, BitTorrent Monster • Clients developers: Azureus, Bitcomet • Prolexic • Response from Azureus developers only

34. Solutions • Handshake between clients and trackers similar to the one between clients. • Clients exchange view of trackers similar to exchanging view of peers. • Mechanism to identify and trace the seeders of the fake torrents (based on hashes).

35. Outline • Introduction • How BitTorrent works • Using BitTorrent to launch DDoS attacks • Experiment details and results • Can we fix BitTorrent to prevent such attacks? • Summary

36. Summary • Presented misusing BitTorrent to launch DDoS attacks • Proof of concept attack implementation • Analyzed characteristics of the attack • Proposed fixes to BitTorrent to detect and prevent such attacks • Currently implementing fixes

37. Questions ?

38. Thank you! keldefra@uci.edu mgjoka@uci.edu athina@uci.edu

39. Distribution of IPs on BGP Prefixes

40. Distribution of IPs on ASs

41. Unique hosts per second